evilquest | e028ddbb66573396fda4edec6b7dbb0bce8a65bc7d842079c847421576731f10

Analysis

max time kernel
150s
max time network
147s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07-04-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest
Size

177KB
MD5

8884051442de72071c3e007ef1438c72
SHA1

737dcc4257d8fa42868644b6f51d2877d1d2c9f7
SHA256

e028ddbb66573396fda4edec6b7dbb0bce8a65bc7d842079c847421576731f10
SHA512

4385062f75738c31ff5e7a938221ff152137fab49207f39ea45a5f2fc0094f152cd499cfcb5deb98407998a293c0ef353d0b5c110bfc79d16b834e4d9d219f26
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9SI0t:5SeOQdaZNxtk8cqhSxvHY9Q

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008b1b9-3.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-6.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-13.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-20.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-25.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-34.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-41.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-48.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-55.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-59.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-73.dat	family_evilquest
behavioral1/files/0x000000030008b1b9-84.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 34 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Launchctl 1 TTPs 60 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest\""
1⤵
PID:549

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest\""
1⤵
PID:549

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest
1⤵
PID:549
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest
  2⤵
  PID:550
- /Users/run/2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest
  /Users/run/2024-04-07_8884051442de72071c3e007ef1438c72_adload_evilquest
  2⤵
  PID:550

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:575

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:576

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:576

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:578

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:578

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:579

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:579

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:580

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:580
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:581

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:582

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:582

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:582

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:583

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:583

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:583

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:586

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:587

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:588

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:588

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:591

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:596

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:597

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:597

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:597

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:601

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:602

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:604

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:604

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:607

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater6BDB2703/OneDrive.app
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:630

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:630
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:631

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:633

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:633

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:634

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:635

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:636

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:638

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:638
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:640

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:653

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:653
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:665

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:665

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:668

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:670

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:670

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:670

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:671

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:671

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:671

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:672

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:672

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:676

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:677

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:677

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:677

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:678

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:680

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:680
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:681

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:682

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:683

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:683
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:684

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:685

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:685

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:685

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:686

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:687

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:688

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:688

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:688

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:689

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:689

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:689

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:690

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:690
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:691

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:692

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:692

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:692

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:693

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:694

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:695

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:696

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:696

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:696

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:697

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:697
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:698

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:699

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:699

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:699

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:701

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:702

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:703

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:704

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:704
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:705

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:706

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:706

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:706

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
44420d17b8646d4ca159e6e5b83a975a

SHA1
c0172f67e4b0ebb8920b647a43c26b135fa2ce94

SHA256
bce3de2446984259d1666091e632c863b48fbe64a1824561820f61e87ec55b3b

SHA512
b966bb9af3ade7931957fd702e32beac8ceb693f4f50f60302d20695fb36ed4032ecd252ca0ab7780550a1fb4292fd3195c7311ab64ecb283de4f627d857828d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2b70bca59cc52874e282f6cd40e6e18d

SHA1
bd1abe3ef75360990adf0d89a2f1e4e2f6dcee8e

SHA256
b0182f495075132c6a627f0a1e7e122a082ca70e9c8226725d2cf87808d10516

SHA512
d771785b42728969145fbfe3aa070a300b3acdc543bed0763052e52f1093a77ebe72805f25fa590de525790da575b1c2635673282a5cd9393562ce2aaaf6ea98

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f6d88ea941e611856cc9598091024461

SHA1
aa3b86b465764df32868a9ab8de95dfffb7abc76

SHA256
cf8bad1d11c102e1b9e47844848a3ea070a7aaa4249e534cfcc5aee3b91c2836

SHA512
4d5664d2626696c7e9f6930281a91a659d775cd4ae57c357b2f3907de022e43e190edabd97d3e30f343ca57dd3a09d3e24383a4ee26b109242c18bcdb30be076

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ecddc1a3985e4667e8fb9881b3d1f019

SHA1
7b64365af15dc33ab7eafe1355086c85ac65baf3

SHA256
479fe6f667763ea89e088a0937e177a968155132715fb26b9b27f294bcca208d

SHA512
4c5984054544ee01ce5a4761520983dd51ad0d859a4db7b381123ce84ed1f2501a09d164e2fd1309239c0e4714f529f154a516549ed6c778974c1f869804b91b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
72c2b69bebb09fe92689f883556342b6

SHA1
a284cc877fc2b6b1a6cc7ac5b909e03d7bc4e433

SHA256
e7e2b1c4e2f10417eab9485476af1e016b1af1bc6e23a105fdf9731b6f24eeed

SHA512
7614748826b796db11a2efb58858550efa23a503f11b11ddf33b3bad66b8ee415cd13c0a1687df133c6f0bf06de69730fbd0dc720a68333d72ed884a7a31a32e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
dad79569730720b616649a876fa49755

SHA1
82685daa33be35be17c11467e0837349325c8659

SHA256
815025838523e5fc2c44c7278268386f0c7d14360d53e11c9090e1e463121eec

SHA512
e0096b65db49dea804d7a6e3176445f0909130559632e638212eb7cbf183496becc0fb2495a41a968d9b9f309eaae3a1bf4173742c75b3f5a468d142be381eea

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f09aaaf61600c50a0a0656aa89569045

SHA1
f607765993b5fc37b9b7ef4e2e01799c24bfee66

SHA256
741d63bdd0eff21b5c3c7870d8cd50b4eb781c2289d35fb6193f09da3375ce19

SHA512
60aa75d7ebb2704db4624f225d5c5203659294c4a041b935d5cfa3b70b58d40c1b77482c4f61c554de7a457b77eac6652dba93960a290bbadc381ccaafd9089c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
adedb55d625ba8ca107d0e022335009b

SHA1
143a3a953c7a70dc0d37ead58660e6ddd8bb5b3d

SHA256
e66c68748e0f117c580f8f35d1b35b7081c02f32e3e95f067f6b78104903f8f8

SHA512
408c5c9ce5e7b00530dbee254c63abfb437d701230486465e9379ed7b7555bd28d158de3ef80bf59e25f4bad6fca34bfd5fa8af87b3efc005c7bb83e13cd64d8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
06a9b60fc96bc4bb6a1206bb56966d2a

SHA1
bc2967b6ed0ca97b72977078511b916d6db71ce0

SHA256
d6de4648a3ca43749d4827c5e0838682e1ebdac28250765d9c95607f475961eb

SHA512
d1772b11aba446ef2c6c386d2d82315813fcdf431198139c5d0d1e7ca1ad9b187c33d67bd14fc240512b0282f6a67408470092e6e5c6382d1df8030fb9eb32fe

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
158B

MD5
ddc0ea48ed054650826434a59b5908f9

SHA1
5575ae0deb308ca3cd721ffc330f4f009f35f706

SHA256
43f2febcdc02efddc36d9c9a677b5b912ebe70def99c12891b7b28047a4eb396

SHA512
b0854a7448f4436e9b1701e65f799cb85800fdb282ebcc58e060712b2844d7bd6c07e570b91bef480495213c3d5fa8ed4a6bb115eecdf844f32b9e06dc82e040

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
547c36b183892320d8c52242e4967d9c

SHA1
cd88f59c6c97029e55a80058ba710a08e375e75b

SHA256
648d194e5667c453876a84915c29abbbf34e2cefb06ff87f4bdbad3482d07adc

SHA512
e43067bee532383d5370a2b2591100d8f914b1bcd60a845abc28e7a9628b4425979828ea716a6cc188766838f773034833e2ac6a80e86d4c607c62f2f96cf6e9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
54755405c34d400e26fadcc8656e68e4

SHA1
eabb0b5a31a79b37a97aef917d42b618ea1df3ea

SHA256
57b300b56826dab6875b9286c04be8da1435bcb81669124c0b2e32eae4d5ee6b

SHA512
55db692421d71c29f5d1a0dbc29744c0977043b81bdf1073610295a5f5d8edb072eb199f9317f104042e9f63735784e34897dd629154271c6ab636d05dc4716a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e885a18d73bbf9a54707700a92a1c3e8

SHA1
be278e0c19403a1479a853ba5b3d04a3c836a141

SHA256
69f62bf441fd6134ee8728be8386166b0b497ad96619b06a566f0175f2c2a2a6

SHA512
1848b9a97fef7a176564d266c06d412022981d40477813304dc39f0d48ff2a60238b04af3c6eb427c3f2b952e0dc4915bcb0c00a1901833ace51736bdf46446b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
f1f9ca5d897ad73f6ba0a4689a9675e0

SHA1
cc3eff47a41553eba354180d07c189f668bfce60

SHA256
686ca2aa60ee1dd77c19443bf3938053937977fa9503ea5e7b683727b227ef47

SHA512
4fce2b287d45fb4f963db8a3fd2ce662840086e2f2d46ee7bd7956c92dfe35fe53d6da841b0d814681bf5efaa948f59282a6e01491e24362969df7efb5092b35

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
47510d6e377f905daa8334cd580be62f

SHA1
080565bf6c544dc09cb5d9e766025b89ddf64261

SHA256
7ee6c35c7692aca737fd42cfea9ca932cffdb11d9401c3722922cfd5c925b523

SHA512
9858cf1f815ac8597a7adc30e158444cfbdc65daf89166f8db23907b4733b1b184c6f5d167e0c5b469a1cbfa03cd061c84968cf4f01f933804c11a0b1a4547d0

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
251e8d94df4c2528932fd2949cac208c

SHA1
c818016f1a250702c69623e451180a69fdf8e984

SHA256
a3262910edcd6510d7d660ce764fbf1b0092cfbc2747bda72b6bd4ee5513e478

SHA512
cb12815e53d2ad943dbe28361f3017133c9f35840bfdef5627a15d6612b707d8d2abbf287d0c2b53a3ad91bf7a0d7615e8002f417ce691920933b66df7f44dae

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e72130ea3c569cd55b1b6e4cbd7e89b5

SHA1
eca722c6915683ef54d997ad723405181483cb5a

SHA256
e97669dee1cf3e54e5972d536707773f6d69833a89bfffd066a5c897757ceef2

SHA512
c20994a56844047da449bfe6c9b40ab04c5b1499060ef036e4ee8dae50a3f66c03623c9f4d7fdcd4003991cf695e5e79d57870395dbc5f0e2b9fa29c2181d8ff

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
fcabec0d3e58a421535954a23b3d0f1d

SHA1
791b26ea6de9fff95012b47f263c58e38652de46

SHA256
4146a4aaa956c9aa2b9ec6756ab19e07795caeff7708260f34cd424ac324d9ef

SHA512
cea95111665d62fc454e62f6da4a916ebd5cd8f251b43b438903ef5d7368a17f9eb2233c458e88d6f2f7c59a1bc0c283b3401210f94f8d2225949579a7e638a3

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
f251a6f2ecd4ee9280ad46818bed237d

SHA1
821550f89ec6d7c20b1450c789136b8639d98a7a

SHA256
b859bcea5c123510adbc68f9c6b3512c8f9177482895319a16f8a14d666daec6

SHA512
e802fed3dddf8837ce7abeb716183c147e4b0c34aa4f2cc074c6246042065de1be2accc645f8a9676bc1c048ade38c00625b01ecfd461c0e8d31b6a1ae5be776

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
ba5b972e01c7cb0c91f367b572448b5a

SHA1
af3bde6f5abee1307bfb5c597caff4d11dd51d19

SHA256
cedb152b3507f4718440eec6131daa20433d9aee8a12c513a16b45124b56d0c8

SHA512
b86e27e6f8bc589bfda6355f113b52a0803d80413abfc81eda2d8f011ec664757c7675ef3a23d3cf30d31d7b83e1fe22768161daa66903cfb685233a9a5713a5

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-04-07-054718_tests-iMac.crash

Filesize
40KB

MD5
6456e72df13d927e4981fd64e2e2a32b

SHA1
e07312ff005388d5bc787327d23fc823b644baac

SHA256
9072a7dd781691c416e430836d67bffbb78068503feb39852a30be5bbae8bff3

SHA512
2022cad1c528877099b32269a5a3e66a0459b7493d91cca2f804434849f943a861b78372f165137e993e3d179ccb8b3dba1ed992e865af9d54a7bfc5a7d17d2b

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-04-07-054728_tests-iMac.crash

Filesize
40KB

MD5
5daebdd46a08ad7e69e10929cb25ef23

SHA1
2decfcc3165b7745b7ad0546bd8bd4a0f58aa8fe

SHA256
f164a05c3d297ca6651dc282f6e94a2497e3638d13992af07563cdd859341260

SHA512
13f2496ffdd80f6b83b552a6b9b639e0849d3374d12d29fffcdfc4546e3ae91b08ad7fe8bd8c696b26b556ed8b5d62a9e9de2a26f1b3dd28e5f7ad8dab620902

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9d9ab7e7f5ec5a84a429f67e36051695

SHA1
ed6fde7b917647027d461db8786f6b31bae22caa

SHA256
75832b2c5e6ddb8e4358f2967f46f1f73ad4137e935df36b77aa30567d8ceec1

SHA512
3b8f92f46832d2b30de8e2f5521099b0cd39a0fd3f0dbabae07cc67a5496704863b0d59cc08258fa8114f9de6dcdf091363a8c39fcd41596e90eb228709c77a3

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9048d95b53f6c267d7fcb7d60cc129fa

SHA1
cd9a0e9d863fa34e94d0a98d1fdfd2ba8cfc8842

SHA256
e521726e69468953430e7a00f3f4317e0c07ef74de98f2504823cdde287eb5d9

SHA512
eb9e920e6e97e4585ce867ca0918af0440bb12ea88f12f234fdfd59f09ef235553d25b75440f99d0784cfcd9f14ce253257ca4381a040ea8bb6ebf4a33851f66

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8bf5912c7eedd3c3d20ed349db5e447a

SHA1
0df434653e498aaa6b22175d749e3a1e526b2c15

SHA256
5cb7861c384fd2f0c7fe0fd597598b2da072fb006132db029f7cdbdcd00cf3bf

SHA512
8fa0ab8067f98a1527633edd2771d8bee7f265607820780c4ff3880e6469b853884073c1c303c401c881d764cc31e5c9df41f8ece34d38c90782cbf91a9faae4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b8586109195f164af651aab437b0da11

SHA1
4f4e12a5db5cdc5a20d4fc7a44842d8ceecd9219

SHA256
9fccb85a17dcaf7264942a1825969f3f200eab0de166fa98ea4aeda733f19c09

SHA512
abc2572157318f4c3ac128ab7e3b2f47fce53641dd26a95c0645675456baa202e0feee8a7cb507d77535de7985d1efdb5e36e61de70c56dafa6f2101f5f2bc4a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2007407ca1ed558db405367ec21aa813

SHA1
d19e654ed1a8711887c24f7bdcbb64e476493bfd

SHA256
fa84e351575ba63d3497f2b048099f77b3883fbfc5e2d5815f3ad1a5bc0b1081

SHA512
346e01e230ff5fdbea788de1771eb2341af20ff7878fa12b196e648256ce7ca0427d8bec9debf34a23d8355c123523ac72440b5ea214d78c6e4bd7330a22e2a6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ffb2e6a93afe48a4a8fa3145a9ed08ac

SHA1
10bf115e0bd2fb08ddfac23c628feb026d49885c

SHA256
a7f641ed4ca4c92c5fb4fc71b4edac108b4c1ec5b64c9e74a712907340c44a88

SHA512
59922ddbefac4318a9f8fcb1e04330bc2850ceb0a6d4ebcc49ae287a9f8e8a8591d39b1befd3d362854240ae3a46e3f04565dc385ac232a19813e8bfc9aade21

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
927dc67b06f212cb22217182a0f89007

SHA1
98b837f4fd0f9c00e13eae5d084677282df832d7

SHA256
3822ee7d966d2ae255f92d99d59bd7c1afbd7040b741405a81a85a35052c2111

SHA512
1c11512ab084724329c00e38394591bb2efccabdeb8a1fa1083850ced468c2e3c36b095eb2dea8a17ce1a420e1e153fd55bcb959706a797dd9dc668116931b87

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
28aa59c7234715c393971a5b8d31fde3

SHA1
67681b15d7a04c25f074def2d090d52acfa4c9de

SHA256
912a14bfe4971e141cf30f10a4ae9535724bbe75d44834b93084fa76abac507c

SHA512
cc2e08123bc573c45226a260fa4eeab8f55ca2a9f3c2abec55b9f0bac917e2201b0e4508073a5e2d58a8aa978539206f7916bcddb7f50d4f0647c75fd263e956

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6eb57c6343aa7099525f72cc0b0cf5e5

SHA1
9bc94da66fa00b0e33ef5ec6046b89c968b642bd

SHA256
99091c4e9c5accecaa01d1b1e39ea20220199200066bcc4258704605bdb8ae8d

SHA512
c858febd8361ed9ba5be088bc823a7dc2892b5f2cd48c1b9363bd05329858d42b62c46465d5b49d8abd09c79940f098a3eecd39b787370905219bea0b7701647

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
da9820e23147dc51e23146242338abdd

SHA1
b052a9aeb63f55d7a5be0c9b164c3598d3dc8d84

SHA256
24cecdd4d2fd565522d2a47480369548c5c6ea06b858c149aa317b820e7a7bdf

SHA512
d14f5fae237b8957fa714ec0ab8af48174b9715df0eb82ae1723d46644b2945a561be883ffed552d6b086b7968e97e8bd620cbb334665f73fc696452a1a5aee4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6808436fb70418e6f6aa29f268006d40

SHA1
5d2d27a6de9e3d8099aaeb308c5b2c1f6c904857

SHA256
abe677db6a3458e7b36d6b674723162a261cef20d4d4c11952b3c69de5f5ae8f

SHA512
92060d4c6620c5535ae4fdcd5b66e4fd9353e037f17375aba1c97e57a744d4dbc9c9f5134789c7bc720b38cb5fc4e9cf5e83eaac8bb1370118b3f0830a8b0836

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ed1fa4ca5ad6ac119097e2ebec3719ad

SHA1
22f7c02397533df4edb53e477a7e8786cf4eb668

SHA256
d6e7159bd48f2a6eb982e5cb1125dbad44e975a98ce905ea76d299713aeec79f

SHA512
1985a158352fe38d727190ed25dfdee1d9a0d0d02349e4fbd18aa578fe02bc31c716d3a76783bf34e59468cabf2d522168d8e134dbf1c6defc7e9b08902c67f1

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit