evilquest | 54bdd383d38bd528df8b9aabba4fc64b04abad9f2b2253036e53842e12f729d7

Analysis

max time kernel
148s
max time network
151s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118
Size

168KB
MD5

021313f4c02734a3f996a29e2b1fd0fa
SHA1

cb28038a2adbb6ac7b1cb32ec2a470a1093262d0
SHA256

54bdd383d38bd528df8b9aabba4fc64b04abad9f2b2253036e53842e12f729d7
SHA512

a3a660d89364c5b5c8f06be8b04fcb96b0356825a7cc8ec4bff74927409398a1236263e8e325fe6d8af5ca7235dbb7ba718a23234fa7dd63c18f32c0b668aac5
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9R0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
/Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118
  2⤵
  PID:564
- /Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118
  /Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118
  2⤵
  PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:588

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:588

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:590

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:595

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:603

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:606

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:611

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:612

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:612

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:613

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:613

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:614

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:615

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:615

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:619

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:624

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:625

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:625

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:627

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:628

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:629

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:630

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:632

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:634

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:633

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:636

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:636

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:644

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:644

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:651

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:651

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:652

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:653

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:655

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:675

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3abfd946d749ff217b7b4f9e98353381

SHA1
b8c9d696a26cbaae6cef45332dad84987c801d02

SHA256
3945034a91e62c02aaf3b1ef1cf5d6a792962607b82fa9677c28af7eba41b7e3

SHA512
a7d6aa5f60556a59114513fb81707f5576c803c7fda00f4c6dbeb164984084192025ecca8f12c50cd8ba014c066f314650e1a1dca9cf5364bc5398b4965a7bff

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9bf7b020afbe52557de5b696fcdebacc

SHA1
824dfef4bde41b1deaec445c72f9b37f60d760d8

SHA256
32d9c4b38f025e496e52d81f480444ef081964b6499ff88f2e3a04660800a7a3

SHA512
11e809444cb3ef04d18c3306b276f688f1be5115b575a5c1629fd122d2c2192c5906cb1907a3bb52d517ff2c9b5635656fd594d54753177653396bb93ad8d18e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
912867560927b1576aeefb4755b04725

SHA1
e11cd47fa9fc59514fb5d4380766f0aeaa55ba3d

SHA256
477eda1b77efe52d2c1e2badc2f9bd4db7fcc6655630ec67fe9db14c21379ce0

SHA512
dd8b61db509d44843cd8ff113cd73bbb974505646d472ff39284bcd773b8d389dcb5d67b1caec8e608ba97375f18acf87bede59daa0821cf244be455276a166c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
03e12c4f2e2743192232ec80e5f89a97

SHA1
46b5dd4ec803898e3cb2c2c38b4dae4c55f2796b

SHA256
24bbad8ecf9b8007825564905718de977a2ec17d6dc65a26a7cbd7e3678cafa4

SHA512
a8bcaf92e84d5fe19278752db5121ab13cdefabf3a40fb69192d3e33b1281f9af70a685235ea0498b749513aac1e65206c73dcb006a045453d368205c6db1b74

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
38de2c865e6423ea68dc8ec36c8af2e4

SHA1
79007a3a955853728b0097b8aff16c2bc7497da4

SHA256
3aecd7d735c079c2a78bfe6f70e9f7460a46328e6c0a7b5f5626f0c47f651ce1

SHA512
72d3fb7ce236d802b3f80a4e5b7ab8611403ca0a77615cf63d34a7044f449fb28cb5c531e397579ed95b16c83a389a0193cd51c218d0aca562f5ef235593441a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e738c9e75bfb4123b7a9f87f63c7449a

SHA1
a43a72139fe84ea104270d601604197149823bf3

SHA256
8288049400363458137db13a39cba06f1efded6b787c8952cf826618bad54e4c

SHA512
dfd0e4317cb93cbf0b1e4ab7721b21b8ddb8b82f6d1002f885fc24209a01f85bd099740496e2fa667c11841afc79e1b53441a465fecfee87e28de404b946d2fa

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
11f904ae520a87981d5d5ffac16e4c29

SHA1
51b7af1f712ec04ea5020f218f07b8ab7c7a8a07

SHA256
d7aad078e1cbc36bcfe3155469ae5bd0bfe656361e9a44d3cced11dfa3b14ce0

SHA512
a567e22c929765e7e0bb65fabc08aefe3ec6b456647720343d9472d9cbdadbbe6578d85f61eed0c5fee992615de6d556b064ebd3a0a56f8a1c0846c19684d682

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9362eab74d0185921f91a357d5fc06c9

SHA1
f4150aca93f7f9b36fa8a34ac72c2e5c6d2f4c0e

SHA256
cdb21d4024f464ef2175f73ebdedceb83a54376e3ed604faae4146e442965c25

SHA512
33a05ea083db6ea2daaf06dbdde6afc9d6eb330d0bcb4214089af400e2e647b13045070928895abc25c6f411bd281d753b860bbec87d70a33d38e853ac9192f4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d1152b13d8ab594e941524540c4e00c2

SHA1
34cc7b2729d418d1f16c65bbeba4d3386a22d0d9

SHA256
da108d6a7e76fbeec78900169048d06b9fcec4cdc92b7178d0c553f93baf7586

SHA512
5eef35023c23f79583c92fe8062b22a3f929721c90f5e9883f1718449d18dc02069d907e5231780546a4dfae07e878d61a1828444894cd8a41bb05baae605ddf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7bf274d7e45b02be68a3538edddcce98

SHA1
934293f19a7406b6b5c0f7c67d0d4860512a8645

SHA256
83ab55e6051202e3893d97b82cb1a9e49101cb942583a418cafb6088bb05aced

SHA512
79fdb08b92f23a2e460cf01f22d924c14a73efa57ba70b5b7b36d8fd9d2d9c0c6e8985f88371ea220935dad26bd0f65f681178a32975eadf474a875b3c530168

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
25db476e64d93495fc6dc94ce085c687

SHA1
db10e4fa9aeddabd9251313904721b3a15a05071

SHA256
0b2b29dcd997406b8becfba75ae8c9ecf09553704add25f1dacc0b4fc90595cb

SHA512
9aa4ce348cae7fa323cd8cc0387a146ef9b13f51bc2e3589f541fdb0a221066e377810612914a917b49ad28dcb37b96b5eecdfac22363b68442c6bf62ccd431b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
69fb3b8740cd2ebe5c4f3d96ce2e2bd7

SHA1
3beb6c129516f4c1c8433a4c651a20b471711a09

SHA256
fbab611fa0f92f7956b0538b4b6624246578af5d2a1d26b311485779607e8e38

SHA512
3bb3e8a1e3aeeb1ab56501f3f14c75b0d79d574fb8706f8356aaf553a7771e64f87850d594d6d18346f33fa1e38cadfe10e567b3b2f9612bb8b536662a0a8d1d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c20680b193477b44af6deec83af2a23c

SHA1
bc4e2aa8c65c4a12a2d93e743e639f71a5aaba47

SHA256
a63182ca6ac7b390a3e3f0fb7c3719e0bf0f12c04a70db95a77b69e2319048c4

SHA512
8be15f719ae3334ab4c43d6bd451ba1335426b53233df5cc927b33da2872aba8e6bfa22e77c048cbc1b74b7dc801abb42d73f9238c427285ea64b0886429de6b

Download Submit
/Users/run/021313f4c02734a3f996a29e2b1fd0fa_JaffaCakes118

Filesize
168KB

MD5
6c05e45245be281a2bab4175bf838ed3

SHA1
6eb465a5806ffe0b48e645f4c225b918cc0db7a9

SHA256
959da6adc780e1030104d0169e2efc6de5e3da15f7eb1c17d7fea8cba6180eb1

SHA512
45ba122d8b128c1a6d27c4508b8568a52a7aac0ef326b97bc50d0a72ea0f35d89ff006e55295514f36dc121a8f89761f3e7b59a79cc3f3374fc29d7805e6129f

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
4867fdd23b5a7e33f18e81ddedf6bfaf

SHA1
1a42c767006bb97f6091be8e16440fabf44adf41

SHA256
674d8a5582396a35c274fc4aa3029e0367c55ce20fca415a11d3b17e39a16dd6

SHA512
664df741062ff3171e785996f33d0b96dfa6d4108a0c542cdc8ad239e3174005e07778633efd20bd4924f9506685863a2296a92e48d9ae8b05a1256a52479b49

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5b90b7f124983e6f6f13f88dde0d8a06

SHA1
8d043f61ef4a9434cd34235ff65e343156d5e8a0

SHA256
b754986521563eeaebf42ac957f90a81d91eb9aab2b898c759cb15778aeb89b1

SHA512
2734da15b7bc71fb2af2f4ffe176ed6487f593346e351e84b96733d3787ec053651ea9c05c3de2a8d572dc9b16dc20f124b1e05cfd963507b50c9969ee36392b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b6528e1046d40fdad52169f542a0df28

SHA1
a14790298e063ae046b6e431db0ad5bebf44f721

SHA256
9aa55617ef905e36b1df67512cf56eb69da37dde5520a0cc4e3432bb472923a1

SHA512
b30f177511700bd11cd9942076f1c86242d2d43193e7b8ae96e81bb9f9c77b398193bf025c4caa1c1a7d3be3d8cf0394a9320002aa7b8bac2490f2d144e0232b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d199e7c2fe22ae0b326c1ad4263ab03f

SHA1
16d3fb4f4cf8e7c99329d9fec08d94f5da1d8b27

SHA256
c9fd118582ddd22860a07640542fcc3f6a529d5ce6228ed9145534a9006d73b3

SHA512
d2de33351cb45ae762aeba991341d02c0af64026d9dbbb64911eb7e341a014e6409d69e6c851319e5a8b35f7052ebbe0ed4bbba26f4b086d11c81de54f4b87c3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2ac08f9da14055d3312fc5f3f0c65708

SHA1
b7209d9846954724368e0ee3587cbc21ca9083a3

SHA256
e8160525ac4452ff8cc1c563cd10a51adf4278e3ede5cb1bf0008e59d4f6dc65

SHA512
944a6784075c6461dad4b051097f3e78e463ff6236b9bf52b8159f4cb4b10c57f18dd7f54bf9ab38fbec67ee323327815782368175ca1cbb71f17cd00bbc7ca7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
dd1bbc247af93c3afae4e766630092fb

SHA1
479b252d2765be029bffd4b2e0f2a6544062c4fa

SHA256
1772c031f45ef4438525e405b9c313c4b9e3f659a0de685ce88b906278cd2e39

SHA512
6b6d256dd89235fcb97cf87705e11faba80c4ffbe6836f2820d76b005c917dfbd8c2646fb06ddef77e143aaa4c0dd5cd556ad367b47f756ab8993878790d5687

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
37c1f2514acf2fa6eb8141f288604ff3

SHA1
33412aaf958575d389c4f42b656b8f83f0d1a556

SHA256
4d7ea71e591b6ae719eb346c598e1f25cd53744795aa985793fe1b0c7ab02d0b

SHA512
827416261286aa2686254ec74a7ec59ee0bfaa036df34ed8be118c1397960e71d85b996cd24680431a31715efeab300122d30439613136074e30cccc3c7c047a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3fde38ef05f3ccbba6a8b93ed713265e

SHA1
9440e1659e2ed32c823b7686630258fcd25212a2

SHA256
b66d5f45503cd6d6282620b001564fd0271eef5df74caed9869188807f71191f

SHA512
47f00f30f69f32bd2f786961ae99bc521cb49da65ec13d6c7ffb1bf525e186284e3dff2245cb4bd1f98000fb9e60238ca61390c3c24014066124a0f546e15e02

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
07ad577a5b05a6a9bcac90bf695298bb

SHA1
1e33a6c0cdf02a197dd8a988cc75e1993c27c943

SHA256
2e100b93ff30c1c7b7d99ce3dcf4a0daf667d85005c4d607034b3fcb6d2d658e

SHA512
71a39c13a5659a487601e115d88fcad13fe85705f2917c5b86bb32372078f7336ecbcaa60f1b72dc3662a97c20df4dbad46ebb38932e512e46dc951d47dbc176

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
961b8cb1102cf38652d225c1663d07e6

SHA1
fa9ae0c1a30520dd8b134ad0dbe0db1d6488d4db

SHA256
dd85712dbc6f7cac36eeae031650bd4842877cd982df86c6065538738ae1137c

SHA512
96e72c64467b2c9f76b734d0fcef8c1db26f085b33ee0f4e3ba7fc286002cfbb2cd7c5f6ad756347866673b955880c08002ab9e758f14e6d685de4a445a9832f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4ef598c43e2de92dbb070f23cf36e2c0

SHA1
27e137f7ad6316beeecf544d84a1e5aff47be8bf

SHA256
ed034bd0e887b1c9479c29b4bc79322c3207a1f1f43c7626362971f27e9e8813

SHA512
7fc03424648f4df2fa8c6cdfec9d94a3d57f59cf1439188d03ca3d64daa121d24e5b0ed12a77991cb756d48c7ab5814b30625c69bb2c195ad6cf8afbfcdb1fd0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7e3f28774dc5daabeb4078ea69570c2f

SHA1
49d098697f0f18cfaa328ef0bf6fce417645ce15

SHA256
6f8d2ad025984bd75ac687ecc1d652135c274d52356359bb60f9197c9a040e17

SHA512
ae820d2ed8c7600b7ebbb3e58f9638db3895c34fdda153335a14edd62a867473516e31562c5c9317c51c71258874bfbc0d9f7de7e658ac3e56f6710a65ca8a38

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
84a26617bb7ed05407afad781823d556

SHA1
a528a363cc7c6ad1611c2eaca45722dcb543573a

SHA256
202be4c3b6e86a4e25ee1ece0adf217279cf43211f659d81125b287cd5108fbe

SHA512
be6c1cf4144eaf919215c66bc9a4587e4bdae534a370600e8d15682c1cb06f5c711707474c10a156c1ca678a4bcb84eb913228a2f7f6fd90ffedf29eefcfdb4c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9c608c1be056b365804ba3138d265573

SHA1
7de8acfd2d2879925b77095f5aefd29d31685cfb

SHA256
e958a8c7f14b3452f6b04a8ea586eca9e95e3117205938fd68e07d2655a42e02

SHA512
5fa55535c5d95088b8260555140923378aa83c73050d8b9c698b145ea03c98d847b685b432292e2c45ada919d09e0c77b159801c2ea4500c8244a84927b7e9ad

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
11d998fe999b9460ae02063c38839482

SHA1
b80a58f744801dc4445dea74cc7659d0ba022775

SHA256
57f0bc40483c0371fa3358135711379cc24348a4f815ed18a1d1fb7332d0f548

SHA512
ba2af9f268d52ef6f640f56750ecc5d09b947a7ac55e66bf1d4b28a0ad163b656c3e1d59d2ea4e25839071cd5c1e724226a695391a39a34ac310660dd9784dfd

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit