evilquest | 39b85137ab92fb175515234f7e529fb0d38624c7501b9c08b67234d1ed7e97ef

Analysis

max time kernel
148s
max time network
140s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02d86b8a84136368b5e70231720716de_JaffaCakes118
Size

168KB
MD5

02d86b8a84136368b5e70231720716de
SHA1

7dcdedf19b4eb62cc10302237d2e6259c6fa8565
SHA256

39b85137ab92fb175515234f7e529fb0d38624c7501b9c08b67234d1ed7e97ef
SHA512

ec950bba18dc51dc784f063a23b0457eb628caf084c4d4cae7ed327f065d5f214de2c9084ec150e3d0ceaf5f4a8fc42d82a3863c22e7949de3d009f37f9a2ac9
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq92Y0:5SeOQdaZNxtk8cqhSxvHY92

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adfe-3.dat	family_evilquest
behavioral1/files/0x000000030008adfe-6.dat	family_evilquest
behavioral1/files/0x000000030008adfe-17.dat	family_evilquest
behavioral1/files/0x000000030008adfe-23.dat	family_evilquest
behavioral1/files/0x000000030008adfe-30.dat	family_evilquest
behavioral1/files/0x000000030008adfe-35.dat	family_evilquest
behavioral1/files/0x000000030008adfe-40.dat	family_evilquest
behavioral1/files/0x000000030008adfe-45.dat	family_evilquest
behavioral1/files/0x000000030008adfe-50.dat	family_evilquest
behavioral1/files/0x000000030008adfe-55.dat	family_evilquest
behavioral1/files/0x000000030008adfe-60.dat	family_evilquest
behavioral1/files/0x000000030008adfe-65.dat	family_evilquest
behavioral1/files/0x000000030008adfe-70.dat	family_evilquest
behavioral1/files/0x000000030008adfe-75.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118\""
1⤵
PID:561

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118\""
1⤵
PID:561

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118
1⤵
PID:561
- /bin/zsh
  /bin/zsh -c /Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118
  2⤵
  PID:563
- /Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118
  /Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:588

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:588

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:590

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:595

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:602

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:605

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:613

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:614

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:615

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:615

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:619

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:623

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:623

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:625

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:626

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:627

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:628

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:629

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:631

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:632

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:632

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:633

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:633

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:634

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:635

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:639

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:648

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:648

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:651

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:651

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:652

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:653

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:655

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:665

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:666

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:666

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:668

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:668

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:669

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
05f7b836bae0f05f5d7a9b231cef9c3b

SHA1
7268b42ad2b9aada2164f6a1fb430d97623a3fbf

SHA256
b37c50f53c7f910aa487fe34c9e129510a092e3c1f68b38abb9e9d54c554e350

SHA512
72c8f2050eefbb14382f162c311ca4d938283817a38b312d02dae9d8bcf83e449a752e446635eda18d370bdf93942e8622a5f53b589a337029630a9e2df6f1bd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b377362f6fe0d1f5f6c39739eb1625e5

SHA1
096d92391024bb52928fafd579f4d64c9356f2ed

SHA256
7a51617f2d44e22c0e73e5f4ff99ddb83cf085516d36eb58b0485101a2b05d01

SHA512
5de14b2bed70a7f9a906baa87588e2f654ee3370792caede1d40384f28611a44ddfc3ae3c5ba6bc5786606c079322b543e0a7655bf0a33367ba56cce466ac7ca

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4fbe824b987d3ee1aae1e2d59ad179b0

SHA1
96110ed8ca79dc22bc100939ba899bf40b99f1ba

SHA256
a1d21d403742b602642cfb9c5af97cb98c6db02862368f00a472404cd8d0dc8d

SHA512
4dd3a1bbc6e01e4d9fa40bab902b155568fd951253a2a6f587c690c728ac5c419b80353fbdf39b90219d3b4cddf45b40db644f08336fb3d31ed3fa495f3a6541

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
da3f9a53419a65332a69c34aefe44de1

SHA1
ea009a3d24f5c9267300725d2c52b2d576da0d6e

SHA256
82a50b00539dcfa8fa212d5be45670e2dbd3e14a45649e2c1582e8608df8c11f

SHA512
80c024551a01c091e6eb9fb8199fd3a57641e1c62d76992184ed1fb9d866bc52722c40c05b13c65672a218335b9e4080a8f2acf34083ba5db5ff6e0f81d1a3b8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cf3fe428ad7a7b35f0e8f0c3cc85f03b

SHA1
a29870fe218c377591b311af16b457088f8b8808

SHA256
4eb3f9721525751695d588597ce66f8e2cc88024b9a0c20119f0464181e711c7

SHA512
b1830d27fbb7472d306a905dbeabc8f13b4e49470713a4534062235f38c2f17fe5d60e4fc6aca0e1f62fbee907f3060fe4d535c510d9be3425ce2e96a42cae63

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5dd0e80e49788b07858efc5ff53e1ee8

SHA1
acb746e606d5f3a36309433d17390d71cc78bfb8

SHA256
4e1d7670287b5c064c614363889f2c99a2fd4890bea67099c7e520d899ad474e

SHA512
d616a855f486a13406725e79ab3cc845fcaf4751d4ca120fee41f6a5f5ba1a08fb81fbd321956915c1d9256ae7480c2056bd5e2596436d6e4d677cd149489e7f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
328583a04c8672a931f7eb2ed070e511

SHA1
5a19187908c6505e2ad3e52e79a46578e9729a99

SHA256
648c43bc771267f9eb9fc72ebf4393f90069025c58a823b29199e6ad15b5e24d

SHA512
684a6249a3d54e6966e45ad6f12a540b5f0928f60759c5720d71644d7a96c7a4c0d05b72f0c44f7ecb521d0c7e0f69b5a2a4a2b5da4ee7b25e32ef1c6b7afee1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e61e3cc8889fef7939d6ea9176e924cd

SHA1
4e89ea9aba687f146ae7bb988dcb8c47c4107581

SHA256
484246aeba36de37afce164e8ab9d24f6c682eff63972444abeede4256f06ad7

SHA512
e8a6bcbf6d53413a7e5c709b944fa09268f57cf0eeab09fe108e3c3352b6c0e5d9e43c01d252c5a90703c9826b58c385c566699480daa454cda39166d5392344

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5c3d43f1eb59dd58c33bdcf184108424

SHA1
87c050bad20618ba47c9a7292e8c9487d1ba1eb5

SHA256
563f03f9332b95beb0223ecadcd4753a5b0a5bdf7612d6b818ebfacba8b5b392

SHA512
b34a5632daa404df755f3724daab42ae394857e7e2e71e8ac52015664f9de6872a9f106534debde79b7e55dac94531eb715eb13babe04ca4884c2ab25f46ada1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b5b02e60d84fff52cbae18d6de7adce2

SHA1
f7f6d3dec7ea82d36a10ee65d341dc16392703a5

SHA256
22836506acc990a40e105cd681fa606691c3c78e013ccbe85db8df5c96eef015

SHA512
138e1280107bbb6551978e9d7874b2b885488821d024aa0f986a34764c9f2609672acbb574c5ccf8a61db0200af056973ba8d2d3b7725bbdf407cc68118a3259

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
83a2792f6c15dbd56a06b019016acc0f

SHA1
4593aa7913515ce4c422c6f10f516a36e13e3382

SHA256
0fde06bb89847b3f70a99402e9d93fafe7bbd7881b032a4e98edd3b35d6bc293

SHA512
baca287a38289573e38d4e950a7e0a116ca21dd941648df89e88660821fae44f0ca2bac1252116f97d660b2539384a614df0766a817effac7db3d88c54b0d563

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
19870b6b55c43bde095898bfad487c27

SHA1
be6238801d0ca1f355ace5a0125435493210eef0

SHA256
5c3149c06be5bbf9e244dff70e31b91fa410ace7b2d268ac2c7845c30152960b

SHA512
be24c6fdb167921d7c5317fe81cc8edd2cc6c1029f12789a24d72b6090aaabf6626cedf085c79a7cd09a62592aae2cf4878c3d73c92ff0e896a4083c3cd8c9d4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a7ee97bf0fa01a8e72943cbc375179a1

SHA1
ab48d2bb72c2affda1b38ba65fc3e9294c62ff2b

SHA256
8f77eaef5458a404051ac9a7d9582cca8a6a1de5c69be862346c4bbb9a06e75f

SHA512
3c95c623c6c81e043e510ad73c33b696e791b72b9d01dc7d3a03f64da650e643892af76ecc4434438a375a69414e7761825dab1dc76246c5e2d31211363b6eee

Download Submit
/Users/run/02d86b8a84136368b5e70231720716de_JaffaCakes118

Filesize
168KB

MD5
4543673d7736d2fc830af81c7d47bd78

SHA1
0f6e3435977bad798089ed27415e4d5c92685f27

SHA256
acaffce9be8887a6c1decbc265cc5cb2f8554741de75d3139add9d0222d98f7c

SHA512
567ba112a52c23999ce6bde10240558a22bc72e04749abe1ea50e748f5a8ad3902bc050422e3da4ca27ba022e5d4d319b63de09c32e31ce11f09a5d6d1f0013f

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
85b9c28007d4de240526d3de69e88ae4

SHA1
2cd818e34b9fcbddb22a4178f4d498345bcd9847

SHA256
411b773e45f448667df99c34fe9a70aef55358bcb72c8f051b5c1d291f9bd0ee

SHA512
6624308e8656870067d130d4270c8b9e923c18fef80f722457200ba09e33693a433e21b0360dc2781a4691961b54d0afa7d17a5b9b39fed752797de7b27cefa0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
420637ea23683bbc6fdd08bdf4fb7080

SHA1
cc475aa0e0353176b329158adf67954ee22aa635

SHA256
0be07f5ae4f091079f09a42aa96dab29d60c3ee5e1810abbddee192735244886

SHA512
8f16941d0b70addd6665a0c8b10eda1fe3f7ad5a820a6e915b87c03db8841d1978704552e516bab6e18b8c18d6251e07a76b591684e80aae6cf9947a1d077153

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
41dd11a6116f08aaa680afba2d44f3ea

SHA1
75abffd83741c6143806d6b33b2c3fe9d8ebb237

SHA256
3213bd7c830ba3edfd51b40632b4676603542209072a6fdfdfcb928224441ddc

SHA512
886844aa8026880a14135fe007caa0578e3aa70a3f67cf22987a085467bbd730634640cde6a20f6cdf578d5171e18ef4399ac972bbf598126734075e86a039dd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
01bfb5b33ebb9ac11a6c3f0131e959ed

SHA1
ccdc2c6662ed106bb3855ea39e2c144bbee6d239

SHA256
d1e97468ff6a5ff94fb1017bd34719432d5318adffeaf9e597cc0c7981d51ca0

SHA512
80bc11dac8446cd8134e2b92521dabd3c0cb96e18d64f846fbf824867ad5c591d54b0614b2e93a27784675295e35049b2cf69e27f9f42b89a3ecaed226c653e3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1a91e8a245927fd71803f24cd51c3a7c

SHA1
1b563984fe23dd1c2ffa74caeb7d1912d7d187f9

SHA256
de7f93b2f7343ac91bd7e862925f2ef1acd38d819b1ba582561d4103af6afc31

SHA512
e5dbf84391a3902d02c0d9c8c79d19df87c3934c51ed2dda756c1dc97068d1ce85c354af4a698be3384a671e769db11d5b4e63aae1f02cec4879a133cd7c1470

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fa92a66812b87f57bfcad9275fdcc2ff

SHA1
57a2b6f2bd0fe3e08317dd9e69229019939eb205

SHA256
626c20a62ac1fb2cbe4d40fb1814b32511c040c6cde648c58ae41c7d3cd03c32

SHA512
dd432553c8025d459dc9fd70f43e78b5ae478f028b8b9716273cad8ea4c1498fe20bbc5ca978d2e21f3b471f9ae5eef6b9a1c930c0a8ed5cdbf7da38bb3847de

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a770e34f9a72908c9a69bf10b9336e0e

SHA1
90a527504420edd840e8fcce0b58e8f70b09f7be

SHA256
007f1e266d29b88d8f99bc6ad0007259430463c0d067b304e6d4545c8ebac69e

SHA512
912ea70e54462919bcb3c55a3679e618421f57a291fc4b906b9af6b22cd00ccb63b763f5b9cc2a3b0d2d8e5475a9fb8587512ff9858cb9f9a0e02ff613b3b48d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
31ead4616d53611ac1e3f0fc0e6d17c3

SHA1
a61c505e86a81599118b20b07986d345473af88e

SHA256
e5c5829b3d6b8cadb8173ad373277532480a55c5069d8d0a7b32d376822ab124

SHA512
5d550a1ae8c9bdb3c7f9d2e747250dec200acb00c16c54ffb91b264d0258329155fa877f80b4b6c82197f4183540d6c358311971305afaf4f411ebc7de97ba80

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3b3cff99b1b24c9e8365641580d228bc

SHA1
27b051bd6c7c001cc4860c31ae924f04f854c5a5

SHA256
dca2c2bebffc85ee28539469b4b484e05e8183fed47056588fcc434b07c18ce3

SHA512
f411ba57f593079c480e9bea6ebc90d48f6a87836979ccd51b790dcbbbf62ac3d09846e8fb54fdc4bd1cb725c4485297cf19eb5e839b55e5c1fcc7b18af879a3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3167920d0234cb9bac645f9821ba4c7a

SHA1
6f23dc3f7349d1b6699ae29f8c60fc03bb7dc455

SHA256
8d65f43d037bb5306627e6fcf18c6599ab5c8da7224d41a9fca3c55d7a137299

SHA512
9ae61e4e1b2a014daad764082ffd3ebe0e98da9618b6d858ff8c05474e2ded58b2d3ea32a01875a0257b6a3fe59b4711bb7885a6368713017cf3b7ba600f9e2a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ed73971cdaeea4967e0f88b9ddf7da1e

SHA1
dcf2292f4d2efc2d89262501d21bb8b84ee91660

SHA256
0b63f0a78662691b898a3b61b28a6d0d492cf9fdcae755815943e589efcf53e9

SHA512
e0cffc5f0a31013a578350cb719829fe3a5986605e49bd0da09f769abc3021dd397598393950e1946e44866cba9278173a682201d980e2c43fed9738a2a90874

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
32188157de861da15e68dadf161b3242

SHA1
f42ec6b8aa48604b5bc76ab2e1ab76d77efc12e8

SHA256
db2c3e7e92faddb64ddfd259c4887372851c3fbd5e022fd169faf229907f5928

SHA512
97fd945c556c627de28ae1f9f4d4061195c7f593eb3d09398ed03351b988a30cdb6c72018e0b68bfaefed6e12149a620da04209cc721e2b63572af1adff556ec

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f222a1731d34489cd96cc373ecf0336d

SHA1
63e63aac18b78702f65c157fc3947768bdb4f4ee

SHA256
aa0f379eb951d87ceeb3b4a99a62341946b471c0b7240f05533fe7d49e24f64c

SHA512
7c8a5c0f0a2622629e425cb872f090fda80e000da2b79939c0d3728fe909c4b47312fdd863676ced3970678db437435638c831d4837a66e7703669be698a8c7c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
09bc2b059d903c76e6e7438644f4ed04

SHA1
06b122d57b49bcf9208289b5402ce7f1daa44422

SHA256
3294cb36ef637f861ee5248f4b382d4822a333f70acd7aa682b7d0dc7567bfe5

SHA512
e30a875ebc280346837baa806cb636c82f30c0db38bdb3ecf37640056be9ce099216d567de23e9e6b8e6fafcd1c3b75201eaffa9aee14db4af308476b9082901

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ec21c45e025995e90bd4bc21728f8655

SHA1
f6bfba2689027c7375435a3c24f96802a3ff6c18

SHA256
b5f5db0375005db480cb3c527661ff493944e171979d9be8bd6928cf98767778

SHA512
fd34369dc967d388f4508ff2cd6de7bb77486916223b324daa1e18ea8e461813608d30d7511bc71de74d7b5400720c3cac60516f941c817a21f4addce8485f46

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit