evilquest | 4cd4e665843c28855bbaca36b6e3608e212b61c5ea659a1386789405de218bc0

Analysis

max time kernel
146s
max time network
136s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
12-04-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest
Size

305KB
MD5

4954266522932ddb434e780f3b88fef2
SHA1

a45cda9c7c9923b0f557f674b7a9eba1d1073744
SHA256

4cd4e665843c28855bbaca36b6e3608e212b61c5ea659a1386789405de218bc0
SHA512

44bc610e380650012175ee236ae086397f7048baef9cfba6971df4aa29a6e4efdf22a9be00b6c7f798fa5a641a39618adbb475a57a8d135c4844ad311abdd3bc
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9E755Sx8GpdlXmVkO:5LOQdaDxq8cqavHYK75kxkj

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 12 IoCs

Processes:

resource	yara_rule
/Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 37 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest\""
1⤵
PID:552

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest\""
1⤵
PID:552

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest
1⤵
PID:552
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest
  2⤵
  PID:554
- /Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest
  /Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest
  2⤵
  PID:554

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:555

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:555

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:578

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:578

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:580

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:580

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:581

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:581

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:582

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:582
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:586

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:583

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:583

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:583

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:585

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:585

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:589

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:589

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:594

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:596

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:601

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:602

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:603

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:604

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:604

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:604

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:608

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:608

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:618

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:621

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:624

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:625

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:626

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:628

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:629

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:631

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:631

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:631

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:635

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:636

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:637

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:638

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:639

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:639

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:639

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:640

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:640

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:640

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:641

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:641

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:643

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:643
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:644

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:646

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:646

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:648

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:649

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:651

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:657

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:657

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:659

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:662

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:663

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:667

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:668

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:668

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:668

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:669

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:669

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:669

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:670

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:670

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:672

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:677

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:678

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:679

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:680

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:681

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:682

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:683

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:683
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:684

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:685

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:685

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:685

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:687

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:687
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:688

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:689

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:689

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:689

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:690

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:691

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:691
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:692

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:693

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:693

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:693

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:694

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:694

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:695

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:695
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:696

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:697

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:697

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:697

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:698

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:698

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:698

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:699

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:699

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:699

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:700

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:700

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:700

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:701

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:701

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:701

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:702

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:702
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:703

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:704

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:704

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:704

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:705

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
dc88d6355eadbdb43e8f8cc4bef96562

SHA1
ca994d6b37103802407ffb584afab777c158a2d4

SHA256
d7ce04ce19e20df12f629165db2d2fad4530e5cdef60b462fdc52e6428c6d9a6

SHA512
50efb6615c7e5a16791602310c63a86ea1c9851aca763004fb02e5db80f12d003f88315049c7c08ddc89d1b9f760aa8cd232a776edc1b1e41821db577a54bd28

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f881db2ff08563ed5e3fdea85f9dfa6a

SHA1
e28695cdf014a2c517062e7d3afd689762951a40

SHA256
694be9200129e7eb0e8672dd88f38c06bdc71c949c32fdfbdb4d9a101a6c8d7f

SHA512
7a76833286fc04bc23701b2e57bfb37949e5a4f2c0ed7d9dec32b3672b656aea3081c3b1ae54b77026ec83c4e7fa02e0796080e65361588dd222b78f85d47abd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1fa0fc1784e26934ae4980559440c8b0

SHA1
e69bbc47a9e944e21fa6a18842b0f9346ad978ae

SHA256
7ec5fa2d7138aea060912d2c0e5f5655a7f0246079311c32f0f58cb687ed2f61

SHA512
1990fa3fac9cca58dcdab0265e87be120125a9fcf2fdcf53ff2a8194112709f7257f1025e86ee19dc47b945b9de6da3d1cbc325d148d5cb4bef4693adb6ea69f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2e4ea2fd8faefe5bceb590cba4874439

SHA1
b7d4c443cdd078bcaf8b368201b2a2234e793695

SHA256
7d172a85d97094cea62a07c623d656459cd06b1d1a91d754c9832075fd2891c8

SHA512
5b9c3590cd23fb9651079ffa76d83c730b6dc89ead8267838695891483fb9698cdef73964574afe3cfe764100a5435c8c95b108966d2516b81518ae38640f114

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cf0a9c16b2bbc797d74d4712049b1273

SHA1
ef6d4fbf8087aba33be274db79af620daf5f9e77

SHA256
aa406bed673bacc428454fbb5ed11741e114230374a187fdd6c2c280fb79a69e

SHA512
229931eb129f3186ae9f215de79c5486eda5aea53a2d5a56ea003c789ce04d8b40c2dd3f5ccf11d8419f88ea4f9c4c037544a975664d7db795ff879f5a90bfe0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
158B

MD5
a72d144a0e0810f0dec49d26c65a2949

SHA1
a66b2b9d337bcf89cce580a472ecee32e641c393

SHA256
50201176378b94b292be5ad40858ce80b19d120300f1ed8665698378cd293aa8

SHA512
486d494620c5835156b23e9dcad7349fb6ab22a153802cace94c1106032ddf80574ddd542d2812e59dbe4b17b68766a50011012f4e47c33f8b937ff8306fdfaf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2623d464d183f545bf544209e5fa70d4

SHA1
ccebe740dee4aa581188147baa589d0b348bd1f0

SHA256
b21b3d260b6cf5cd97e1fa8760f67411829216a68c9e0bc88ba7c3f431644e78

SHA512
c874e0f3b1f28311ffecb39c8c6f5ea7a39e7aa80b69d6847887fbc3da133bf7aaa239ed8d768b161c4ec7c4653a77be64dd628ac678a90edefe8ffa5f6a7164

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
158B

MD5
27b07523bdd57d44f96f2375ba45168d

SHA1
167a960b40f2d4a000305d6a9f45104e95821def

SHA256
8ffec808ce56a289664e106b1f9bdb171da7b233e50fd3ce96f620eade0fcdd3

SHA512
a200184535962cdb45f8eb93c4a22db15ac1bdde9f6ad4363fa8ef281f1e2a474b955defd74de4d57d8ffa2e743f361e2e506c32d61cdf7577f5c06db8729fd2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
29431b4dfeaba233af2d6be51085ab48

SHA1
f712934cd928e611b63284fc61d6122bbd46cb55

SHA256
b0b4aaf23c9c015caffc062ea9142a13cc119abd1886fe9bd9b891efd8500880

SHA512
9d98235ab308ef829d12f400ad614fa7327936590c6549ddaf886cb8071992699fd716d781573e6678c806b013243347c3b1225ea133da3c5a1cdfdb39ef09a8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b68e1750a693bf629f0ff4bd3b36b6d7

SHA1
1bb0bb554750e048f9a2df30cfe3f6d9b6b5e7ee

SHA256
022aa37413154d3762a411e514edca1262c5e9d7ea4de9ab0797d68adfc28dfa

SHA512
bf69c3f344bbdd4e9f795aea32a9e79e7a69a194260a68df440a3bf00540edfd17b78cd49f3d09255cf7ca4e6d7235ee49f2e4dfee6d8e136e7beecb3a27d91d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cd289f322c66e58a01a78170c623c7ca

SHA1
2c34029efcf33d5e40b00c324bd159dbf7cfa911

SHA256
6ac87bd4e6332a97b9138d4d74314c845afc7c66fad7ba386e4845fb8b0acca5

SHA512
41355603a8e69bdb34c8e28cfaba71f37bc16c8a2ff39cd36d0e24860ca06e5cb4890fdbd1c841b2086b3e17fff2ce154922c445b81addd9c2af3048804c3801

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ad4957977aa88767cf0467b080468a3a

SHA1
1eb5550b9f8b8e052151bf480e519313734f3ea2

SHA256
6ee53089032b93c320786815e4a7ce749f4be5c619113bb00a7a1760feb0b04c

SHA512
22ca6fd36850fb22c65fac1f9225114864aab27656cc0fa3aae4fdfc6cc8cbb0a02ec8a5887fa1ed7720e05ace0f7762c96998aa818615136c078979173ee4e2

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
d16bf6eaf298af1c787c8075add852c5

SHA1
b900f957a8b7e44f2c5c799d02af7fa8560c05ed

SHA256
1bd10edcda4f1c228e2f3676d549a77e04bc4a4755347378632581c8e4a9766c

SHA512
60371feee68a5f9d3b97900a353cbab742e6891a37faf6a400515aba90f68d031c6ed8a1e848d770f89846ad5239a0afca3cc91030851cdd0d0486fc34c4d392

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
ce793139a1ccb900a7a432ba27f8d5fd

SHA1
0aaabb3f765cbe0c05585b44fed3822adff6b3e0

SHA256
91fc37742fdcbd1e9256ecb5f48b44b084cc6ef046bdc45ad6db4a2399f78e96

SHA512
74b87ff8b313e34f0eb6b7a4ad55d1388a676bd07d45e2a3eb0ae4def6d59f4fb7c7886b7f751eeac0d3798a514a1ec769d72922defe47ddfca32da09feecf35

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
cccebf0e673946e41c0a55e80edf403d

SHA1
244042910dd7ea8a0a7bf8d2fed7869a3fb5f191

SHA256
a77ee6dd7657f6550118a87c328e2603a68a3a95ca6495177903e4e363a16aae

SHA512
5179fcfe01085e63d22cf0c38d186c9f8594988f7ab80b300864f3788283d7ebe7f7c4c873026e3ee2304e8b488e5a58719ab38a7ebcb98f77ebe9a193e078d8

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
ccd71ce51e220eb678facff052a67fbb

SHA1
2f01b18dc4e1804668526075165c9e9d502f75a5

SHA256
ebf65821c774756ce275c80a152834959f517a24c7f2a01f88db11e554b18298

SHA512
084e7f42d8a777047852a396d1a76046a3676d6d5af36d44145e1cf3327ec880ddcebd3d6e41b4950de787d45760a13a2b1b152a3f90f927fe951130bf234536

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
6fd1e8073d5f4997c4ac681dd32875ad

SHA1
7a139dde641a1f45563173860dd39caa1e427aa5

SHA256
238fd8e6a2e81a0af895b77ca9ecd324de42001ec9c43e03da67b7bdb2825a39

SHA512
32d11ba31aabab0c534f3e41851f4cfa29dd91f4a1d70a01670f88c27654e0cce26520d2217e1b288b23a641339bc0ba969044ef514ae8135f70776fc32846e4

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
0070c0176718046415f1076796c9eb88

SHA1
ee34ef612eb6fd5254fd88c93c315d824d5befbb

SHA256
cba83952805d0f8cd6c54ac6156f9bdda34416b9350d30f4159a5c4317407622

SHA512
5435d489681ae4b121bfb1cac998410d0660fbfa66faa3c7f0cc9e315b613277f2f94b7df1f27a57df8dbedbb65c588542f1a113bf0053a7c6ba90763d5e4d43

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
24a5c182095e66904c122fdd40b1207e

SHA1
bfaa0c6425b44a5ee55d23bfeccc1c985382a87a

SHA256
93f2a873837d9ffc70a589d99c3413904eb108d001ea600f0f01341c0c35bedd

SHA512
8e559c88bcaa321d9a4f22eb6019e8309ed156a5ad92f110e149ff099ebcef8c824e5f08f9b6b9859a8df5854aac21df49ad470434505e655a90d035ccfc093a

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
24937d3e148ef52d278db9dd9d5fa841

SHA1
b27c847cea2b81ea96ccec24a9412216e46f88bd

SHA256
064f266909d62cc409ac6747e7290bc8d3d49c36fdf8a007d87c42e1236fb7fe

SHA512
8623e0e8314d6a22ce55a5fceecfb5a21c7d1a56a189ca76f3da9fcd9df17ef871b52931b03243035c55ca4caa9cd4eeec060d23b7be0ac9d22ca0477f44fa29

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
a0b0e2e2316c06be82c4f5121d0c7605

SHA1
dc6c38bd09dd4409dd7c355a435deb1aea9e3452

SHA256
ca0520b3dfe6d2ee669841ce1b4c359e09a0491c567c2085840fc47ee9850d6c

SHA512
6fe0bc7746bb0bd4d5fc43878b2dba3637ac3e105742e9a1759b48702e2568595f158a825aca6d65fc3b46a94b332e6f1f794c5a27cf2a7032554b300028616a

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
c50cdda39269fce7c045430004b42e8d

SHA1
b32e155878a915ba16d557ecd1fa353224c375af

SHA256
26d5b8f4640973407e26e724e14cf92c42f1965cae3984eba135896c6dda291d

SHA512
2f8bd2118080cd0902a31a7f901f45010ed6a4d4635f80604f4609c27de8e878de18300b43ec9e323bad26f8ff65f3a114fa6cdcf4c78da10aa8bc26e1fdc8ed

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
ed05931203badc826781c29df6f7b344

SHA1
29701f92465d37f982c88765cb6b7c9d0f7588cd

SHA256
18d6ca5660a65fedcd89a6271a254319642ae9492f9bcc1eae98663471cedfd8

SHA512
648c43f77c3580281a77bdc6ccb69311ded02e0dd1c19ad72e3f241a882db143308eae7ed4d5fffa96ef012702aabdce9940d49e60b4f4364067d0bbc2fa5ca3

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-04-12-233029_tests-iMac.crash

Filesize
40KB

MD5
17ad152f99aaadf2097f2b2304b1a43e

SHA1
a5b2bb975ef6b34fb74881966709f05280b47cb0

SHA256
8a8481462a8fbba3e7e65493bb0ae797f2aadd187d3a4bc5e851bb4f0b211ac9

SHA512
f06f7cf973e59a24e07d468637196dd1ea041af98ea50c2fab7b8e7d20762e5d4091b23f5a66e8a67613086636bb4b683c47370d901999cb1378e4637e045fb1

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f3b77086632f906a6a294316453c5fd3

SHA1
eb29b629e128596c1f47f3f78d889149f9b68503

SHA256
9041d1e6cfc43648db76016bf3672129043c07c38f14f0d3e21f660839bcf917

SHA512
78649e0a9d362f6a77829ff926646176dba20dadf86da5984d808f87a37f2bf799c061a31bb7a64521884a74fb342339bfbd8ec9d90f76a8a62db66ebcea16a7

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f4fc07631a314858b97077f4123b88ac

SHA1
aafc6dec744423f0aad3f3c5dc0895a9f8b0c8f5

SHA256
c8eef4b440f7e7611c4c6b1ec5304b639aecd3a7b648e7b4985849f6ac141bc3

SHA512
4b6fe65ac2510799f24d038d5e438d9680eb2610f9298888ad3aae02e86e53bc1a67df7dc5058410fa63e23c11ed6a7549918877fa51c05035500f66ce1279e4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
27023570494fce3b9f2082b0a223f988

SHA1
cbd8df75e6ea898fb5cc95bb9df1ecac0f738809

SHA256
3003c5b6a26872c0b0420ee874eb5c16387a8937f1dd727f475c1710f16bea7e

SHA512
7e8b6f64a0258885911474db8bd6200ae03769ac5a94a5b66c1601e151a23f4488135522941d04ab67ac58929ff383e8473b5c2950f40137a45768a1c55e3746

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8544c8d23964f2a142b82da1e3a31987

SHA1
255e516c55385c4d9abdc09bb7ab8a75b49e804c

SHA256
1af702cee8dffff53c5b1422e740952b5534a80df5670274ddf8494b29185ba6

SHA512
80947e9a699e32c109a25e23875cfbd6763fdd4f7241c71a4cc114c18d7c97674759b593a3e925f0726ade174530457d3cb6a13c452fbbbaca07c5f07f1576e8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
95a33eb584b5cc16c517548194698ac7

SHA1
68ca46821bd1042232f379fbab6a93ffd01ab32d

SHA256
492b62c98b55dd3068fa1c9883e2f7fc8ff1c373357e08bb4f33716ef4397fa8

SHA512
f4885269efa8c84b4b7f6e74563e52d39f6626df1c82b7fc371fefd7e471ca981c5ef6b987b3dda214d08edc7f57eac11c734f31da327f3730c27aa7d4d26340

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9c426675248479a55d74a9b65e31e139

SHA1
44cb5759d0d91c5bbf0389b5e59ed14f7098756e

SHA256
2628f9aeea495d0c884471f16a0aa930895cff4346e81d95a59c265c294d14df

SHA512
357f8847a42cb8942cd318fd1da8d4eb0ee186372cd0317185ce0f3dafafe9fae78d01e52e6c7d0c3d16cc4755ad92be54212b6f95046ec85cf9f0cb0498e966

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ef3544a0f074c8862c1138cdb60ba0e6

SHA1
9bcf82a40eb1b3c97da1e9638cd1257e19f036b0

SHA256
c3cb7d075ce244399db1a45ab8347dbde1878f76f107e3866e1c799eb15348ec

SHA512
2e788a95c3be3fa69dbc3b850d8a8e9509cdf77762fca37d007bf26b8378cdcde51b870fb46077761332ee3399ff15620bfdea6b37901763247e62615d88d1b5

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2f86328cb747032e2fb0d6b1ed4bad08

SHA1
52ce86963f365847c9d4766695c700c63877cbd3

SHA256
b4e042a58d9af57b024cfa8e63947dd679e69b0348455c7b663db35b1fad48a6

SHA512
6c5dad6f46613343c4c54c4b719efdb50c5c18f37976b98e0a86675869309d7690667af65e941a98de5648e706806d40851b253002c6cba01d9fd8e3ac498837

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a05f85eb8156e5888915d92c6e61a3c6

SHA1
cead92236674b00329b8a422d00e792b8f135175

SHA256
c772b135c9cddecd0f51f86b341a9a2732344143a30387a35ebf6fbf284b2f59

SHA512
2c45d7c072d0467892db786d7e58468476eddd95d321f0f6647d5e29da5732786bd007340448b8ec8be7f5f822ee67af84f6e3035fcd08231c675828136cfd3a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
01e28b263b3901b32b321e41bf842151

SHA1
1ad2bae431b9d390a71ad144953e4f5eedc53ae0

SHA256
a78cae22c17f13f2be7e989d552eab64d60e7824dbe6c220595660bbe213aa7a

SHA512
754ccff11cf65846726f545f388eaa401334d819ca41a538a4e8acab143a7d409f0445680f53e1ffe03db6d3f9f4319a1446e6d2d4a5126819174c689a146df5

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
71e25f0038a8fd542f2ac247ed5b717d

SHA1
cd4505e970d881bed37b31cddda597eceb3dc4e3

SHA256
25e96666a17086e1a6c44b6f4c49b74a4d47498de4ecf85a28914b68043dfeb9

SHA512
63cb4c7b50101b8b8274c140de4d3f78c160573e92d641d1ee39f543b2eca477797b968810a40a5d8937bdadb9bf66ef7905512a46fffc8dcac368abb4537af1

Download Submit
/Users/run/2024-04-12_4954266522932ddb434e780f3b88fef2_adload_evilquest

Filesize
305KB

MD5
71992e671f425b1446153feca341b001

SHA1
b2a886f0c20baea5fc15b0555089bf28279281c8

SHA256
ab4429d792e360612d62a83d7fae82a41812a842bd68845194da78daa971405c

SHA512
788678ce0c79568083daf732a5a05edc5b4c58a12d22cfa443125fb54555c9a1808e55003ef4d8b3d6be5a420b7971200d0f62871751c2fb2e8f2a6e891dab0c

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
1a9f993f1f0cca8f649f5c6c20b953b0

SHA1
f673d4db44f914106f755e46799d26c9ba6c6e38

SHA256
86dcb89909821fee92038b378c559f0ccc3728d35ba412bba8df475e89c2c2ce

SHA512
f3ee90d301758b37b25fc68bbb453f14fd5ad2c028982888e91db62db020787a533931c7c4f032a423049a2cc7f124a92151c02112404161e2fae2075ba977d5

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
291B

MD5
53a90a8c3d21d6d90a1c45dc4cbef4f2

SHA1
489cfaa011f529648a065eef7a051cbd2411a267

SHA256
8dc6201a98f155113eb960e17cfdbd4a8f4866dbca558b507b272d8bcf07a8b8

SHA512
b6eac059c09a9faa9072f8cd74891d669b4c980dbe16df3e614d3d60ebc2a9a11fc7bcbb2695d54e33494919b5362c0eb661a89313a67da6e8ca461a80e873a8

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1265.xml

Filesize
164KB

MD5
cd3a24c9f245dee3eff33b1ddfded4ec

SHA1
e1f48c8a5eb35381ab1810e9e106279033b652fa

SHA256
9125b82222346c1ff34f67382258c95ebab029bfe869572ab49f6cf002c717be

SHA512
258f9b90e4325d13897abd0183c5a60e3c93a82541185e5b5ebea1aea1b641035a5865f115687becab43c186807ab238d111e35a3cd59e5d5c6ee237c9dca87a

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit