evilquest | 3971b47aaee4685fb25e142d6ffa4012d16353fb379e8030c952ec8aab9a44c7

Analysis

max time kernel
148s
max time network
147s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26-04-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118
Size

168KB
MD5

01215226bf408f3c71fcc7fd67fe00d4
SHA1

5d7cc9ee01aecf22d362b3e085d46a543ac81002
SHA256

3971b47aaee4685fb25e142d6ffa4012d16353fb379e8030c952ec8aab9a44c7
SHA512

ef7e2c1eb313536a531ec3cfe39542fab06666a021127249d4bf1bc51bef036b6421f7c908e6bb1be78d48ef76e2e00ad62bfea14993c5bc1031a5de96e51222
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9L0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008af41-0.dat	family_evilquest
behavioral1/files/0x000000030008af41-3.dat	family_evilquest
behavioral1/files/0x000000030008af41-11.dat	family_evilquest
behavioral1/files/0x000000030008af41-21.dat	family_evilquest
behavioral1/files/0x000000030008af41-32.dat	family_evilquest
behavioral1/files/0x000000030008af41-38.dat	family_evilquest
behavioral1/files/0x000000030008af41-43.dat	family_evilquest
behavioral1/files/0x000000030008af41-48.dat	family_evilquest
behavioral1/files/0x000000030008af41-53.dat	family_evilquest
behavioral1/files/0x000000030008af41-58.dat	family_evilquest
behavioral1/files/0x000000030008af41-63.dat	family_evilquest
behavioral1/files/0x000000030008af41-68.dat	family_evilquest
behavioral1/files/0x000000030008af41-73.dat	family_evilquest
behavioral1/files/0x000000030008af41-78.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118\""
1⤵
PID:520

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118\""
1⤵
PID:520

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118
1⤵
PID:520
- /bin/zsh
  /bin/zsh -c /Users/run/01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118
  2⤵
  PID:521
- /Users/run/01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118
  /Users/run/01215226bf408f3c71fcc7fd67fe00d4_JaffaCakes118
  2⤵
  PID:521

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:522

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:522

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:522

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:530

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:530

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:542

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:542

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:544

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:544

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:545

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:545

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:546

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:546

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:551

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:551

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:553

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:556

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:561

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:561

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:564

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:566

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:567

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:567

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:572

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:572

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:575

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:576

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:581

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:584

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:580

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:584

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:586

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:586

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:588

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:590

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:591

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:598

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:604

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:605

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:606

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:608

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:608

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:609

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:609

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:615

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:619

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:619

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:620

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:620

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:621

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:622

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:622

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
001a66f88327ab799d896d1e20176b5f

SHA1
4799d1714b75aa705828cb57acab7b1ddd0e1c18

SHA256
c6f103d79847e2aac8ff9663cf51f398a9f44b30c4dfde58893eca6a97988b02

SHA512
c8679074c6e2a184f158d7b3c17e6b2a9bd54e8e60465afdf75148b9159dfa86a6cfa08661a406eccb420f19f1e4a54fea0bc161f7ac18b24611ec569658baf8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a509a0a04ba6c1fd875eec0788469b05

SHA1
7192003b2cc4325a63a2142433d6f0fdf885a0c8

SHA256
f56890f39f54e1a44e0d14727cd1b409468c08e718378d96b907610a60ce7771

SHA512
2bd4fc8d6a0ee79ffd2cf570ee8ba4a868ca69122a4b84351be40f4b33f779034945f97e57e793f5e2544a1eb7023a6b1855b6a55dcc75b3851f0bf19fea37f5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a3fcbc69087fbb5a79d630acf5fc2455

SHA1
415bd58af0cbfc6598bf922887eba5208c1b70d7

SHA256
3c24387a242dd63301f1bce7367e306c6ff3655975283ba9613533c80b49b60e

SHA512
00276d8cc301914f6ac9b003fb1b303a0498f7abfe763a91b3de872cf51da00fa4df3d4f46c5d099ad29bc96f589aef1da5d599c666139c8b6fb441751aee386

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b4d42775d4674b9a5c11fa18a6a70c03

SHA1
2c1d22ad7cb639a1c4acd0ac7874e2ec3de08325

SHA256
0fa114595f6c08555f4410c4768a163dbe5f95c59ea516cf1e1c4c8b320a86ad

SHA512
89dfbc0c3a0da2b18de8ba898db0e1f26bd6f519795df054927904a535cdfd4d080c583799877ad437490b0da1c4a61c536dd2d8e4548560d2a572ac1692f6ce

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3b7ad8ca1b0dbbf557091a2f6228bc62

SHA1
f8ee594c50d01c9daf0fd884f13552d9891b57e7

SHA256
6cc06e9d21a6f3135be5e592b2cdb9a11eea68c0a5ac9ae9514d21889e5a47ff

SHA512
0a321d8f2a4d21dda9986a9c0b208c16851b98187d8541f28230707ed5c4103d5433f1b178a156a6e639bebbb9d50d6b3cfed6be6436575fd1bf89e9473312fb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
689d831652026e9473e39449c8ac7ad7

SHA1
710a0b8691ede886960eca8eb538fcb2c35d9674

SHA256
5b26e277c0585d032e052f4d3b14181979ba4f6460c9b02e6a5ab45a0b7f3da7

SHA512
7deecf367d803f087d6949cd32cd8dca96ad7e5e4e7541b409c8da87020d0a4c45bbcc9ebb927b1ba57b8cb60753217da81983beb2d0ef5624ac1653961be7cf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
df5b10741aa5949c6c9b996eee2bbb64

SHA1
c06dd59f64641ae19232e10c930e88e25099dbb5

SHA256
30e09ac0cb442be68e23b4fe7e344c91c2fac2227b489998f64875cd0c22151b

SHA512
aeca7d4c36232d9e7bc107edd67287ee5b57d02cae5276599e28a5f5db7728b1b72f34b9ed7ebd21b2ef82dea003d6a5cbb1dabafd0f2f313a3a7b77925ecb57

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
de7acf6d3fdd7112c32d1d977e6e1fbf

SHA1
1ab3087c92043d8bbf36835458b9807d53fbcfab

SHA256
2a10655e0c3d120041f12a6b337f8a73f0affceabeaffdf05aeaaf4e02e21d4d

SHA512
85998be84d6c3086ff62f78e4cb1b9b6dc9e82f7eef1c083299bbf577b7e8699342d23d61646280308b5a6fc3ab2616931c9c0752053255c72208a4c5469429d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c401d3d46eb13effa10c9d8c5a03b458

SHA1
358a1a109d682d119fc0f60361bbe18f61324f9f

SHA256
36aa05a867e9900bb9b566bc0049b7f741db94b96f8c8b0a4bf91a62ee665092

SHA512
b803988d995e5c0e92b8558944e2fb965daa06f69dbab036c170988e948b47844da52e7bc9ecfc0c25b781548936cc46eace351e3ca9a8cf5eb3b077a0435aac

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8dafbd8ef309437f59b7ef7e23127ee3

SHA1
c0f8227c7f5fc7c65c4c6c7ff6d17cad5cae01c2

SHA256
9c57cc88b0277ba2ed39178de65de5d0710be27cdd138d11166e3f85af1cff50

SHA512
910b30c845b37943fe115e4c26519a58052629f8a58c1ff674175b6c347bbc3b2adb64f5abfc3d652319c01fdd573880e6d5e7cbf2cce73480f25c1212fe258a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8446c737c5f85b41198bc8e18b4532de

SHA1
cb5542a6657aeeb707257bde6e44e4f90b2993d5

SHA256
3381d41d0fe46202d846c9a3aab039d04897bc63f66afeb8827cdba2d74787a6

SHA512
d87c013e43d3f0c5958be4cbda08fa2e565560465041c9f3d1faa7517e86e4f805ff95f8e0241be3da19ddac337029478a698b3ed43843ce7e5a70598adb3c2a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a57ebdda032f707f577fadc2db480618

SHA1
c539700e16f17f9d75ac4328c5304da8f0cf3be1

SHA256
7689db4ad56994ad99add8ad7d702732fd836845167c941edd735615f6d84aee

SHA512
0868bb4473885def14a287d002a88dbd55815a69979019752d5759ad40df7733daf7268aa74bba088fc1fdb038c71b837f33224da6e3edb6ddc3bae69ef356a9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
39953c64292de409d9b2d79fdd66df79

SHA1
3f8a0d70fd29e687f4349c3cc4ce1c95656c2cfd

SHA256
39a019e8b81ca72aa34312da2d4752d6387d8546a6d9f8babd6eb6fcf25d43ce

SHA512
e48e6b712fb66c4b3adb08ee3dd71e71cbfb3e18d374bb74f3f01c72c56c0325f063df170189fb350120fa26c373bd0f93be0666c006987f78cbeba652fd599b

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
126B

MD5
95f24d2f9121654acd5a1c44e572082b

SHA1
ea13b61b35ef396ebe42f09e638a39f13b93fd9b

SHA256
2b7b2a1c679a5a0d2465351f35584f1eb6de22160daefb4cba351838f98f155e

SHA512
d1eaa0bd0b245f98a03d24197e02096400abea41f5a36905a41c777bedba15194f3de256c12b4f038e38267147986e8b9dd543189fdc6d1788d3c012bc63270d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
167B

MD5
1340033aca269b30874eafa2ec72adfe

SHA1
e1c0e123ffc93a5f22c906c7206a625a149944d1

SHA256
fb10f63de2c68693f4360c0c8cb0dd64e163dde54ffb9c97932d804df4a4f724

SHA512
587feb19b7dcfc422a0feb360fc1a855a766e518d8a16b0e6b1df509706c0b703270449e5688bcc584002f277981d6f1edbed996abdd81b8a402ba968c2d08e6

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
da0674c5b16ed3f73248b167c9b32d5f

SHA1
59a807ef31e945ccd4750f3490038fb89a79ae16

SHA256
1c4099398971d7662fa80f3172c9cf9085f8ac24ba700228ab65750c4fa1191d

SHA512
58c5f162183092d3487150d7657f9fd151abff058e986dbe385e429a3b05a3d576b010e2877d50e16bd99daff67b87cbe2bce4b84b0eb9d88f6ec08e2532f1e0

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8b3c6fd4c6bfdb6ab2684bdc7e52ee02

SHA1
614c5bd67912f92b5571fbb134a1998111ccf1a4

SHA256
3a013618d634b17e45ce14a42ec5cb9a8568b08ef0c3ddbd9a540237ce934eb2

SHA512
82d12920639f7d85f59195bd4e301bf71bf5e128bcba8ab0842e1d5da27ba2903907fed79a6a76725acce7ad56481e2b9a1c9aa55e7f66b74a336c0f583833b3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6b313f2fbf0427b4eec9711cd0079968

SHA1
dc7882cda497cd5ee304416636cea912099a184a

SHA256
2fe921e01c5a182f14c83abd298a80ccbef1edd3ded778c3d845a437a33472b7

SHA512
3b0b31289d4bc245cffdda48369a2804fff9d79b76dabc13d8ff399b2bb4983ae01b093d6471970494c2be68b25ab15d9675f2f83c1123ed431104af5000197a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d4fc4a61f35302f44e443a9148f7d268

SHA1
7772efb0ac68236f94a103f819180684ddd79ad6

SHA256
4c8ddd8ef06a2721deeff8d8d331bda8de17b55268f70e762d2da9f51396490f

SHA512
dc23b760f1fda3c4934fcd859884f4f70344cc4d04beb734376f94c57594a08ec993c62f51206f59ef455e138d2c4d121990cb53eaa8330fbd3a82b51ffdb47e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fa983703fd266b541ea6393d93a61790

SHA1
89ac976dd269a122a5b24ff848b1347fff1c882b

SHA256
52eb05662c64d09c3d4367a5385080ef4d426549339762b6e65921c22c969c73

SHA512
5ec20919124208e4a759a6f7f145d1b73c8d020ab8572fa6498a0b8663f77ccdd0df58eb9843840811aa4c3934822a7adb6835f04bbdc4cb5cee7526148a4a9c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3d9eb5e0ba175d66f91d55f63536386e

SHA1
f6ceb5b372758c6befb4084b42a0eb02026a34da

SHA256
8fd884cdbeea19a8acfb8edae138f83f47b11bf0670e9a71b1b612d53e03b92d

SHA512
183985231acdd1ff0a803f7408c60b7f55a976b565595075b4b88d380ce6f3362ce7664eaa0311f8b4666426f860c0f7675cda48899af70d8d2bdc8fb27bfd88

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
785890b6dd390ac798e97509690ecfb3

SHA1
c8a002119c3755ce8dc59f6c646d565653176d02

SHA256
6a80b74a793ec140ed708657fe268f51dc071cf550c34e6ea12e22e7ab29b1ee

SHA512
9a97b84a18ed4c412b714fa0b609761b65f4a5c2ccf5a02c8be3fd9c85bbe3d394122c6931c04fc1214d02e7871fe6a6a4b9bca45f8232b93d44eb4402c81988

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
23bd72fb04c0170bb357b7995215245d

SHA1
207cf16bb72af312b4e95d57c64f819da3560c4b

SHA256
ed5e907ed6373461cc28d499c50407faff1599d727c73155d3eb09bd7cd3fe15

SHA512
20670d03704b5a63510d629d2471f6c7bbefe1efc0eff4ea09be24b4b61d5804813364b9b14ffc42e252c51061840575e60230e8eb34d83f2234ff1ed84e5e28

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e34aa7d69710caf8cafcbab452ef8ec4

SHA1
ddb05b7cf7e66918cbd11f7f08b5aaabbfaf9325

SHA256
59e95130970c3718e778da293969ac79f6cc935cfacdb2fe7c75d0383a693530

SHA512
4cbcd0a0b58b33d733f063c128ac0c48e65014efd391e7186ccd4a5d18df296ebb509052c29b9bdd3e045d6410aca04da211ef240f10254666d6a524d6e2e38f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
569aee835ecf8896d17fdd058a06da40

SHA1
9015a9659b09464b71d5a8e3f86fe867728d6f82

SHA256
899077528258a248346715f82b4a5a15c29c7e2132dfb486b575f4d625120c61

SHA512
c334b815015ad6eb36316d5a9d4ba71704610fecd79f87d736b8a12462d3d77be6f21a81fe0b01ba4d8d3e299e2125eaa597d6f789538827caefc61e863013a5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3aca0a46f38bbdbc6612625c7e6bc0f8

SHA1
e8799e4b972e5c283b2bfc52848d16828712d2c3

SHA256
9ef5595d1d1d0f99ca7eae39eed2cebfc241a9da787dc649b1df4d200ac5cb14

SHA512
6385b9f04b6a38eb3c091552be38b7dd695079be2959ce1154cf6b0421b5d70dfc6dcaee6b968cb47fa8a6eb6340dcd3a9027500aacaf7c152a79b4801b1233d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
998f62097dc5f83a13ef261582f33809

SHA1
5f5a36bfdfecb82055c763264b57442a0d8f7eb0

SHA256
ecf929d613fd864c7b5627f82d7fa3170ba804dc14eec96b3e4c3212495953ac

SHA512
2f753ba2e5c4dc2646f7f9a3322afe67a6445f872786ab9da5458611e6f63690b8e5ff32e71c96c8923b65bfdb95fc5c18b8ee2c3b573e2297c81b4486282076

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d1c14958942b1bbde6b9362818e22122

SHA1
9e90e9d9ecde5e69e7abf92388707eac7b359b97

SHA256
363a38f367bb76a578c25ecb5f3f81691c4606ec0e3cd01e2da4064bd3503748

SHA512
9fd456f732bc22fad8135bee2ff9189bb0e84e59267725ec2fe5932384ff5e20d9101bd255445c72516ec9667ca0dbed0debc7a219821b7cbd78e3830fa52883

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e16e36282a9fddb0662be2b85b21a0b2

SHA1
597549999664154213eccf8637b9390dd47b1c7b

SHA256
ea2c2f2667aa131899a0901dc7531a0f53f441ca3c5649a95fd71508c12bd282

SHA512
1712ed49eceb9fe6176df749d551ed6a627901d515f5f66bbe0a0046772368a64c96217654f5411c524a7238f4ce857b6121a2b5d5efc318b04cb9aceedba423

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ac9199d0c9744c1bd3b7786d3d42a09b

SHA1
f203d948c498da3c9c35f9fd5ce3143ba907d799

SHA256
db8167c907cb4273bcfa43cb445d5d20fe188796d158425a9467be3f7ee23144

SHA512
c28695b8f8696c12751e7199020830cf0aec8d717fff44449ea588b5e281b16cc3272cf0ae4058f4032ca815abe6d2826132df6a548109cb475fb3046e07fd21

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit