evilquest | 0c3acb4842905c92d03bb169db53cc9a2e8022eae4ae918d04f006dd9bc80d14

Analysis

max time kernel
148s
max time network
150s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b19345e7658857a755861547b40123_JaffaCakes118
Size

168KB
MD5

02b19345e7658857a755861547b40123
SHA1

c73331670d3e957a8cb0afc876668d74c5677e11
SHA256

0c3acb4842905c92d03bb169db53cc9a2e8022eae4ae918d04f006dd9bc80d14
SHA512

68827e195a53b47a71650f15cebcd5a6ec053a0d1601211e67b2bffde55f7fa52fc19cee3f212f06a158a0f117c1977182cbd48f53c526c0ccca9a96885ecfcb
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9O0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008ae00-3.dat	family_evilquest
behavioral1/files/0x000000030008ae00-6.dat	family_evilquest
behavioral1/files/0x000000030008ae00-17.dat	family_evilquest
behavioral1/files/0x000000030008ae00-23.dat	family_evilquest
behavioral1/files/0x000000030008ae00-28.dat	family_evilquest
behavioral1/files/0x000000030008ae00-35.dat	family_evilquest
behavioral1/files/0x000000030008ae00-40.dat	family_evilquest
behavioral1/files/0x000000030008ae00-45.dat	family_evilquest
behavioral1/files/0x000000030008ae00-50.dat	family_evilquest
behavioral1/files/0x000000030008ae00-55.dat	family_evilquest
behavioral1/files/0x000000030008ae00-60.dat	family_evilquest
behavioral1/files/0x000000030008ae00-66.dat	family_evilquest
behavioral1/files/0x000000030008ae00-70.dat	family_evilquest
behavioral1/files/0x000000030008ae00-75.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/02b19345e7658857a755861547b40123_JaffaCakes118\""
1⤵
PID:575

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/02b19345e7658857a755861547b40123_JaffaCakes118\""
1⤵
PID:575

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/02b19345e7658857a755861547b40123_JaffaCakes118
1⤵
PID:575
- /bin/zsh
  /bin/zsh -c /Users/run/02b19345e7658857a755861547b40123_JaffaCakes118
  2⤵
  PID:576
- /Users/run/02b19345e7658857a755861547b40123_JaffaCakes118
  /Users/run/02b19345e7658857a755861547b40123_JaffaCakes118
  2⤵
  PID:576

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:591

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:592

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:592

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:594

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:594

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:597

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:599

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:599

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:605

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:606

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:611

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:616

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:619

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:620

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:623

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:624

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:625

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:628

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:629

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:634

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:635

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:636

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:648

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:648

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:649

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:650

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:656

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:675

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
22f5ea4123b9011f7c72b42032af9800

SHA1
738411b986696e6f6cd46ae3dd643a350989d9de

SHA256
82119f62326871d0daac1e0227766a5ae49f09a2323ccea4eb664cd8d6712cb1

SHA512
7f4ba2f22f69498b162f3718dee496b3e26d4d8bbf848d5932e6920a921b0d772b1200e00cee9dd35d9842acf6758c42543b455689025aa7837fbd681c2c1aa4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8c3902e1b2dde8bebb211345e8861dd8

SHA1
f246ffa04452281785ed12214ad5d4d4ce7f69df

SHA256
358dc8a38096e9570960d8095552f2e368c187ea005695e7dc8201ccb05ece1c

SHA512
1721a5d0eb21d1631f9f7415fd8e7ddfff507491bd95a303dee2237804d13d1fd231e2b73f03e772f01e3271364780df42f5b0fa46fec7af8bdf61bccd54144b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5f4a8be2815189fdaa9c4b04272726e5

SHA1
ebee3f82e0cd31b73cbec4c6da887c07af8f71de

SHA256
766c0e110c31a4e18b1d1767e7317fcf930d8d88432db48e977be15a3b843fe1

SHA512
4b6deb06769d11aa8b111648926edc89a3fa4ca324fdc8afec45f9c195f68e05ad8a8fe0328d8b072d5c0376072b49032470b9e4391e72be7596785fbdb52b4d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
16314e5cf23917622c43e4da42229803

SHA1
8b0922318eef136d1635dd31dc2b7346cedbf78a

SHA256
1c7b156517d109cf5cd527a82ed9645d054b90e283386c0b513f8a969c9058df

SHA512
fbc8f8a1021b242985dec36831a61270eec9f02a9bf4ea14ed822c0043bc86466bcd8cb158da4f9c25cff1925ef430337bf9a639a22500ab87ae7761f003982b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c193ea16b65d9f0ed00057395ccd385f

SHA1
86d0527bbd0f5cd738371289bd62bb2748926f59

SHA256
ab4ed51c9be67117d7d7d269f8ad919b82d80a4f0146006e71d599211daa6c49

SHA512
2db6635c79a2d17efaa1082a7e346eb153e45555181e759b9a66c69fa044cdb763045646f6d4db0813bd50510f55eb87c60a5b0352c74464a11da2e9e971f925

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e21823b5296e4d34ba813c3a1ca78876

SHA1
051ad48bee34cabfdfd3ce7fc1b511555c98fd03

SHA256
741264d1b04896861c5ba3dd175ed5a0a7f0612ec3f3944ba30305d881eb9d43

SHA512
d3ab98eed5774f70bea282d66932405ded44611bc8da898f8b66ab126d2c9b77686a1d4a69db52102a3cccc074ff2cf2d2a6980e6457ef1009f1d7b4b9337070

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
dcd2772c923d9ff4876bb7df95bc91bb

SHA1
ff698da70621c74ad0b046ac6beb4f11e4bd9e5f

SHA256
0ad6e47139c575dbe5841fa5e22e79eea05e7c66e678c4dac2cd3176a730980f

SHA512
53488355b0af9b15fadd2dc605159943077e9937ad482d1b872a5ee3fa17b71888871af86b08f2b3040e50b3ae47b29b41860b23c65cef2f5aca8a0875380e2b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7e9428a285326b94ca54d2b954535c9f

SHA1
fa0197b1643143f6daa7da604c48c49fdb03ac7d

SHA256
e94c89d5147593c188cfda53c07b092a61b55b3a7ecd09c4b144e2523ffa5cd0

SHA512
302c4379e67de99df0aba6bd70129566b38505f26a68e3dd70b1553d4c905575db5b565ed5743a18f976c68bc1f7d1131483829bfd58f13a04380b39c4ec310f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
afd94439cb55ba9cc56764cf7cb8b8df

SHA1
76992463919cc5eb66e12e1b0f77acb6fb59792c

SHA256
2b8e5f8c26f26f8dc210d028ef3ae66af3df283877a8fb25551217191fa30317

SHA512
16cae3bb176bac945f7679f4467168ce1b6cc0e2c19116af14d1a7202fe98294b1be19164606014b76f2bef21044a2cb4383583c547aafc89dcfeafb66ec2991

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4eeae5b195b71f4ac2ef39e95bd21456

SHA1
f7e924121feecbe16a4d1985919d4b0a05ea0f67

SHA256
fdf9559f3b9de2d8fb359c3bf2a3261fc9a3f0c463e1a8d674fe5a04f8c84db1

SHA512
46d995a1756e6c5397f28e81ee8eac0917aa33136ec79eebe395705aeeba16652bf7660104719bd0d38c4ebca349bfdad59bd2b7fc4b1f340ccee35d93a46e7e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
81b62ed480a28b0a604f5988203efaf4

SHA1
62342517a8a073fd9be33f2a570dfef1d0319911

SHA256
23e28e2bb285820608ab4a3ad132fd01cd0833da3e772b37861d3fa5221adbc3

SHA512
5fd766c6c154c323e8e8cfc610e60ee97d920d0f6e9b4f32921778becd8b67e40a31010e1b4bc0ef7251566176b51d32bcaefed7d291dd780bbe5dd3a33cde0c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
935b4dca69b2274b8d5a8b0ad2cf21ea

SHA1
908d17aa57d673a8c248aaa2250bad6b4b5a21b5

SHA256
42720987193e529c55f0daed65044c8f51c0e35b6ae91fc923bd92ba44987747

SHA512
b6d21e1286889a317d200e307a8439c2890b0681e84471c9ad3a18dc8a73b87835d97bb35d534fb5c7bad937bebd2768e44709635faea3e4ca5096b33d55a6ae

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9dcbaaa2e85cfc726674361cda477734

SHA1
972bab491d4d9febcb51c4654b9ad4cb7e1d1174

SHA256
69508431a794f080a26064b5320f7271c9b1273676da6fddb9ef1d739d69c3ff

SHA512
306e606d18154ec0917fe77ae6ecfbf2bf75d89c49738f28981f9581c89689813e7ac31f97cf54413828f7f928ecabb401d089e4a11eb6860154ef9ea821dc60

Download Submit
/Users/run/02b19345e7658857a755861547b40123_JaffaCakes118

Filesize
168KB

MD5
8304e24c1d21fa5a3e2ee42fb5452f1a

SHA1
e87fa3ff669527ac2fb0d6671e605b8bf4afacd9

SHA256
6ea27534136b14b939a5265a244eac22378f5ec84d1a7b318dbb31e87eb5e05f

SHA512
abd6b506a6b9b303fd8798021f3d4fa2eb9c358e8626ab0afa7ee499a071c16fabd9a82bb2d9e0824f25aaf128aece134174208e195f21c39973d06f6e8a3cf8

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
d9628c1ed1c749a0308804cdcaa594c2

SHA1
92be0b82b113dd70e560fe67555d1edab5752e5f

SHA256
e0b2edb3d29c8958e46e5d4f16e0665317fcc8196e01ca95e6ed13aee5ed7b56

SHA512
88c4ec4d2835a9eaad73adbc2452af9011c97f78983be8b0a8eef7b23fa8832e6498979c59adb85fabde1f6c88a3dab0150ea467d3d4d34dad319014320f3ce5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ffcbb5693630704508157dfbcc963b32

SHA1
71a67879e763a648d025dbf22ad65e535d4c1fa1

SHA256
0e3364fc472d2de5ee362e9969fd2beab1381dd358fb9c7676e22493250cfdc0

SHA512
65e14abcd204ce765859926d702e10810d6647efcfffe9dc16e3f8b57ad4efcb926d25a7a1c0283362f7afe7399d600afbab9963078a6ad5972a87ef906637e8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ae957b47957b673cd4c936cd1b932b62

SHA1
3ea763d2a8e529f989a15cb75b1a768452a3a3ac

SHA256
079c9f07bccc85ecb92f4a9083badbcfc52eb5cf8403f9a393a653b21adf8b4d

SHA512
3cb48c4ee0825a152998e4e9b11fe5ab5c107210035a23ab07ec22857e69e18a2e650c1423ddd561dbc257214e163f019babbf8fdd3ce1def53d593a4c550317

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
476d97991382eb029fa85fdb2828aa53

SHA1
f2eef8c5c2c0ff69d702a953a8150c06f3f13df0

SHA256
a52daf1e053b202410826fd1d3541fbcf25c3e91c205a96bad224fcf21fecc11

SHA512
d94ba26bb76b24c7c0da0890f8c1bae21df47bedec5ec6d9f7a183d01c485598a3324245a76436a3afbbe7f698fa9c63abfc1a8bfe4a97f4e358e43fd123a00a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9548afa76a7d09ca0cd4a616f6e8281a

SHA1
0eee53b55a397d825ce7662b7ecbecb364cf4a7b

SHA256
67607d5b4c5f4575f9699ff82f945f89474dacf2d6fa57b65ed4b9d961534aa7

SHA512
f28947020f397d36d5d695692b7bf261d543cbc414d6611e6dcc1f35657ae78cec72dee85bef05606b4c6e85ced90744af4ec47606138aebb285baae10830646

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
938eec716f55ecf963d3e013d13bbb5b

SHA1
a3c2429636ad15175a6e50c87ba98f149f5f80c8

SHA256
1d7962073d2792e6bd1530ff3425868e5eb78318c2d3e6f3bfa3cce70bf2023f

SHA512
71abc61c7264df0cffc559da5e9017f6167c5e9972a5b0a7d20619ad194eb42476926ad30e6ab7c501d0550c3b2b68ab751fc1c09a4b9d7e787c1fcc48ea14a0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0403c67b109f6121b308e4cfca70dffc

SHA1
7f25e6297015b96ea41ff4cbc93b58444fa0a73f

SHA256
6b142d747a311ea53fe92bc4c82b2b31625f8eba3a0f08b2f58c14f8a0faed13

SHA512
c62e4bddead62bfaa60a49811c5e394e342001d91d39843f7558e62cd5936873c5bef59050a726aeb92259e9794f90f4d587bc5460972f43dd97c6820533dc86

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
114bb5c3f66b6fec51107b6c6c89ea3c

SHA1
acc7ed59be25c1e9c2bde78e0834f5c16e29d854

SHA256
72146873211f00f9b52fc262c989f2be54f6038069b7e75aca42091e1a13b9ba

SHA512
5c65402fd6c4fa7a1d606093d4d013fe005b823fb32f3a1ba820415c2f42ea9e8abc61a5d87bd16ce560d41595416256c4a57bcdc3ea8a30890b48c35336ecae

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e27ae301edc819873c2006c38d7b805d

SHA1
04a8fb3c51cafc3592ef5f17427e401a8ca7b6c8

SHA256
bcc958babf781c9d9db57f057a3ddd4816bf2e3ed4f24b0d2539971321559c97

SHA512
1f3fe6356ede70230fc4fd53bf22bcacf0642514991ad446f6148dee10669ddb82e1250d922b3dafcda7e64d1482f23bda1f95421a88d88e277939f9d416fe94

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b37f372e8d4c9dd392f4c5601fbdeb4a

SHA1
19ef9c839f952071f47e0fb9f27784033b79ac31

SHA256
2172e79f99e9986589499f2782c158d44a47361bb41ec644e47b0d7fd46bb836

SHA512
260a64955f0a91fbaf4bd4f669685d2df60d9f3b08b58a379f947392de0fe9326624ad15bae4f3709b10ca1347a060d9b35f0ec84008b10420ccc2e7346f53db

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6a9676878e708989b8a32323b2773298

SHA1
9c0de895e654adda18f2ac64c42a26851a1e1bbe

SHA256
5ce54fa8aa6626dd5594daf90e2acdcae0fe31c40ea91a058226da40243e97cb

SHA512
09d17cac124614ceb54a626ae551361f6ce21ef8bceb3a85f032335767a3eea1e51678a70c6bfe90733f8a8d223a055e761e20b22138032996183ccb933de0eb

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a8ec6958bcd78aa4c4a2d335b45266d9

SHA1
09b99bc3715da5df264ea89e77b4526006ceeb5e

SHA256
4b0cf7fcd44898be8ff6ebfc950de4a4a9fba5cc3ddca4ef87451a5bbbb932b7

SHA512
9e9abd83a87c0a0fd3570e0a09356c52a29d7e1e9ea5550ed74310f089208abd5f32ba014d90ee1c6f0844fd5232e9baf841cbcc1d09f0432547a34b70350025

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
37771345be415bbc1f0fb81f123337b5

SHA1
0952a064048728e17e3481756302cd2886a38693

SHA256
fedab24eaaef0109fd43f057c63b0a7f85577d9a834bbe287782d7f53a5a178a

SHA512
5f06d5cf5dc28ab505607b293808f4e2f38efcd19a2dfb95b4752102717717b33bdbc2d14dd59f63429d54492ae5529252b1983316e3e30fb6986366a2be78d3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
626017a7e27f8be4e4822f545d109d3d

SHA1
77a8b3fe0bceaba021988d7099f6d8c2dda184fa

SHA256
32331e2894948ae9991d722708764b0c171e6982f28eed40fb355bff6bca05a8

SHA512
4a9d9652abc329c99a5966190e235d750d40e715985641472b7f05d1d2a729185f11e93f368271d57f33f9b457bdd59fa5f94f0441e06e8e611890337f4d033e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
efa5ae651cbe592ff88263fbac6a9054

SHA1
7c8dfc5aaea8da25252c3e2316cf62fed6b19273

SHA256
eb7aee064090d25a5690b4fbf270e363ce135c1bfbd91a395856036f51199703

SHA512
b7edf6977f7c4a0d6617191c1f3541d36880bdaac896e44d19d181f9b6728ce3288d62cdd946ed4495aadaebac96f9df9953b698f3e91f91491bab2fd04569de

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit