evilquest | 5297cb270c07f8ef444c844a7dfc505a182db276fe442083270dc6ac20ecaf4d

Analysis

max time kernel
149s
max time network
131s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26-04-2024 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118
Size

168KB
MD5

01b76a68f8d4fb92f79a6a1093ad1e3f
SHA1

0156159924b3caa482f9eba6e62c63a49d867bb9
SHA256

5297cb270c07f8ef444c844a7dfc505a182db276fe442083270dc6ac20ecaf4d
SHA512

525ce2abfaf0a2cc19bb89b37eaba916043a902f50dee56dcb15842ddc99de908f37fbdae14bcd779bdd067db4078094d0ca7e831cfd59a3ca613634622611fc
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9S0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008ae01-3.dat	family_evilquest
behavioral1/files/0x000000030008ae01-6.dat	family_evilquest
behavioral1/files/0x000000030008ae01-15.dat	family_evilquest
behavioral1/files/0x000000030008ae01-22.dat	family_evilquest
behavioral1/files/0x000000030008ae01-27.dat	family_evilquest
behavioral1/files/0x000000030008ae01-32.dat	family_evilquest
behavioral1/files/0x000000030008ae01-37.dat	family_evilquest
behavioral1/files/0x000000030008ae01-42.dat	family_evilquest
behavioral1/files/0x000000030008ae01-47.dat	family_evilquest
behavioral1/files/0x000000030008ae01-52.dat	family_evilquest
behavioral1/files/0x000000030008ae01-58.dat	family_evilquest
behavioral1/files/0x000000030008ae01-62.dat	family_evilquest
behavioral1/files/0x000000030008ae01-68.dat	family_evilquest
behavioral1/files/0x000000030008ae01-72.dat	family_evilquest
behavioral1/files/0x000000030008ae01-77.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118
  2⤵
  PID:563
- /Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118
  /Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:569

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:569

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:582

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:582

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:583

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:583

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:584

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:584

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:585

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:585

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:585

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:586

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:586

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:587

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:587

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:600

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:601

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:607

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:612

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:613

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:614

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:616

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:616

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:618

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:619

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:620

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:621

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:622

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:623

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:624

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:640

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:640

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:642

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:643

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:643

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:662

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:666

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:666

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2b34d9a4b6d1a5b75b43bbd4925c30cf

SHA1
68b9db5e3922eab8978ab8f5d2b9105f38fbe65a

SHA256
44fbb770f14a8d96aced1b5afdf2b60f0c3c7c4fd97170bc770608010f207e28

SHA512
9b8a4e2a44a62af1618b142fd1d6cf501ec6a31b1828457576fd7bb6f0fc201819bc6c4c96e48f76de7b122ce7ea2dc93d15020a1b570eedff09d3e2e6fb6198

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8a0d7c7dd7e756371b95fca170482568

SHA1
a80ff2469cb4df62a2b0cd5d81df0951a1422aa5

SHA256
7716265469c658ad4ca4b723e94454cf6b9b9f93af5c5fb3db25dd9b6644cc97

SHA512
15387e347a67f259606e8fe7da42da8700ba01950f3888caef4d1e86528d6c53b404a6b96832b451f3e0890dd70fdb74a97a84506ab3326b9d9fad2749bc7a71

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
15e188a7b0f63d2fc852a7778b2818b1

SHA1
21aaed7c22925d33867d1ed0c74dc4e267baa78b

SHA256
593a693158917fe6b42cbe3449976376cea6bc9bfd2dfcd2e8b06a33ed692ac6

SHA512
aeb133a1445adf26e0e92910c7327ba3a11342acf7f233698d08ed63a402c3e309fb558022022b72386b40bca1e7fd82b3ded6ea4527322d11da237690de02c9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5b8f0883ddf006b34b2ab57d5ceb4e28

SHA1
aa9adb3ec8f6124a8929cf232c47bfb7d63c7673

SHA256
e95bd18a64630f74dcdd4204f8f765ca2dda1926e12b3f52d3741807b13cbeff

SHA512
952f25884cf82654550626311dad2e08355c6f6fcda6bdb704cd0f634a26d3097023502703d70cac01472e30896bd8bf8b966470ce766812366cbfa86bea7d71

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
35db93ff3746e8f6067c38c08e8d0025

SHA1
8724420cf9479e7e792f2f607ad2bbe8ceca250d

SHA256
982cb5d5abf8bc5961e6b4593ea0a5ff04a5d7578eaf51e21cc72fec45f57341

SHA512
cdeff0cede24e87eb677f9246f852d182d567ce328303064dde01ee0dee2ae68592e5fcebf9e3688de5be1d784b877a9a0484a25064e6777dfb604a899ae073c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
951c8070e61832f20174efb3264bae1f

SHA1
ce78b33b5418b2cfe5362855c616199efa917ba6

SHA256
2975570ff9c38456823a616e38440e194a0a22933d8c990c30fd2015bbaa9a42

SHA512
e7800f96fbacfc650eb258bcd4c808217a04d527e3417674fd2fa6e6c2c2434e5521b454db88e057e6105f40c6fef44be44665d5f5d9d3c1d8944f9370daf9bb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9cdaa3c52d26bce1f11332739690d981

SHA1
edae44dd12715d120ed4230fc6587b030f6563cf

SHA256
bdddc62eec798fcde17446e5dc2b64ed684593c2797699ef5cefc091df41dc92

SHA512
53a5fbb8d3ce76888fd71e2a0021d9d0ec5a7b0ae4d5a74ace13c3de65c2161704a0e920f78ac82103d91cb2e058d7a30a0ed379eb8ada5f6d3bd16aba34431e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6a3e537b1f38a3b3d193647c55d4d520

SHA1
e72730da0d195aa02ce4f6dd0675d02cedd75b3b

SHA256
8cbb3fa018ba10349c7562c500b9bb7e3cb2adcb04a51db91692366f63608dcf

SHA512
a5cddb1be30b797bfd31839613bebbb18f006a32a021a3403decc4603e2056e6f7d63799087f0121c2ec7462eea07238e4eaacac27c0a4d1923f17f757261cd5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5ead17aeb899d1c42eb8159607ef53db

SHA1
a461cee24ebd7f327990f2400106916a551563f3

SHA256
eb9f7a7dece6bfda39b52f08c1c2ae754a925890da36c6d8274dfd924b4ce826

SHA512
b089b382fe3d2961469742bef8cb1319410a6c98adc7a50f3b0cc62d0e0688458b790e52d3eb3edf85e5489789a919fc07ba8bf7687a5d1a864d5281b2bb65a8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
78585e3f062dc5a5b0ff11a316b67ccb

SHA1
25852777823a33110bb4b08db33735a2745a9aee

SHA256
556887716074b8884b00f17b1b3d4ad65ed5dfda7231a5f6053410a4d643aa05

SHA512
65f098674c1b8e6d3fdc284650f25bd73ef42407a383309f913da17465b0ed562efd3ba8a7394796ac2316fb63d10de63e59e2a5c3d74e8e518fa349743e48b6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1d5cd4c7dfe00b4292ab4df5104191fd

SHA1
edddfe9d1828e01b5637e34538456380fee664d2

SHA256
ecffd45d041aa3f8b7669f51715f031b8559c307a028e04925e53f7f19653840

SHA512
3188b9a1a726d3e679184ee0ab980719ce9b6b44fcdb1d4c4824d4f4e28b3c6fad190d0f12c12ae8a263d8d11786275d7e5c211f71bf309ba28d1fb174c63109

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e61db875631f6413041a6cbee56d0134

SHA1
42b0d4d6051b3f99c6d41454c2fe940367b32388

SHA256
4b73c6fa5e09a405f7e2aeb0e52aedc2b354eee40e1bb3b2cbd355b11cfdcb86

SHA512
21ee9486dd7f9d119ee14e91b59ee7f2b0cae005a1237dd62b8acd1c5009d9f05a43da3294bf7234d0e6a6506bff561b9bb8a0c8a826636b89ad1f5a8873ec31

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e4e2e34ad654f1651b0310d13b2004bf

SHA1
1099da5300c1c2982cb928b7c5175aaa0e9bfb7b

SHA256
e9d8313b182a228c588943e2c57921e1fed8c628c1afe1e339bcb76ff4c8e8ac

SHA512
0df45a244f81d7704e36724df7fb6570918c1b9e886eeac7ae63c38488ea0eda24f852daa0047d463f1bf5433be3867c97c08b3a1f13bcd5ce019bfa4497bcc9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1d1c185467e2df8163a4ddc7e0f7f3e3

SHA1
c0c9cf01457a742d67e23b9fbceae7980ec8154d

SHA256
a99d98d125c9ee46fa44ab790d6cfe99080f085fed35297ab28be4ef3dd51a9d

SHA512
44eb472f758687dfc265223f1440e6740c3c6eb1568d91204e287789bc7849ebcd78147fc035fdcc1c593a57d2cd09dca4c1768277dcf60c8f64e7747868ce21

Download Submit
/Users/run/01b76a68f8d4fb92f79a6a1093ad1e3f_JaffaCakes118

Filesize
168KB

MD5
3ebceb7b1c0daa471e31282f17d0e984

SHA1
e25b8fc0adb5da8f195527676450662dfb282036

SHA256
72403078dc539def64075f107646567d0adcb1bf4781edf927abe21209394b30

SHA512
a06d7c709e2d72a2ef9f6bb03399af452b543f7ee0003a34e1630f29f26dd872670e88c9e789da4483f9bfdee025664ddf9fedc919087aec56b017c599cc898b

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
f0cae42e540a2962457e5e85a64028da

SHA1
40c5fcba25f85eb605b4e5cdaa45002e370d5f5a

SHA256
6e32dcb3e9507e8500369dd614e671c07eb2ba2833460ec14cba190c7f6fe631

SHA512
e2119b1b86285ea136cb0b4a226e81d1f8bd68a7bc3e35011f149d6b45921976879b238f77b0bbaf4d69efab4d95c4bbcf42d8f93ced83a928d84d58c71ea204

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a6ad943f3a54f4d9fca387b93402141d

SHA1
0d944d3457877bca94a5032a9039aa83b3098c3e

SHA256
85387c772f3e4bb73b32fe4fc47b450ab92a664b8942f596d08e2be32a2ef981

SHA512
7974083e7305a680f292e12eb9755fb3e6b0fbba40b59a44bf15c95e883da319d1e17218ee8a8c720659df05db1bafabeee3390841580f25defc465e6762fa14

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
892e37886555e14ceafc329938d1b319

SHA1
47bb52ac55ac1b2ea192cb2cfd6c70f256789ea0

SHA256
7babbce240d7e1b75a74b8d56180e9b4ac80dcdf01da30d277929803905f336b

SHA512
2dafbb16be7a9ce08eab99e171170e1edfb58558e0eb4ce28086e2fca07c7d41004b8ae8ba4eb50dc27042984df33bcfb0b0380858eccee7ab44e994ee3786f3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a4895bddd1555ae3ef8c49cdab611f1d

SHA1
75fde2bb1425e253ec3054833f4942eb7effd91d

SHA256
9d35957850c721b2d308de5043630f964de07355b380f37660969bf5b23e6773

SHA512
de173340ec0506af724f91654ed59d4dd9871412ec5ab6a14a673c424b114f25cd7f75a176ed9ec1a2a1daa150b8e6f41571e210be026c0d0c3aa40ef582208d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4641d5536e107b32eb5da7f2ff6404cf

SHA1
d9ce0f921ed3a1cb0f3fd00c893bc7d501d6718e

SHA256
48a16035b962c662a8c2d6e902511b57ccf8805375b207e59a943e951ce13c5b

SHA512
26acebeb7dedf3cf1e11d4597722476afca440746d50293daa8708040a2259bbcf6e45d43ccb99ef911d4dd58389a5bcbaa18d6f445bef0bee83640d0ef3db38

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
df6e14ced2db73ca04b7b57d96de06f6

SHA1
06467f10862d53923f1f3d39458d750818cc5311

SHA256
22a143a288c581af57a3fe69d874aa5112d68704eefe67364eea53ccb27ab2f8

SHA512
092c1a5f075dd94f2e59c5ed80957880d23a540e05a014b232ae52e6dbcb44569c982233c67e7c02c0386af42e4f97c1caf44fcb5761f4c33222d73f86853134

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d15809ef515a37712bf285c2e512ee38

SHA1
645f13891d7f8bf4e90f4d0d45c9984c63cae885

SHA256
868481034d0d600f71cf916f535ad803b9d1a63fc378607957bcc3bc97189abd

SHA512
3def0edc8de9a0e6e86ad523ea92fed4ed9243538d0bcb92c3c6ab435dfd9e9afb95fcc53f38845b379588fea8b36fe45f12a66f2e6709f12120de7d51984369

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
68125ce208b93c5e1f905e8a916cf989

SHA1
b6e676d4e786102e5b0b84f85ee6b5d53f7d9dd9

SHA256
b49828e9482b7628a5d09ab952c0458e1b9e2b84a82704bd0a20e627ba8c7da6

SHA512
c16a9f1714a211ea662299a090b273655dea1c0e8f01fab096dc56f6554cb9eac1e63808625ccebed9bdefbe30c6695959fc9b13df994175f0470c644b0192ba

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a6bf1deda4b5efc95379c1ec95e357d1

SHA1
76ad7e2c7dc65fc2673739c004d6284c595204fd

SHA256
e984e2a5af59997b47369e86278ef360cf55b6d839de2658c5bc44b85a853c47

SHA512
0648aa5f60c3e7e9f84725d6c23d7f7df6140c64dc3afdf58bfb8cadf26432e3281fc82520ba38fcf3244dd859d993e469baa916fa59c0f6533a4680d6f71bc1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
00fd8ca9f4a5ec9fb88dd1dead360a32

SHA1
4ba8e1488cdb5834255d7f1785f4c1dab17efc5a

SHA256
9526d0fdbccbb6134ea789a4e4bc50d7cb87ab2aa6eea6974f74cdba18aca752

SHA512
88801c21739cead6c40cc8ebc7aebbb5591d1ffc9cf7e833dd6e8d3f486d38ecaaa8636ffbb8a12bbcfbc60324e7285212b8098caa2aab003c8f10cb13decb4f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
21c3ec285d426df303837f2e3a582baf

SHA1
59e58cddb1984dd36aa649a4b97d25d2ee5a198e

SHA256
2377ac9c721d2a7fb610766da0a4898e23014602543b11fd4b5399e58ae7cec1

SHA512
1ffdcfbb207b89d70af63c547c445d58ed8bcee942231044f424630f868ebd6a4ae9bfaf32e0c2850c726406a4ff37177e602f4286d42dde6b4bc648b3e61445

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6b4a1b7c498459e8a328cc88fa0ef4f9

SHA1
02b38e64551e5c678f652ff5d819efb15bf10477

SHA256
a8856c2e4cfad054b23fa76cb38e6d974bc45b22e5aac391560cd44c6c23fc84

SHA512
57180b12c7712a0baaaeb83cf29eea81257c55d314c9910e399f7a249ee7dff51de3f7807dbe7a71da09ce8819197fc1e386284372f0e8ac165b33d79d17ba18

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
df8168118e3d51660c61e3e6c335f2b3

SHA1
40572e1ab45d5e5d8eee1300ba7ab2e639d727c4

SHA256
ef8817e168e8061eb1fad01b0e7a6c781874605ffed0aa545d44698f2cc225cc

SHA512
b6e6d519dbc660426aa1b1799de667c57f2f41a81c584c6477b3cac8fc3b5fa8dab927e122986b3385d53c76dc174a01060b540bb61fa480803d6cf63d71f4cb

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cb2b6231565b319ca99682cb0bcb2f59

SHA1
7cd58482ffe3d47f4c666b0800b86edef0fa6893

SHA256
03093e14e3de4f7a88681ca65ead06a112fb50220bd5efce8375bcf6a890c67c

SHA512
41452b1537ab4ff79ecc96eb16f0343d034b7e148e1414218dc557faee81d7b3a57c252ded79c8a79c37c542479cff53032be4252f19b9aeb62c00405931b0b8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
edfbbe8557eff10dbbc4f8178f13734f

SHA1
b557f545cf397289c303ac62547fefc320133a1f

SHA256
ef708faf8b008c27d71110e0439a49a74d80e28139f026b1e094058025a9e095

SHA512
53cd46c60c1a0243e326ae8dec90b39b0760bdf88d668979da31c7967c9fce0381ecc98cbd36b461a9ee46e018c7921a9876a4f6031e9230828a3fd4856cfbf9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1999580b64b3afd5111c79fdf7b3486f

SHA1
04a8966a40906c5c16ada9744616f866b87ce0e4

SHA256
492dbae7f154add530240fd9ac351f0b8ea062d45f97c0cec2772ba2d008d786

SHA512
dca48862279635e4c4aa812a57a71088bbbd2fae37469debd31d5ee95ee75e9af62e2eb4650476feab310c93ff7f091c068196930c93b52264ab441512a0dd85

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit