evilquest | 308ec0bc1572507283b53c2233ecb2aa27a23eeae857f90c7ebac274fb54ff8d

Analysis

max time kernel
150s
max time network
149s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27-04-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118
Size

168KB
MD5

03a67d80fa5fa77f1c6449cfa18a7557
SHA1

af176a7acea73091dad836dc40ca2aba813e3403
SHA256

308ec0bc1572507283b53c2233ecb2aa27a23eeae857f90c7ebac274fb54ff8d
SHA512

35aae29a451742ff3a3fd84722e26151318398919184d503af4a6f1e03757605ebca6f12f9ff3d180c3ea5f47885ddd71b521813859e449bb1fee11ae85f2fa1
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9BO0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adfe-3.dat	family_evilquest
behavioral1/files/0x000000030008adfe-6.dat	family_evilquest
behavioral1/files/0x000000030008adfe-17.dat	family_evilquest
behavioral1/files/0x000000030008adfe-23.dat	family_evilquest
behavioral1/files/0x000000030008adfe-27.dat	family_evilquest
behavioral1/files/0x000000030008adfe-35.dat	family_evilquest
behavioral1/files/0x000000030008adfe-40.dat	family_evilquest
behavioral1/files/0x000000030008adfe-45.dat	family_evilquest
behavioral1/files/0x000000030008adfe-50.dat	family_evilquest
behavioral1/files/0x000000030008adfe-55.dat	family_evilquest
behavioral1/files/0x000000030008adfe-60.dat	family_evilquest
behavioral1/files/0x000000030008adfe-65.dat	family_evilquest
behavioral1/files/0x000000030008adfe-70.dat	family_evilquest
behavioral1/files/0x000000030008adfe-75.dat	family_evilquest
behavioral1/files/0x000000030008adfe-80.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118\""
1⤵
PID:563

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118\""
1⤵
PID:563

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118
1⤵
PID:563
- /bin/zsh
  /bin/zsh -c /Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118
  2⤵
  PID:566
- /Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118
  /Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118
  2⤵
  PID:566

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:591

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:596

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:596

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:601

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:607

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:611

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:617

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:618

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:618

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:619

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:619

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:620

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:621

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:624

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:625

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:626

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:628

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:630

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:630

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:635

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:636

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:637

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:639

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:648

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:648

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:649

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:650

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:667

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:667

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:669

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:670

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:670

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:676

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:676

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:677

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1747be17b9fe9ba3fba954aae73cff11

SHA1
abe186e5aa1358ffea3c9b6a16adb6b4bf97740d

SHA256
8dfcc61a06bb9afa2a88ed395301c6e76ad1c173197a0bfb001f64f0bbcf2b09

SHA512
9df279edbc3cf84667fa49911f568ecaa56b6dcc52bfe7592ef742c2d9e43ee95600edb0adc9ebb8425eb13b26dc10d161d324dcd9ef09ea16187f1e8bcdbf93

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
bf29c94a16cb080df43230ca324dc3ae

SHA1
9f21633c050f5f747dfecc66f4e39b907c0049f8

SHA256
3c03643d33b4ee1335a4dbd734ee5aa773851988aec4351c73e804cddfd5f190

SHA512
3fc8b4d11b929a9b4b6066dfdb96fbc441568e38b60f07e233ec41873512d0a85bddebb0140210eb317779605483115d4ef8d6943d1d16389f7608a81d7681b8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
63a99e5a79c08a5727ce5f257fbfd4f5

SHA1
00d4a55f195ed75477cbd2fde6f08913a47aff14

SHA256
d567c77e7341d6ba3794e16c67540d3ca4496a8f8bcf8a1389452a45b6588783

SHA512
2fa1839b9a9adc8964717cbec80a88083df6fe6f6eb58ce776ad40fca49c4357511457e5c4ac98ad310cacd652855ffbb35edddb770120e3cb913ff008d97256

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
84c597ee66758826fbfea0d749a7d64f

SHA1
c37e1adce0d05cec3ffe1c28010ddb7706057df4

SHA256
a2d2a75f8696de40bd2d279344ca5613e73b5a13646b3654dcc7aea574c83fc7

SHA512
8987081acffb219efb851ea47883d69af354819ff0d89f77e83d3052a16d9111f31cc1f527d24a124478d57fdede0967676051472fe2bc1c08ceaf9789591a07

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6761831e1c55caebf4694fcd153b4780

SHA1
2c48306bfe9fd1d5fff3e9ac9d92542223149c13

SHA256
13e876ab90d1605b8a3a1b58550e6089302c6c055f3ea1d6304f1d42baabbcac

SHA512
ec6c5f8c78db684b5defde54975e781ed5606b34a31685b0188ac8cf90b6d64857d5e0eb0670a2187a300e452bac3711aa6fbffb347a07157e5f129be2610a98

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
da6a787d505b8c43efd102a822843148

SHA1
52ac873881143b18b12fc6aa4270bf544b63a143

SHA256
2c5efd0c3b96eb69ba1cf048914fead36d75099ee23c9666cb1c391ae02202b4

SHA512
d09abc5ee0adeca1973f3f3b9dd06dc922c10f2f2591fbda260583b667e410dc375eebe9aeadaef65c8324646008abf3e2b6c514baf8e9d22b9334da4890f76f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7602bf5e397b4d2e0c6de4e5aa4c4f7d

SHA1
0f7ddd3d8f077e5201925c9e9ca0e4dfc19c2623

SHA256
de9647d1186343f2abf92fca39047345b9e05060b7501a6b1aa85e583e790216

SHA512
58d175e05879c599a5c449fe852aecf477a4eb0576eaa076811cdc48c7c9de176b9ba85420b64779b35ab240abc94da61a8ce99de407fad08ece2338635b3238

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4e3e4df915356e2ec9ebf9d731e2e5e0

SHA1
16ee0bd89b2fd3624a01adfdef1051e26415a671

SHA256
c091a99afa1859051df88c6b2341ec892678543b69853ac509b399cc15519019

SHA512
4f28ddcca33987f2a2dbfdb1812943110386116a1f142894a1bc712bac7a71933d96b0f9f75dc50e312aa038bb524f0b21c6a69a5b1d2eb463e4fe413cfbd11c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f1065d177ffbab55b8580640a90b64f1

SHA1
ee00afe432f075d6a1672b024e22dd8a4aaa72cc

SHA256
b1bf13cbcd55d944171496d875f74028fcae081edbcbcca0682de258097d0091

SHA512
4e1ded5774b6850fdb2803d67a41587459b41d50c90265f74d7a7b3765367d5b24fc6c3d8e87d88946fd3d6584bdf144284094150923baea93d2299167e3d4ec

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
30b9192ce08f4cb650a862e5fcb2f8ab

SHA1
db50028c5be95326740fdcbb94d3c8a0d508b426

SHA256
8eff0d6e6317c206d999cbe67b5bee62aa674095b6d0366460e6844d9abb6f00

SHA512
9259e386165cb25026a7b3a7b4fa1d469847e75174d67481ff49a0adb7abcabd711f451417e43ef6d858123a88d1cd443e53c17419c050334f582ea1f0dcaf83

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c1ff2b8783ed28f925321c7748b2f054

SHA1
422dc77486e16f9d52ea4aed06f99673caa74c32

SHA256
01464a3eb7ca91661e13d3a5209cbc8623e83240cb867da0c27c6f80356d393c

SHA512
3d87678d630883c2bcd60d2797daa3b49a2e2a0f88e9e3b4b807936fda86a7658d436276d173f36bceffe6b0fde8ec04dbfeffe053341707fbef9f4132e62567

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
298ad33fab557f83cfef525535e0b603

SHA1
0ddd9c266b1679b0ee04f672098ae549c990bffd

SHA256
c8979cd62bc2bfa872edeb583448f78b3d2d227ad41dbed442e6d44c05b05edb

SHA512
38dc5252ed965c244a29966f9288d9853f3edf7f5e1d50ed1fcb18ed9df6ac8a5246a93d62a0999c4af524bb63ae6069dc3522f555040f3a5fb1759ba1b9fa6f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c42034f4073dd2cd47a680616715020a

SHA1
cf314e32a1f71b9c74a6fa6b84814913830a55ef

SHA256
522b7f59da98384aa36034f1bf22cdcde9d48779af992feda8d732efbc7c056d

SHA512
baa80da488f37e8a7d134223717a72556f1d259ad8fa65ee855694396688f458d476ca8f768f22e0fa7ba70c11f77ed9012f58d56fa0207e69ec16596ea09c18

Download Submit
/Users/run/03a67d80fa5fa77f1c6449cfa18a7557_JaffaCakes118

Filesize
168KB

MD5
cdc728626d7aa64837bcae4f5363462d

SHA1
a9132b1d48b86c30200635236975f1034627c236

SHA256
44139d3695248a93cdad61e6bcd9e85e707c778448097a53fa9445b6a09da0ad

SHA512
3a6d200f53849920ba8c8e2b0cb077195e7195e5b4421373f2a9ace6cdb63ecfdcad7e9020eee902d595a94d9830e696267d5318998a7d4d621299d5efc2becf

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
17ba4dbb1fcb03778f3c750eada85f21

SHA1
ff3ac2236ac346d288476a2630e8515191777aa8

SHA256
423ae9ba0b5f3ebe359162c39baebdb2dba0dc51e340470ab230d58b9a0f079d

SHA512
0405a6c53113fc84e0fcefd5ebcc0562cb1414473ffd78773771bf8ebb4efe5b853b0cfd035ce23e8a7e16915d9e0de4a4d72f3e3318537959b6d1456bbdaf79

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d00297673aeb7afb91afd59b13a9b05a

SHA1
d6d0e80ed8f206c05078b22b2ad6ef620e140506

SHA256
40e54bd68f96d1f0d131d2d5049cd539a95cd396eac58c8a1ac44f26d59af882

SHA512
02dfb5dbbd7d850350d47d3c26439ebd17ca26d9fc9b74e0c5b405cf3589248875e5320bdac2b1737ec956b55c9254269da945b154a6771d99c73b7c1c360128

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
789e9560c8fb09f1ddf7a50dfb0fcf6d

SHA1
b10aa2555ea20d0d695f26a990c01ec615a39383

SHA256
884d8f4c655d3a33596bfcba439a348e4034270d51476d2da7d2d139dca5f264

SHA512
af200f29687850f1366b3716d6fea298c6baf517ee2ae9b07a8009737601981e87f2b127d9fa4c51ac7f981349a55c43bbc726fa213b0bf871203c82c0c26110

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2e5b6a8a7e651510839105925fb57acd

SHA1
4e68cfd786a3312840b599460a98d175473c91bd

SHA256
986bd7271304aefad3b69196e8bb207bc53fa76e83e5861e56e10ae9973343f9

SHA512
06fa797f373a91a2736fd116ff40621b8d74bf4421aed56681edf0a3e9e9d76bd3b7b9b014fdc5538e2c9c06f6d78ebe5ebcc62e93d3a33b9cb8f0756bcf61d1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
add7c5e33e9ac22e664d37b28a5478b0

SHA1
3a1a805fb0d4cc75dea746d29acaee901a8614cf

SHA256
9a4a642e276ac14beb05d7a34c82e67bf1bc57971aa8c4f145fae591c9725dc2

SHA512
1af742b2381b3f929f461d71263fb747db37f060fb1773b389221aba98ca03c080ab325e73c68eaf36432061137e0f909b7bf748cc0eb7e3c2441028defb7584

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
70b852201d7566040cfe27d4e5a5a0a8

SHA1
b5876ac6f662c6c673d52e54d2dcaf220134e24b

SHA256
e37c899f6e0fc6c002510baf1d7580fdad4f1cb94052674e4a46c9956b7d0fc6

SHA512
62beced0c8d3134122bd1e77d5db05ea9b7d5184dc8359f5991faa3bfd023e091891258603a43b29bd491807dd9d85ff44e84ba961d8ee12241432d88b247b65

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c196d85e661e6ac28a54f530a7f2e5ae

SHA1
0ae4b42b10f72603e2dc1d10aaa781ea09b885c3

SHA256
d50e796848dd3e1456d0e7c5029b8104f721c89484566a55521f591d6836e631

SHA512
cbe57a30e93f7ab9bdc311473198750a2849eb58e186b303cc7ef17079cf6bbbee98e92392d7ff34d420543f654cf1ec8dfbe0144d5ca7e943a94143c419af87

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ff7c82a345dc4b6de112b54ba20a036a

SHA1
503e8cc83557f9903298d05ac3a8bd6b878ac5fa

SHA256
e27b7f50764509438f06eaa6d31602b28f1dc97445fa423a16ba296cb1770820

SHA512
b37369fd2b5f112444205174637942b66b317e636a0c74c5dd0fbb2569e501f2d581799057ba0da872a591c2662b31128ab3e08d784105905380a5264e647d99

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f20e347cffef15b71a276f4c55133aac

SHA1
2014d0549f693b5c350f0589553c87a9bb47f4fa

SHA256
18c9248e630b3e05a39d8c772e339712a3b062b232a75cfe85bd123adf1b6956

SHA512
46832eb1cdb9020ef0ab8e4009fdf39229107ebded85231e6f1b57da2777e4cf28fbfa417eb614913db57fe5fb970399e63b4f14fc4b0cd7b759619070cee64d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2cfc08d2c9b39f155a79b0980b0079e6

SHA1
860ac94de4813be8f3ffc8b6746e83f4d69994fc

SHA256
6a30c048d3dd3296d3bb288444110f45c193ad16bc6cb133b6751ed32b7f86c7

SHA512
f6e08bd5b6bf6faaf20884a9a2bcf1d798f041264b1362bedd8ce7eb24f909582f33a0d097b42681652e8caeed02a65af7e6aac00ba8749fcdb2cfa7ff253b98

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5cc9278b35f94ef9c3c34aaea45c499f

SHA1
e0bcb99b4c1e90509e9991c8656c4e89256a25e6

SHA256
8a479e5b4e2c53c637ef6a2a6db063797b246246fa87a7d2f40a943227dbae0a

SHA512
f35094cab6b5f0ff32a5c84f6f55d3bfc3fd95639fd77eab0f6bdfa3d0bd4bcb82f119e226a686211855bd7a78980e8dafdeeb668e3dc3c5428cde7ab917c13e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
720400f7790e1dcacde465f27699fae4

SHA1
5eb52fb653b58e3bb11544c52740016f0ef35d2b

SHA256
f61a7ee82ecc3d48c1746435a7276555587a9abec76cb05d4a5b63fed4d28bc0

SHA512
6432ebaefc9df9b31488f6263818eda4c5d1c216bcf7094cdcf91c99cd71c43048413e555f84a54f3d108e303927a88e49399cc0c8da39178ef7a2a734bdee8d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d340bbcd3a128c2a020f26390eac1f0f

SHA1
45ea563018d303e036f467c6e083e4ddeed3936c

SHA256
0e213f7b1c1731200b7a2edcda70fc29fb302117838eea6e9097317b4b58e87e

SHA512
1f107c3dd535a058b88f4b5ab75fbd8b6998855eadea61bdad2785e47b5e971ce19e2950cd29aecc181108c7aecc5231fcdf5072bb704c29b36d7d8eda01bf16

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fed716ccd9b6f0dc50724a6241c358c7

SHA1
90cead56b631d083ed95a15c7a467fd87d957cb9

SHA256
0c36cb8e075de070166719ca9077fbcf68ba07ab6169ec4737914078210235ae

SHA512
8294ce365018e6a4dc82551fb59a279314aabea4dd03711ea1218f24e67df8498d6a0e4e0d696ecd18aab5019077c8fc10b2d5915c336a1620541f409505d430

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1ee43348175b54b9b096886c55478c65

SHA1
b3a1570036692ae97f16ea5f06957a28ac62cb41

SHA256
3f9f76bdb3d522c68657dcde42610c51694e49951d17b6ec17d08b8247cf31c5

SHA512
8aa583b36eebdee5ae8dcd63593f4b546e370044b3bf98df13925913d3b436208410f5a8d0b10493df61c7bb0bded04a4f03ce85b84aba003e44d944ac46b6a4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c0fcb32d0774e90830a3062a7af8065a

SHA1
f30b91f7a9dc30dd3d9dc3cbcd8b90e316628207

SHA256
2b79ef309a8e0278be16990a9a6319114983b26af9dbdad752f985f05c18125c

SHA512
ded9c7a10d0ee653141b10f41c6877e03062726cb2ce29ce3b8759c543b6767195fa7a135704aac75b1d1c301fa444950484fef84b336f96a752e6ba3a9b52f2

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1269.xml

Filesize
167KB

MD5
a645869f7bf432953f0292ca5fd17ad8

SHA1
9063c8541f8d4d81d301df8b359a30071d42b119

SHA256
04daf260c11cd34cd84f42fb5a47f1d5717d0b2f62b236826d7c3a6f0a1c9db9

SHA512
6449c45cd990750cf88cbf75b3320e6d972ba1b10dd8bb23835e1d298efb0b5d50399ad2c4be9d3d068619d645e544afc3245c66630da1878c8688811e76fca4

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit