Overview

overview

10

Static

static

10

2024-04-13...lquest

macos-10.15-amd64

10

Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    13-04-2024 04:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest

  • Size

    177KB

  • MD5

    af86fd61bc04484111c4addd3108eb10

  • SHA1

    9644d99de132e9e16fc7da597053ae5abcf64ba2

  • SHA256

    685883cf772e335b8d0733c98b75f9c19280b7ba6b10c456f2b85a0050f0a1df

  • SHA512

    da1d5fa669c475b86961e76c2de7edcdc009296af23ccf1898a8f16ad0da2ec41806e1eab2e0446a1f14c4ffb9138bf3d1d71587253636de6f50a2bf93ef9fb6

  • SSDEEP

    3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9WX0k:5SeOQdaZNxtk8cqhSxvHY9O

Score
10/10
evilquestbackdoorexecutionpersistence

Malware Config

Signatures

  • EvilQuest

    EvilQuest family.

    backdoorevilquest
  • EvilQuest payload 2 IoCs
  • Launch Agent 1 TTPs

    Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

    persistence
  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

    persistence
  • AppleScript 1 TTPs 64 IoCs

    AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

    execution
  • Launchctl 1 TTPs 64 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest\""
    1⤵
      PID:480
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest\""
      1⤵
        PID:480
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest
        1⤵
          PID:480
          • /bin/zsh
            /bin/zsh -c /Users/run/2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest
            2⤵
              PID:481
            • /Users/run/2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest
              /Users/run/2024-04-13_af86fd61bc04484111c4addd3108eb10_adload_evilquest
              2⤵
                PID:481
            • /bin/sh
              sh -c "sysctl -n hw.ncpu"
              1⤵
                PID:482
              • /bin/bash
                sh -c "sysctl -n hw.ncpu"
                1⤵
                  PID:482
                • /usr/sbin/sysctl
                  sysctl -n hw.ncpu
                  1⤵
                    PID:482
                  • /usr/bin/pluginkit
                    /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                    1⤵
                      PID:487
                    • /usr/sbin/spctl
                      /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app
                      1⤵
                        PID:488
                      • /bin/sh
                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        1⤵
                          PID:489
                        • /bin/bash
                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                          1⤵
                            PID:489
                          • /usr/bin/osascript
                            osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                            1⤵
                              PID:489
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.security.authtrampoline
                              1⤵
                                PID:490
                              • /System/Library/Frameworks/Security.framework/authtrampoline
                                /System/Library/Frameworks/Security.framework/authtrampoline
                                1⤵
                                  PID:490
                                • /bin/sh
                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                  1⤵
                                    PID:491
                                  • /bin/bash
                                    /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                    1⤵
                                      PID:491
                                    • /bin/launchctl
                                      launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                      1⤵
                                        PID:491
                                      • /usr/libexec/xpcproxy
                                        xpcproxy afsvcpd
                                        1⤵
                                          PID:492
                                        • /usr/bin/sudo
                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                          1⤵
                                            PID:492
                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                              2⤵
                                                PID:496
                                            • /bin/sh
                                              sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                              1⤵
                                                PID:493
                                              • /bin/bash
                                                sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                1⤵
                                                  PID:493
                                                • /usr/bin/osascript
                                                  osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                  1⤵
                                                    PID:493
                                                  • /bin/sh
                                                    /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                    1⤵
                                                      PID:494
                                                    • /bin/bash
                                                      /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                      1⤵
                                                        PID:494
                                                      • /bin/launchctl
                                                        launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                        1⤵
                                                          PID:494
                                                        • /bin/sh
                                                          sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
                                                          1⤵
                                                            PID:498
                                                          • /bin/bash
                                                            sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
                                                            1⤵
                                                              PID:498
                                                            • /usr/bin/osascript
                                                              osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
                                                              1⤵
                                                                PID:498
                                                              • /bin/sh
                                                                sh -c "sysctl -n hw.ncpu"
                                                                1⤵
                                                                  PID:499
                                                                • /bin/bash
                                                                  sh -c "sysctl -n hw.ncpu"
                                                                  1⤵
                                                                    PID:499
                                                                  • /usr/sbin/sysctl
                                                                    sysctl -n hw.ncpu
                                                                    1⤵
                                                                      PID:499
                                                                    • /bin/sh
                                                                      /bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
                                                                      1⤵
                                                                        PID:500
                                                                      • /bin/bash
                                                                        /bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
                                                                        1⤵
                                                                          PID:500
                                                                        • /usr/bin/sudo
                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd
                                                                          1⤵
                                                                            PID:500
                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                              /Library/osxmobiledata/com.apple.afsvcpd
                                                                              2⤵
                                                                                PID:501
                                                                            • /bin/sh
                                                                              sh -c "sysctl -n hw.ncpu"
                                                                              1⤵
                                                                                PID:502
                                                                              • /bin/bash
                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                1⤵
                                                                                  PID:502
                                                                                • /usr/sbin/sysctl
                                                                                  sysctl -n hw.ncpu
                                                                                  1⤵
                                                                                    PID:502
                                                                                  • /bin/sh
                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                    1⤵
                                                                                      PID:523
                                                                                    • /bin/bash
                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                      1⤵
                                                                                        PID:523
                                                                                      • /usr/bin/osascript
                                                                                        osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                        1⤵
                                                                                          PID:523
                                                                                        • /bin/sh
                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                          1⤵
                                                                                            PID:524
                                                                                          • /bin/bash
                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                            1⤵
                                                                                              PID:524
                                                                                            • /usr/bin/osascript
                                                                                              osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                              1⤵
                                                                                                PID:524
                                                                                              • /bin/sh
                                                                                                /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                1⤵
                                                                                                  PID:525
                                                                                                • /bin/bash
                                                                                                  /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                  1⤵
                                                                                                    PID:525
                                                                                                  • /bin/launchctl
                                                                                                    launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                    1⤵
                                                                                                      PID:525
                                                                                                    • /bin/sh
                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                      1⤵
                                                                                                        PID:526
                                                                                                      • /bin/bash
                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                        1⤵
                                                                                                          PID:526
                                                                                                        • /usr/bin/osascript
                                                                                                          osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                          1⤵
                                                                                                            PID:526
                                                                                                          • /bin/sh
                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                            1⤵
                                                                                                              PID:527
                                                                                                            • /bin/bash
                                                                                                              /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                              1⤵
                                                                                                                PID:527
                                                                                                              • /bin/launchctl
                                                                                                                launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                1⤵
                                                                                                                  PID:527
                                                                                                                • /bin/sh
                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                  1⤵
                                                                                                                    PID:528
                                                                                                                  • /bin/bash
                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                    1⤵
                                                                                                                      PID:528
                                                                                                                    • /usr/bin/osascript
                                                                                                                      osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                      1⤵
                                                                                                                        PID:528
                                                                                                                      • /bin/sh
                                                                                                                        /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                        1⤵
                                                                                                                          PID:529
                                                                                                                        • /bin/bash
                                                                                                                          /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                          1⤵
                                                                                                                            PID:529
                                                                                                                          • /bin/launchctl
                                                                                                                            launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                            1⤵
                                                                                                                              PID:529
                                                                                                                            • /bin/sh
                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                              1⤵
                                                                                                                                PID:530
                                                                                                                              • /bin/bash
                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                1⤵
                                                                                                                                  PID:530
                                                                                                                                • /usr/bin/osascript
                                                                                                                                  osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                  1⤵
                                                                                                                                    PID:530
                                                                                                                                  • /bin/sh
                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                    1⤵
                                                                                                                                      PID:532
                                                                                                                                    • /bin/bash
                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                      1⤵
                                                                                                                                        PID:532
                                                                                                                                      • /bin/launchctl
                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                        1⤵
                                                                                                                                          PID:532
                                                                                                                                        • /bin/sh
                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                          1⤵
                                                                                                                                            PID:533
                                                                                                                                          • /bin/bash
                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                            1⤵
                                                                                                                                              PID:533
                                                                                                                                            • /usr/bin/osascript
                                                                                                                                              osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                              1⤵
                                                                                                                                                PID:533
                                                                                                                                              • /bin/sh
                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                1⤵
                                                                                                                                                  PID:534
                                                                                                                                                • /bin/bash
                                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:534
                                                                                                                                                  • /bin/launchctl
                                                                                                                                                    launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                    1⤵
                                                                                                                                                      PID:534
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                      1⤵
                                                                                                                                                        PID:535
                                                                                                                                                      • /bin/bash
                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                        1⤵
                                                                                                                                                          PID:535
                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                          osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:535
                                                                                                                                                          • /bin/sh
                                                                                                                                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:536
                                                                                                                                                            • /bin/bash
                                                                                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:536
                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:536
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:537
                                                                                                                                                                  • /bin/sh
                                                                                                                                                                    /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:538
                                                                                                                                                                    • /bin/bash
                                                                                                                                                                      /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:538
                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                        launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:538
                                                                                                                                                                        • /bin/sh
                                                                                                                                                                          sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:539
                                                                                                                                                                          • /bin/bash
                                                                                                                                                                            sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:539
                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                              launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:539
                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                sh -c "launchctl start afsvcpd"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:540
                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                  sh -c "launchctl start afsvcpd"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:540
                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                    launchctl start afsvcpd
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:540
                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:543
                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:543
                                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:544
                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:547
                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:547
                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:547
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:548
                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:548
                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:548
                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:549
                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:549
                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                            launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:549
                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:550
                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:550
                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:550
                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:552
                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:552
                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:554
                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                            sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:554
                                                                                                                                                                                                                              • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:556
                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:557
                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:557
                                                                                                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:557
                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:558
                                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:561
                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:561
                                                                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:563
                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:564
                                                                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:564
                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:565
                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:565
                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:565
                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:566
                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:566
                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                              launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:566
                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:567
                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:567
                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:567
                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:568
                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:568
                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                          launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:568
                                                                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:569
                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                              sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:569
                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                  /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:570
                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:571
                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:571
                                                                                                                                                                                                                                                                                    • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                      sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:571
                                                                                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:575
                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:575
                                                                                                                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:576
                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:577
                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:577
                                                                                                                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:577
                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:578
                                                                                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:580
                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:580
                                                                                                                                                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:581
                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:582
                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:582
                                                                                                                                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:582
                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:583
                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:583
                                                                                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:583
                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:584
                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:584
                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                            launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:584
                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:585
                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:585
                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:585
                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:586
                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:586
                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:586
                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:587
                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:587
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:587
                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:588
                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:588
                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                    launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:588
                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:589
                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:589
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                          osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:589
                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:590
                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:590
                                                                                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:590
                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:591
                                                                                                                                                                                                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                    xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:592
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                      sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:592
                                                                                                                                                                                                                                                                                                                                                                        • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                          /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:593
                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:594
                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:594
                                                                                                                                                                                                                                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:594
                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:595
                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:595
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:595
                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:596
                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:596
                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                          launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:596
                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:597
                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:597
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:597
                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:598
                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:598
                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                      launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:598
                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:599
                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:599
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                            osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:599
                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:600
                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                  launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:601
                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:601
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:601
                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:602
                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:602
                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                              launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:602
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:603
                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                  sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:603
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                      /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:605
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:605
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                          sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:605
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:606
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:606
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:606
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:607
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:607
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:607
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                            osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:609
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:609
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:609
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:610
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:610
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:610
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:611
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:611
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:611
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:613
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:613
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:614
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:615
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:615
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:615
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:617
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:617
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:617
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:618
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:618
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:618
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:619
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:619
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:619
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:621
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:622
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:622
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:622
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:623
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:623
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:623
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:625
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:625
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:625
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:626
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:626
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:626
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:627
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:627
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:629
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:630
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:630
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:630
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:631
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:631
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:631
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:639
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:649
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:650
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:650
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:650
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:651
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:651
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:651
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:653
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:653
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:653
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:654
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:654
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:654
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:655
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:657
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:658
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:658
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:659
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:661
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:661
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:661
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:662
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:662
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:662
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:663
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:663
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:663
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:664

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2489a6dc335b505d6018c565438c5d30

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d6946370e32ddb79bd2ce4227c510d087aa09451

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4bcec21a4afafe01e25ea3474101f53f8f4a719b488160660da8ec68763313f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4ef5425c8e7233c97b7d36ab82c139afcafe3af8e2933efec1809fb39e3d5eaebaba787007c782b5ec8034e4b6b0f61be77afa9d2ec2fe78c8f15151f9161d50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  168KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  61bb0d1765c70aa85f1ee8ef3e2ea6ce

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f4522ebfa871ffc47e85c760b5bb118273855362

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  563d6588d6b96835adffffad50da9f846bea1810f64aa99f3e35bbd9598fae7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7a4d6da425258a3b4c0d5afa894f48ff6f141bb9adfd6b4017f4ed007ede39a456b0957a23eeb31e2af87164f6709b7fc4561133e956c5637033d9b5aa1f17a3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  429B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b29145cf94cd1ef0d81552c333c3603a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4095a7b7b982b8875a6256919b7d80c50b0a2799

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit