evilquest | 5a5b548bcd07ed5c302bfe57902caacc9614b1168e71b34e908cbfb5a4b6cf29

Analysis

max time kernel
149s
max time network
149s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118
Size

168KB
MD5

02a30918b9a27c71b18f190da71b5a0a
SHA1

7123120c2301677d480297fd3bd1cb7a45f3195c
SHA256

5a5b548bcd07ed5c302bfe57902caacc9614b1168e71b34e908cbfb5a4b6cf29
SHA512

01b19563e7f8c3f490a1f8bcf9f89f66ec0061a0f63240dcc3d223a65d059d713aeb176c4fc50c0afa084916582baea799d9f378990306e607feaf74ca0291ca
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9R0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adfd-3.dat	family_evilquest
behavioral1/files/0x000000030008adfd-6.dat	family_evilquest
behavioral1/files/0x000000030008adfd-14.dat	family_evilquest
behavioral1/files/0x000000030008adfd-20.dat	family_evilquest
behavioral1/files/0x000000030008adfd-26.dat	family_evilquest
behavioral1/files/0x000000030008adfd-33.dat	family_evilquest
behavioral1/files/0x000000030008adfd-38.dat	family_evilquest
behavioral1/files/0x000000030008adfd-45.dat	family_evilquest
behavioral1/files/0x000000030008adfd-50.dat	family_evilquest
behavioral1/files/0x000000030008adfd-55.dat	family_evilquest
behavioral1/files/0x000000030008adfd-60.dat	family_evilquest
behavioral1/files/0x000000030008adfd-65.dat	family_evilquest
behavioral1/files/0x000000030008adfd-71.dat	family_evilquest
behavioral1/files/0x000000030008adfd-76.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118
  2⤵
  PID:565
- /Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118
  /Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118
  2⤵
  PID:565

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:566

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:566

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:566

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:585

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:585

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:591

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:600

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:602

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:606

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:606

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:609

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:611

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:612

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:612

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:616

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:616

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:619

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:623

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:624

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:626

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:625

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:632

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:634

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:634

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:636

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:636

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:637

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:638

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:639

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:640

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:644

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:644

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:645

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:650

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:656

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:660

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:662

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:667

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:667

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
73044ee97348bcf39e425850124a2017

SHA1
fa076781a6628d62fb07828428ddbab76537ad3f

SHA256
a9763262f7b99e4b923616635cd3a66723507201a41384f2423784e33e357bde

SHA512
19389d72528b4269f4b0f5f5f1e92960a3a22b1df0558b24930ac4772a3e0982680881caa3a54f9cc4d931240e867b68a777846a4f7f016c0577d64743cc81fa

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5485d3e5442b994629050bc81216e6a6

SHA1
ac12b9733809420f9ac6d004b90c65c8562ed14f

SHA256
6144a469ecd71ed3b72e40ac37220e03adc48e60f48942c54112e12036b87e6d

SHA512
249f12657e3fa6eedc86c5c74496d024ae2e7e5221d03594bcd092128ec162533e3f0e9dfad8448c6acbf9b07f440c3c92be054ae70bcce98f4c420521db2a37

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4d81dc2039e07768af52a2bb09e22d2c

SHA1
6ed828ac536183a9ea6190f48f84f0f87438e5a1

SHA256
036aaf010ea05db45659af68fbf2f30fcb3de376cf981e6380d4998e62b56b55

SHA512
781878c999b67ce608739c353f9fd3d26a6c0f6eb6e26335e99d69956c0c7203348b0aec210eb61eddb3daa351a5fdd3605acb3de5ddde282aa7b87e1d8c8fc3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cf6f0a53780985c865c3158843792f1f

SHA1
cbc9aedf0cd6dda8fe284f7a0a08513d6a589df5

SHA256
8c08d06a247c341699e2d6aa8d53d837487b87520edbf906e9580731768b7b40

SHA512
fc6fbd1e2fba5691c6db14dc6a938ad5707b31634c8c6a4e88fa7e3904504d621603d2f7339fc09b2fabf9db5ff7c5df1aec3d16b5ddb4058e3b7d27d80d0c01

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
96702a4e5bd83deddb73b6277b2f52e3

SHA1
0d34cd53cf2cb4df243234d25a9462b69ca13bfa

SHA256
286af9ba0c49b7c71ca090d29c32d6b484b8a521ea984aaa2be894876a476422

SHA512
6e517d0f0502b97b23a1a2f383ee3a26a8f2e41137433a5b0a97734774fc12e5d0c198c16f4fd4479455fe2f8b7a87e4cb7a4f3597c317278955d695694f091a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0f795693731253526f6b856a93069a13

SHA1
0bfbf593d1038fe9e326a65b91cb0d04ebe5d184

SHA256
feb841be6a6f38cb63d5466e3661a539b51d0107d237f0fadcbaac959970708b

SHA512
c8fc37c88a1804cf5d5183b6b1c32827c83d3185a97136ecfc499cda5af1f5483129f7df466a438bef36b21a1df9ce74a38d7e02934ebb9c87a356fd9323b770

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fa121da33f5c39fe4fd81b5f75f31b27

SHA1
68e630fa16e82e34c6d6f4fc79a527419d12b970

SHA256
2cb7882e708bcdfa80b8e5663b88f2640bf4bf3c51e6ff1c4b829c00b684f71c

SHA512
4b19a93ce2c73ad3b3fd3ae000bf6b967442995e1bda5bb99cf0326937180ecf7bfcfce0ba4182e395ea55ec05a4782691667e38e75439816db0132613481e21

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
566b7cf54e014f3796faa083285a39d8

SHA1
e913071da3caa686c56f4fa8e34c5837f030c6b8

SHA256
80580626344a3f40574ed84b77052b2402a141b41712fc75af8ec5d2749c6950

SHA512
52a237e2a72f46c3421862c0c9f35b6962477a9cda67094431ad2776fc8d0656b913ce93d723d462466a8a117d267351487a0b6dafca068d418c993b96c2103d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
30e0d5247b4345af3d07ef35d455d926

SHA1
a39a1ffc9315ca329f66025563c03c3f7fda5524

SHA256
4ead483ba462790da32f33869321ccb81d5743a593387b6be458863163167ee5

SHA512
09dd3a5ffa096529f3a807cab5cbcdcca5086a233dc317a887bf087810cdbbd2424fd2741dd22a05f6e46fc6520d0b0c23e101bf45ff62bfe71760205d5570dd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8c64549546b3a2798120c3c06d7864b0

SHA1
7b52b8ed2b73ff99c7fbd27b4007a70b039230a5

SHA256
ed22ea2c6de1605a8e17753eee6b7deeebc5c1ed1a5eb0aa56d76de0ca4b0732

SHA512
80f79dc536fcd4ac6f1d0226eb24e733056add3785ca4dafc849daedeb2baa15d3d3488a128cdfd2079eccac1c510cc6b6d36fc83b4513f3aa5cae085b1ecac9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
644c30f249c63626d31ab751792a8771

SHA1
c1f5b91b5f638dfa44cf1219e25a077c23f6ad58

SHA256
3cfddb1d12f2b6bc5a95293b19fcea0541a0e909a275284f0cf1f73e8cdc82f6

SHA512
ebc72cac6dc9049c8d3d1694da1a22148ea47c5c897d722acb1efed627e7632b3aa4fb71855a1adfd5330e9a78e90597e36c9baec3537344707e475218cc4f04

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7262ba48de2d17bec4f076ebbe5fa112

SHA1
e6530057a9a9ffc61638fca6a87d244617231578

SHA256
018be55140c1c1a2ce1728fbbce47c2f8eeb6e7b9f3794b73d8bd6f5d9086a14

SHA512
8133027e9f086a7c11741ebb86d16a606726e61db3b845c815608591dd26bc8003177522d314e47048c2f474767495f7a6bf30b9e1c878ba30ec58267b90c97d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b163197e4c5ef00ed4ff87ba67da0f7e

SHA1
fe10731b848d2ad8632d2b8fecc0199bd8ad54fb

SHA256
0efe48770e0baad8f31c06992c13d0e673a00d015e978ad7db222fa069155d4c

SHA512
06af798af4a4fdd0affd1df4782571e777d1ef8f63bd9edb9b2c53e3f620614bf6425ce54f432c6b76b8d5236173df78fa2064b629048b4d1f7af90e9c8146c8

Download Submit
/Users/run/02a30918b9a27c71b18f190da71b5a0a_JaffaCakes118

Filesize
168KB

MD5
62a1fec670eefba7deaeb3dca142eb19

SHA1
4b6120882691eb98f532e92a270fa16809a3841e

SHA256
cbfb7b95236c4b0b44ac6fc68138a662a0e3f7b06c97d7985481b412df80b378

SHA512
2fb3b6419b14774c0a74d4b9b359deb0fb4009491a92594a8e4dd0a015340fc01906edbe61c00bed71df93ed9b7687844539800411068625ed1c5fb8fdb67de7

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
a45eea8e1968833335a77543abc98faa

SHA1
104fb9c38969379fc0a316ed11b57dc603c69627

SHA256
bdbf29f6b7b35577c5905812d026b1eae46cba0fc1f6ff649ef2843836e6ced7

SHA512
04e04c7733e55e735440ca4d877ab67c9b5a380cab01317464eafd7a7ebea2d376a8f95437bf4a2d4456042fb75ce85725213b3cc9648956b89c19a586466588

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
c0307715ffe62c3d8fa65ec86b37f328

SHA1
8e2b5612548cf6697d606d373a1889bea0911f38

SHA256
f6c3444152bba073c425911d1c263a64ec6de3f0411bdd54beff38c6fc9abab8

SHA512
524a9657550a2a9b1e887c11876cfe8080723b1637bedf537bc90e47809eebc18d0760ca9fcbce209d2e62bace9b36f858a555cb4ee20f5a9e9face610920dff

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3a7370f22f931a2368c6b22b25c7fb1f

SHA1
b2398d156c268067d3d25dcc3be2873436c67eeb

SHA256
cca138462e9dca8d22547dd5fabf9bcee1abf50afcdff6c3d14b41985e7a35ce

SHA512
4fccb2a5ef091df457df31cc76a6402d25d6216e50f909e861db9a3e5de4b1d4fced57f30ee5ebdc2bb217179892306b4b499f43b2053d3ba3ff0e91d44b0658

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7f6061e5af1a7103cd6385d07791acfb

SHA1
2955ba63536904f0ba465ec39dafc24083fe2866

SHA256
7e5b0e7413b452c83cf0fb4e590d33cb08b1c650dfd3f0910de0111472cb9a43

SHA512
3c52743bd92c8e411db530f8cabd847c0ebcb031400f35890a8d36cee37f67882c2874961a7487747ca4d560b25eb8d7eb6f699311cd0e6f21e9f4912335332c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
aa75e00032c54dd5e75515a5ba49567b

SHA1
15e0360a93935dde451deb8e074c4ad18503bcf7

SHA256
f945834dac937f8c0002f9e4f2430a616518dabb761e701c8e764598002ac822

SHA512
0be47b1b94e25c68c5ef9996fe1b1ec61d780923859eea7ff5068006c2213b856ce89e2a5fcd46f72af04529ac8b9d391bcf92474e0a81dc8a7e0391fd20faf8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d47ce41dbe65c0f9b77c00d61c42f583

SHA1
c03a045f3018ce30b2cf297c97aaed28b09b695f

SHA256
ee50f75de1a70c3b69efc3767ee1393c4aa87b74414f9d4377ca60254ee8e7f2

SHA512
cbc60a9331a9dc0742f1b1472bb0266f913443b311fdf53854462e60336e43e4f9f11b8b0334f1d93ed15d74f2250c1ecca49d0f5404fa02642d22d915bb5ce4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f0ca1440ec5f5cf8159aac793e42a8d3

SHA1
26bb607f7a07c4980c57834769d996eca468ec3f

SHA256
d4b8d988bcee4f4b8bd2216c6808818bd4ccd0285d42b8611ddc0d2915fcb964

SHA512
1efe737802219cfb1383fbd9a0445d7c6f1b21696c92418ed563d5a589d320478770f3262c5c7c966acc1da47b91f94d2fb0fc5446b183a84188f2360451e07a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7304ad593d74430bd123da7aab8cabac

SHA1
c0417dca0411f1ae942c92dd56c588622cfbc33b

SHA256
7e5784e81d0589086cfb01a06bb7394ef06d1ea2ee9c53c600d27936fe15506e

SHA512
e5fac9c889be5f3ead5cf31c5351e4f0081b28bb9bc979fef137d0b05eb3f1dfa7044df82743e79da5dc0d9157b8b9e6c0d0c829c0b459b1877e3a53ba666203

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c788b914098063bb9429dbed3184295b

SHA1
72da5b87f6cc37a97b65dd9eb314d443479a208a

SHA256
af52694ad82b4e6521b685045fa74a1cb6cbe5118fdcf876e040e268913ede1e

SHA512
a11d96ed67593adfbeecda34b1b17436cea13535a2a953862b184522ab11c92aa0f40fe94bc51653df6c08cc76ef35d5beef625774cd5cc9ffc780ecdef3302c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c5e84d0a4c026c2bcf86f01a359db358

SHA1
eae6fb04e9b8e22d720654b6687d334b08001f95

SHA256
1a8996a61c36fb88cef96fb3f882aea0f77de76dd4773e848d0d0398de50761a

SHA512
e6e7098d3b89cdb0638f4085a3336e377d765dbbb5304d7f39a1c98e22bf5dd844b54a000de185b9f6987bf9827ec3152c5e5d7de975cccce7c385f8ac65f05c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5349e255d81d7b5e5eb1ba1fcd71419b

SHA1
74bed999a1966e7046587a7dffb20c52d05690d8

SHA256
be8066c0fd8726220162d78c04b8474845962dfc52bee12c32e851464b42a4dd

SHA512
b0768ea8bec452b5c638cb619569d871a68bfac1d3005d6f3895fa7b2dbacd9ade73f43ad0bf46061f690188a66a5e8cb77ffbbb1989fef48101ab13b39e03ad

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ee38ba4196aafab41651a664960ebd6a

SHA1
a52446ab0fc92f11b9e2ad2ebb3ee44ee188578d

SHA256
0f296a0d8a7f4a465b8136a3cc0e0cc71e65a1e19c4755a4fb782857579841a6

SHA512
690d0acdcf7fee01fb5e62472a91fbfc147cd01e3f2ccdbddca6cfb66372650841e76cc20464136279802005b44f185fef7c138853aac23e504b7b4e1b46d4d9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
070cea1d77a19f80d9c56c2b76433748

SHA1
f99af644c0b83827ba393223090e6c3664c21472

SHA256
225259563bd7a1b2d439167c99fcddfeba33b7b46122d978d2a42927f9a1038d

SHA512
f5922d36ae18b8f0ddcd929e1c1907b9d4e92e82ffb8c54ee4a40a4b84a1e8bb1ad05a24715d4eeb4c6122e1225488a12d2c3ae3fdae3cb99b84d629a20220ad

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e77980e89b46d828f6ff808733ab277d

SHA1
833cbfcac89fdfcda8b1c32f6c97128b13d6fcd5

SHA256
bf77ee63d6734b65a12906faed2f28aedd3c1beaa2458a3394686195884c3c10

SHA512
2c6a0ec5b1e7fed8e961ec04c1b7bdc558816a7c12e355bb50d7f1591f656e299ae4bdb36f8673e62ddc4b1a5691311c41f75cbbe479cc8608679cb550824520

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2095d0a4e74992a5f483c2bfb977ee0f

SHA1
04b91e6bfc546c0b185cbee12caca75d92a1bb8c

SHA256
caf06c5c3fa02ce4ec721f473e58d07fed875eb8486e43b793259fd8cc3c4f42

SHA512
59525ae6e74c8776be29fac35b5062e6f4c0af5b9d621efbe5ba8213cd24f162943d0daf3d45dae9446335e688829432fc6b2ce68dfe063c4f3430d9bdaa6c6b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
abda658e5cc75a5671146fa35ac2d225

SHA1
422e65ee0e361cc051757fb07ed43e87138259ed

SHA256
d3b684c7019841678c499ee9c6c0b28a7ffef49f455fbad188c9092b742027a6

SHA512
49551883f19b97c801cff8333afb298ffb4df4032b62f0a76969f3b9eba8249a209b57f4453df20da97eada3fd3b9a152dffc98af30c017018b63ea0e440fa76

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit