evilquest | 5a6fbf9183f7ba8aae8fd6a80b296e25dafbdace5afd3d488a657eed39e05e6f

Analysis

max time kernel
147s
max time network
145s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25-04-2024 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118
Size

168KB
MD5

001b2a8df80bb1482b06a459fc56ad1a
SHA1

08717aa4fed95608564a11fe1ce9e678cb88566f
SHA256

5a6fbf9183f7ba8aae8fd6a80b296e25dafbdace5afd3d488a657eed39e05e6f
SHA512

8124edc358f6ffb3250bedefe517e7116c52c35ad88c144e59a801a706724567a6645da5c0cdfec8b171665f8f9767d3a03b18e725d3429f6533ec0b9a705d26
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9t0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008af41-0.dat	family_evilquest
behavioral1/files/0x000000030008af41-3.dat	family_evilquest
behavioral1/files/0x000000030008af41-11.dat	family_evilquest
behavioral1/files/0x000000030008af41-20.dat	family_evilquest
behavioral1/files/0x000000030008af41-31.dat	family_evilquest
behavioral1/files/0x000000030008af41-37.dat	family_evilquest
behavioral1/files/0x000000030008af41-43.dat	family_evilquest
behavioral1/files/0x000000030008af41-48.dat	family_evilquest
behavioral1/files/0x000000030008af41-53.dat	family_evilquest
behavioral1/files/0x000000030008af41-58.dat	family_evilquest
behavioral1/files/0x000000030008af41-63.dat	family_evilquest
behavioral1/files/0x000000030008af41-68.dat	family_evilquest
behavioral1/files/0x000000030008af41-73.dat	family_evilquest
behavioral1/files/0x000000030008af41-78.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118
  2⤵
  PID:522
- /Users/run/001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118
  /Users/run/001b2a8df80bb1482b06a459fc56ad1a_JaffaCakes118
  2⤵
  PID:522

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:523

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:523

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:545

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:545

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:547

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:549

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:549

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:550

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:550

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:550

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:551

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:551

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:551

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:552

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:552

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:555

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:558

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:563

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:567

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:568

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:569

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:570

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:575

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:575

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:577

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:578

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:582

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:583

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:583

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:586

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:589

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:591

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:594

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:604

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:606

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:606

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:607

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:608

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:609

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:609

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:613

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:613

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:621

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:621

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:623

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:624

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:624

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c8b7c58113a9102dccc989c7f3092ec3

SHA1
73fc487f235f5917197c1b7bb62e0c0040064e76

SHA256
41cf7abab03a3e32d78e5def71e44f8ef40ee9b45e0181a89aff167a893dcfa2

SHA512
3a869a047ed66a0a952d26558b6c01b64e00964aa63c11333c3b8bed4fef06c70236ea844b50d87cb78a07b00e373606e8674468df79ca988d1d7fc17b70f9f9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
77c1d45d42da21c9f4acafaf47e48196

SHA1
9a763f63223fb30b86b37451fc9ca1b2a191c27c

SHA256
939a39a82d45889a73a074520cfa1d4c8741b9d710609ff13490f72e97a37b87

SHA512
badcb35cb82d15e396650466a28f810a8f0f75ab2b530b923f31fe63f3d03d636c3b9ac9bc7e6323edd40385c57f897977b236c24f8634a6f2e69f497d371467

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3b3d0295e75b8ed8160a250dbb3dbcd1

SHA1
689e586d1e8cfe7e6a073cd44fc3717d5a8e665b

SHA256
e7301fbf6f20c02fe938390722ddb70c3d0e8539fd4984cfc80067f266d38421

SHA512
f2dd71bd2a6a88412fa3d2cf6e5197624d534bcad272294b13122734e90f02fe3146a7f6db6473527b42b10445c00199e99a39fe35f71a6afbc209bd6457b1bc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
55880ce6c23a7fc13525b52bd1ee3ae6

SHA1
48a4366e19645b576b5958b756b673510cb9c486

SHA256
dbff02eead574223d558d87f27496e5a96040cef9e86757afe910985ecd3ce5d

SHA512
2ccbb2aedba3806390d246b0d139e9c455cf162b2537242eb7cf6c0986404c54d9f28d587adfd2167a5fe974879945aa97861ddbce27de4ec7c7f4db1225d780

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
24d01d8e6d5d7a571a2dee866d022e42

SHA1
36b4cf50aaf7c54755dfcde3f9c5d3d497337550

SHA256
6933b3e4284f88d65b53d3eeeb002e36e4133550ee83a7370e99cacd8025b5c3

SHA512
66e3757389dfa7e98db0aac6dd5f3a2d166f8ddefce9a49babb16769023f2041eac0fc51fcf9226d986eadeaf2d4fb124171afe9143e518547b574b96149f3a5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0bdd492ab38d6181b61e07caef75076b

SHA1
f46de111e35be1bace188a308f45882a4ba160fe

SHA256
5c3b80a6542b459670afbde0ade6406d85bba1d744b56e035003929bf65edcfa

SHA512
040deb8c36e76eed9184f9c64c24eb756a2703acd1f7eea36a6b17eef10956c0dd3beacbbf424407c34612c07f3b2f618263d6077c773b16a5acb59a6bb23a0e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e64d15c6f10b7796ccfd04345dc1b875

SHA1
0190da0ccb2a0e899ba4f3eaa0b24f1c3ee0423d

SHA256
336542859fb8923927f0bf67d54ac12a1eaf4db6592eae60fd4f7d56ab8cc36c

SHA512
d757b7441aa039276bdb8030824d65bb399c39281886f87f267ed7c17360aa1a7d8248c7359c7b44cdfb7d9d5d7b574c24be4d82088dac1ebc30aad80e314e60

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
41495e33b6ad218379f4af24a990197c

SHA1
ccbfa8a173b7023eb128df46336d2a22f273370b

SHA256
fbc105d74bf2ac275624b3d6770ad934284f4e35cd98531043986d78b7b78022

SHA512
fcf387236dd3027b7ec28db75bf766b62692958347671ad41687327e277830574fc4d925ad225e24be1b50a58cab0ac8fa1700eefc800b47c5aaf63fd819cb4f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
87c23f711574b1b6919e4fdc927ac399

SHA1
7c18ee5f6f84d785867644435176a2dd86483812

SHA256
9303baae3e1412b3840d3f494499d262e3d4737bb795db3e16833175d0ac658a

SHA512
6e577c4a7003b5a3636f0a56df35a8fc58d310f66e4fbfb1102e51179ccf374b5f632eb3e3fad133b896bf5e72fc7ace3fbab82effd65e045cd3a6929b988e47

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
709bdc927c1f1af7f36cde000ac362ac

SHA1
b8e96d9b8b58c0ad40ab7c91b0d41aceea15ed6a

SHA256
4476f26d463de7a4a9cbe3f1a5d1d975e1c7702b0f5606d8181c0de08214f373

SHA512
616f207a7701de9251e53213cf16ad630fb45a0a0e5e29c7fa8a546f0389f430b9755f51eccf1ffe3ca1d784bcba9701862d54a53e4b0dbac3569ca4393f12e5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0789da11c820b28ea8170b7e0f121e71

SHA1
523fc1a5d5eea77228caf79c273ad3a4902a3ec0

SHA256
7556a3762681c87ba5de9dd5eca70f8ae8cc28519227a7d5f4371e0cb04c3dab

SHA512
9a1d1e922377e59b911884fc17d09bd66f9d7f93ec5b88476f1d2a75de521ba5a23f4007cce80151e179e5eeef42adf4a5ab81afab6bb116b7e15890054f4e2a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
785e62f8fdb50e3df8b8ea3063988c47

SHA1
8957a131eee22c670a412228c7f91549ee2e4ebd

SHA256
c46128474c9608f718d1cb6505619e3b38ef892180f221cddd13d18396e432ff

SHA512
956d5131585009995bf92581108558be484945f7f5d4c1e10bbe7573757e3aaed0cb667a5f4842fcc0ff73ffeb85d03a658ee45dd6ed5c592e40c7306801e52a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8ba54cf7642a6d53dd216ad4efec0498

SHA1
4528af8a43e85d23213c61b38139110cb3a59072

SHA256
1ae0afed1a94480e02db9462d044895891e05142df4d6c5f2c59224e7b295619

SHA512
cbbadb979b4c03a6d8c3fb8de150ada9002ab7fa4c5faed27cad7c888e0ec30773d2731412e244f88fc4e3479efa302d421931ec30d798c3817c8cfffdd656e7

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
147B

MD5
a6ed424e1135465fac072dc8c30be6a0

SHA1
8cb5811cfe6611074f7e01b8b9a533aa7bed4432

SHA256
c6a15fb293a7994c87cb4665fa076b4804c15a7f17753d267b6e271b036457dc

SHA512
d6dc5f49efacc0bea1d388e490c2e1283f6a6f42829e1ab30ec18b0ad35faf44e21d7780b84b5a2ebaff1e79da6fdc090bc547990b513cb311db82fb54cd8972

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
167B

MD5
54ac2dfc3277cc71d095814696c9d295

SHA1
8f0d1dfbdff79cd6d57bc961c6c3fd097ba48893

SHA256
c538c601d32e3052f7b1abeba70b33930f59b71d07abeb63578e4340334fc4da

SHA512
9c6feb5711798bb03f566cfdce44150d28e9ac7cf6b6668aef9e9293b367b91a00d69db06d07198a7e2e3c8ba161ef2238e143bea6b1957cc9298ce8e9e7009b

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
2c4c3bbf1a4c3bda2b4f3da7cd6fdab5

SHA1
b3790fe7675de54a928788346217b90184b9e82c

SHA256
bde89202ec1446901a0a9745c269c449cd8fe1f917bf973954b4dbd27105d7b1

SHA512
b008f0b7c484f8cf40a447388157940e21e4bf0b02b0387469625b5cb6b658c8e931796e87e31b02119a9f15922edfce2b148bb468c6bdba45962f8211223461

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
291B

MD5
4d84ab5ec4832c32b3b4b4e19f2ce394

SHA1
069272149daf95392c1f0a3b7bf71bee86fdc2f4

SHA256
98e2df4a6daafebc290c3b94724631ac83bb80a2aca29d91f2ff016314efd4c7

SHA512
892610cc1be1f07a2a98ab1b662d2b625fd6f59bfe64eece20d44fc4327407ff67c5b9c1861c3536ac97691061339a1daf3977a833c987804a71d5522877dcb1

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d7e8139d48fd744f37dc89646f1cdb64

SHA1
e8e197766975430be1871a4ead9b8744c7a7296b

SHA256
769d67fbadc0eb00720d4c6e2c597f7f84ca79aac0fcc827cf863f2fd77400dd

SHA512
7945131e1be7cc4ba3366d8b6c10f161018d1aac57c5a95eb964116633d5923f513c2f07b1c27d671c8bdd62c6803bb553d640fb27fc2353cf330bbe4d0795b9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cb3c2f5469f95dd0a69fd8b29680e62a

SHA1
e61c2513e9cf2d11f6f22e6612427a5571d9ad49

SHA256
e99e7eabba04e19763b8589b6b0901b7fc4584168fe78a91cf282c893094fc01

SHA512
cea788e06b5b31d6e01cb5f4936d2c479c985f1e8a9e19c3be44893cf3fa401749b211c95258a10f1a040a0858aa34542fd103fa8713b3685dec97cbce22074f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b3aeede26bc1cf9e8a35107eafee3da6

SHA1
5454e8ef73818ad40bd679a42f43539cc9264518

SHA256
4c44dde99340be9f037394830e808c8f4803d6c4163145bc6cd8b0a5c023c26d

SHA512
76b76dd3402029b6718f6439b10fa2de7b2247725e1aa3e51a85f09cfff74cff84cf3795b7dc410d4b1fc1495b79ff47d712b61129fd778985790c0edad257b8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
623b812a5ea5a707d1785b5e83a18bea

SHA1
dda094e1ef56a14ab18a5beaf1529dd23ad306ea

SHA256
92bd38985ff8751485dffc4f5932bc9a7e1015927af9868b620a91c882639bb0

SHA512
3386ccef8a5b80931b9883e3fbc4bca28e3c60a5ff57c99fb4779e6d5f2aaf22b6272cfd0b478f36506a17c9a8d52447f7ca6f317164cc01c000e92e82673f3f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f499a85f71297b31f6f5e04906010514

SHA1
252d707e29d02eb4c6234cadb8e6a32714c55888

SHA256
50fb29b4d1120cdb111f43334c37099eefc3e78acabcbbf27cc98cfd238e2b62

SHA512
1af5ffc78dea184ce1521d5853b6744f0c530a458092924be46b74897c057a44db04a42b91812ee5901a454d2bbf0668c86e59b4b0c1ffaf5506493d494c6570

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9799edf25beeecb4c058b3d26b55262a

SHA1
2c5b3675c73a91a5b870c486a7f6ad808288943a

SHA256
0291515b98c2556ab91926c7cee9f53b5d1eaf4a5837a79ca14b063f10ecea61

SHA512
77c93307a4d0ac1631443b3a51be356cb83d6637125c77754e535fc72580729a1e4d26d2157892aafd5cb7b9fd6cbb60459ee82967c27f8428b60baa5da88ddd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
76c68f8759231c5847f487e1f32864b0

SHA1
e0f43f9f42b4483d8f2cd2d32c08de668c5f241e

SHA256
f533f6407a960c4c96c42905d0fc4bee0dc5fa1a44ba85a2133681b938ef0566

SHA512
926e3817ef529007d50519c11f6baaa3b1361c811801c8b83f5a915f019b5d994ccb2e20eb729261cb7d946193db7b3d622b0ebdab114a7040e6f2480cea84b0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
59d151968c6eacefadb62c32a2a6550c

SHA1
25ec651392b497d322fd52d3cda0b2000513f733

SHA256
fc20800aff1235ca90c4787fe2fdb7dbcd5d8a11ee146838f1b7dc0b0bb2a214

SHA512
d9aa0f853fc6a889c1dbde3a5de5d88865ecc68cd29ab45f2dab8f0245f5e961b617165dd236226870794f4685302ee99d34ec5bd4e48ca43ff566ad640df16f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e62aeec8ea5a6be3277274575685bdea

SHA1
a902e74ab9c1981479e1403e64b27bbc03902def

SHA256
86a38f727146ef429be518bf22df9fdac967d20e23d331376cdf61eb7e0257e6

SHA512
55e61288d84fc5dc679d8a031de9713cfae233ce7e4467b60b5c590a5450b23ce84c6116aa5680f78dbf035ea365f36c553be5d1de4c9beab0c437f08fb1c382

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
65138f6a96d8c77b6fbd9d1e45d31188

SHA1
213d34670d20f46b6bcfb76f394d197bf5054d43

SHA256
46b99b4fa9887deab5667c26d70b3a0e7e230081224abd9a9e3ea40a36065673

SHA512
abbebc3d19221c7a0936528ff054d0079437408e6745f2f5011b9cbcf4dc3d9a4d58bea5d2ada3352d005dcb1f2c62ba208bc34f8153d789b5facf5b4fe1094f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6faa1a6dc52ede288b471feec7e8ef33

SHA1
5504440fb03d5cedae9f867f630ed5a8caea27fb

SHA256
34beedaec263a4a5eeb771ebe73a141dc4db608fea64ce9be3ba5689462265de

SHA512
68cdfabf1fca22afd295e280d5bd960339f79f3a44c97487a826585638772713c0585458cb5b62ba11589ede09c84aaacf35cfa51f747531d3c3caced344994d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2bba95fa7b5c856aca827b084da74b11

SHA1
a54771dad58bf097eeb7621435b77437d1d2a2f1

SHA256
5b36bb727186dab120cbcd7ec6dc87560be223efffa121a5a5884c9db91dbf69

SHA512
43f09913a15f4be08ca5611e41fcec11d5f9c2b487b81007b84bcac0507af280a50074b7ca106ca4fbfb0ff3c044eb84e05ffc300595cbe3bd065052b72d19f9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cfabb75ce1cb3b89f0b5cb005540f35f

SHA1
7b47bd524f8a8b675b9ad146c54bc27af9fdbbd3

SHA256
754e4152da532746315354f605f1d2b1b4be0ad7c0e9ade25ec09081f35e4c49

SHA512
e92b240a4ac150f0491cb3292e77337c132b4d7ce229e2248f655ec892053f6b4d554d85915eab4a4973b5d9f555c9d5673ce97c479e379a6b1417a9fde74572

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
da945269349013b8df4668f91e99a0a3

SHA1
5e50833524679c2d9d6c59a4b2c1d69264ce1381

SHA256
b0c89fcb032750c17b7f6426c15bb28163d693056bfda1e6925655b5c98fe36c

SHA512
4ab46f973690cda0098cb8aa1e2adf28ba5c42c96338573551257ccaa7c3c97d6c1b68d71c90e7f11caf49fe09aa11463c6894a4ddea5c7c77c443d52a1bd3ab

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit