evilquest | 54e2ecad2930f63e5d64a5f8f406ecd856eec7019f6a95e8d958f216196b446e

Analysis

max time kernel
150s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
28-04-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118
Size

168KB
MD5

0449c9c54a0bb3608321b2d8275023a1
SHA1

c42b3bda22e7b7877e383596bf2173d380023c08
SHA256

54e2ecad2930f63e5d64a5f8f406ecd856eec7019f6a95e8d958f216196b446e
SHA512

61560532a7ecd7559118c4b10bcdb3361e8ce2f1926714ea30c3dcd45669ddf783b3d2d18533c334291aaef04ed4dc8b94dd5c4668b33c46129d1ed80d52180a
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9CqJ0:5SeOQdaZNxtk8cqhSxvHY9Cq

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118
  2⤵
  PID:520
- /Users/run/0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118
  /Users/run/0449c9c54a0bb3608321b2d8275023a1_JaffaCakes118
  2⤵
  PID:520

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:527

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:527

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:529

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:529

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:531

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:531

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:532

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:532

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:535

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:549

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:563

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:564

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:565

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:566

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:566

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:569

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:571

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:572

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:575

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:577

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:578

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:579

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:579

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:583

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:583

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:586

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:586

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:589

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:589

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:591

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:591

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:595

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:596

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:596

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:597

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:597

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:601

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:603

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:603

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:605

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:605

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:606

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:607

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:607

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:609

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:609

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:611

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:613

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:613

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ac26c28751b0e26acd479c903cc8f174

SHA1
6dab45541a62952646f9a0e115a545c6216c7f4d

SHA256
2277456366c6443e401c9bfde0b25bbad801295fa863638de98d3514b812d090

SHA512
02254ffbdf574f36302fb77aa0776b72332f273ce5aed1a74d50bf331af42a17ba9d4d531d03083ea8152a4834f5f75977b87eb8686dc8d458d317646bca2742

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8e3f5e00894eed78c639642e672cca9f

SHA1
54b65cdb2408548bc7461636985b15a0de885cb9

SHA256
bb32e60adb724e86c879241fd27d5544e76a3afae608334b5afc8eb3eb479a87

SHA512
8a9009e1a460dfdd317c192bc259f32a325e486f253b94962501e035926a93945dc0079226081b8e58315f584ed62679252d2a7a30443ec22b31501431391793

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ee5ed78f932c46782e105e42b25a43d2

SHA1
2cbe3fb2a8f760e0b6845cc6c045520bc38cfaf3

SHA256
56af3b2a74a871bee968d73e28657ef8164409e8c8a118089d8baa86f92c889c

SHA512
b7a65ba1e6c74a7d6cc0d34bea9c3d8ca28baac37364c131ad27420640c5fec27edd0e41f31da451a1faf2043132eb2700a0d89feb42b4d007f63aef2b6ee5f1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
199609e03b8db5d6a20820f5f9e525b9

SHA1
15982abaaccca1e61615edf20d7ce2002819e997

SHA256
91e46d70ebe1743baa3432f2ea8f30460bbcb6b3e8cac8a1cb9453648840cbe1

SHA512
00c6482d0a93f89140c49fd76f65f50f56434a6ce8144b8e5ede1b8aa5697d2adc9d60ac47723262b4d9fb5fe6ab6a68bb9cd044cb1a25582c68ea9dbbf825a1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c42a9d64799859d3b819e6ed75cf62d4

SHA1
036c3365c90d8ba371173dacd7b2c3eebe90b5cd

SHA256
921488cb380a3745c3adacd523bff5fbc7d90c9a76a56113eecaa01431cd3a4a

SHA512
af4dd1ac02a7047231a9fac6e309a63e3aaf44156f3565c162dd1f67ce511c1fe0fadfdef5626da22601c0824267113e13dae93d24041f415e5b990629352c9c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a09c43c7ca8c071ccdcbc5ec28ec4b5d

SHA1
f4e01d256c4c7aa053128a4f32715f3a8e651426

SHA256
a14a724d1542de85af5cc3c6a58ffa9a8609e2309a1f8ca1b3b6b6f56254888c

SHA512
bcd38f6ff070aa240df3bffb2cebf758d02c824ad5088b42cb18be79237f8291c512f46c08961c940de554ff40af8829a1b171f3e83be1e431fc3d6fbf57a094

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4beaa3a5119507f64c8a2be0615ec030

SHA1
696763f2898b2165f8353ee85005705e2985b012

SHA256
144bc29133fb09b1b3c125db37ecdb6eac540d69d64cb35aca95285d23f97977

SHA512
bbb1abf89a3c8c3b5e184346bceeacb1b8d7327d5c82362dc320a755558f14d6bd87a0a563f77509908726c8e224cb681bbe47aa7921dabf50edfc8647feeff7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
acd2b7fa121472ff7c0c2aebeaf7f195

SHA1
5c8a8290969e53912cddeb1cb0ae0b08990b95d3

SHA256
5bad2364b268c35d7ee4e37c20455379a60ccc1aa8985bfe7e33e8df8ad49418

SHA512
7cc706de9dc73c497279abccfadb2b828575e08bf3d89e1ead1749373aef651bf7673bf7bbc26261a8bd728d7ed57f43dc7244a930feb88e6657591d68a305b1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4523980d7d3cdd1dd702a6828297ef8a

SHA1
42f4cc6aa344b3c590235d2c3018a4c6853fe1a0

SHA256
5d285f272ea3b91f0b6342a95400ce65f5222df7e3970fbe3323f3efe9baec9e

SHA512
07bee89b48e4f638e7784d40e52fded02ee009dc2fc2661183a73cac14f141de4ec78e23a3d72cf2d0f8cdbd8aead55f8febce8cb35a1fa55c2579f837c2101a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1c0eea751e3678ef036f62ac0cbea7b6

SHA1
fce463d09c886ffcefbb0eda54f333ec9d578805

SHA256
a85d2c0e63a29b581c79a8bf5e5ac2c2552ce957404499c76d63461eb8290429

SHA512
ce9764c80688d227e627ae8e32f60eb256af43527953d6e41b8fa5c82ce52a42108c895391863325a283459141fb4854f5a8d3fbacab45d274d396903d118eea

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b8462e23a022becb17ee56f7359ef3fd

SHA1
d9a57313294b329365bbbc281699cfa92690210b

SHA256
69efa389232f573c7c203e65c99fd46ad486dcde6637b2c0f4ac08b39a7d73d9

SHA512
befa32aa63f22f082dc2290bdcb5f7796011c8e3f5604e3f331c0cb7715a05f4dec4e777fd80a119e76eceda5c33ab4a0674f04084147271eedc7c1ab4eaf65f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f5c0afe29a15a6e4c88f3fa456a2b4eb

SHA1
03b5b19e213c0da5bf8e221e8a84aaf991f4335c

SHA256
74822c4641c0c94bafbf81503f09b00048ea27621bb90e3865d43b65fd5940b7

SHA512
16c388be83c1e7b391af4aeae1c8579dc0d94ceb90b78514d72fc0cc2970f8de3c9fe123254e0aab971f3339587c1aea7be455a859c35137550885b80ab9855d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
65e571190e767c0efaa37b6d1b613df6

SHA1
8bb2f511d28dea520af7c1a881e9491e7f47c705

SHA256
de8943ec146dbf186b187cdd21be2458937d447ca8edbe64dc2eacbcd1d3557e

SHA512
a20b93703aa2f15296657907dc460c646a473d8c7e761c7238102b85b8c68c41b9f4acc5715983898b14e301c8102d3ca1a9c6254f479d95298bfef7f290404e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ae0f31331e656cbd0a0132082a8d1d65

SHA1
1c62df1a5f61fc1e00b0817e3d6173284ea4a02e

SHA256
b15637a318544f474c1196c316c8c66dfbaf30f2a90c98562a32f6f8a512b0b1

SHA512
6383a3b7b0f6cd0c39de34e47a10b5b95bd64027c81e6a40fbe3c2fd501c423867bcdad454550c85b2cbb38952f7f10ab1a5e9e5be73f3ddf18c4b7f83bd9881

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
288B

MD5
55d707d8a498ca399dd49c710374392d

SHA1
94956fb7af8ebb24faa018be5739179ae2e21dbb

SHA256
0de9ce482bde894cb5d5042cfeaf0d54cb0f56ad4852caa4d06ad54a53a7b49f

SHA512
e6183083a8f1f1ea5e67806ecbcab5adefc331aca2622e3b846cee48b803a91076dfd9a905573ee71c900bc5563b4e6e7f3ab994de7e29552a01647cd29ad20e

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
ce9e330311d52c1552dbf21583b2581d

SHA1
cfb3ba6d08e0dfc2aba10378957ba32f76fea244

SHA256
f9c806255059d7c139c24d3bcf768b120d159027ae6c510d34aa520d130ae781

SHA512
b1981a94ab09af570518acdaecbc73da526676721dce8c2962a091f944b344eaccfc02cf3f2b19c3b3b2718eea743dadaaf65fc4c7bf68d6e0bf8bc278c5db34

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
984332fa658b120abbf6f2ec46ccf968

SHA1
172772f2fb946b9c628393707f8da300ec87f105

SHA256
35f63127dab5eb47a4d8e9933aa5b96cbba52af3743fc6fb75ff8d7462a666e3

SHA512
9a4532649fa28fe3734b3ce838801bf19877a09c1f5c1e3f78db4a6cf61ffb362ebd108c035b78a7584e0936df07798cfd8b20336b5ddeb5e8bd5adb0e0011db

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0f6fa6fe0ce242c568f2827914ca9b92

SHA1
bf97b5ae17f894aa29cb8e440788b9a3b428a7e9

SHA256
17d3fe39baa2b0fe8ed3cbc148a8470870c792495835a95bdbc9e3f10486fb24

SHA512
d1ca2be3a8ed474f969fd6f371e43c1c839e505e57ca68c108775cdefc488ac749c22a126cdea717bb8047a6c0358404792f9c0bd553bfb05035c2bb7b36ee00

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4f78c7170e98c67c0cf2e1f70864ac70

SHA1
13b17af358066dc7fee40e4f7b8dc0cd400c03b5

SHA256
33f57b41b05331a6a0a03cf3dd3558d6397e0e17eafb70fb5b158882a26cbc77

SHA512
0a2b1532f5a8bf9884cd3a312d7560156b0c0957bc1ab447302e4fd9e55043567ff2f7eb3a62417572db4fdbd181f7a90cb418afda0260dbf81518369e160360

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
def544e31c979cc2bb2c066fc6a17409

SHA1
5332d188e9934a932b6303e9a9d0c917cf80365c

SHA256
03d9b03f8d04f90fcd1f7ac8f65b378c49a3652623fda71a70491278716239ca

SHA512
439a926a24d8c7915957c198227331dd0ef75cb4e40a14f269c472c5575c885e5bad31e3d79c48c5be69c6c14c3531dd82d61c018e4c5f02876076b69cd08959

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4cf9f8e267474df8f87da06e664d0ff3

SHA1
08cbfb7ac4d80fc2e3b4b7e95b282a73cdf14b75

SHA256
765304ff764f2eeeb3b4cbf168b92ef4f0b2506dbd56fd9dd3f47039c33c4b21

SHA512
0e37b1c1de35c76ddbe6cdf397a8cea8609bf9d2ea3e708824214754291e84efc9924c38429bad9c355c391cf6661d92348324786135de3e15d07b7c4a2dc307

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9b58d23d86f39ed8880e31590218bffd

SHA1
fe4522fa4e178ac6f5ab5beb2ab131763d7e87bd

SHA256
78b5c992fbf0979bba13c38c89131822a636b1785315ffaa67f7d16aac68b45f

SHA512
79f70bf5508651274e045017e04a59a3f8a457ec2edd7c322e01c9cdc24159e0354b62c7ccf815e50b7dd0e5b3bb31b8244b6edab765189def98de56f96a783a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c4c3281360bd5ffff317a5480f6a08f6

SHA1
954a128542a06009085501764be939603ee43cf6

SHA256
63c5cbaf5bebbbd59ebe529815e0a59579df564f033bfa85aa12f7656e740333

SHA512
9d2cf0612fbbe68934941f9cff4d1cf225e4bbc740f513ef6ac747ef826f31884a0d2335ed68df893dd4f95133a48b9bce554df99ac5d0c3905220b8a017e019

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4e337a2a47184470cd86cdf41b9b884b

SHA1
34711ceb1e40d3baf18f4790dffbe045adde178d

SHA256
4f4fc0033ab684365b1323ee4bbaa95be16f0c0f9aa0bd764a183548477c0549

SHA512
96ea077f655cd1c0a605a4a30d9b695151088abbbcb343cd5506c35ab3ffd48a63ce41577384986f8ac293002a9e0e9ed8e1d49b89ef12688c771d06e35eb689

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6e37c3c3d67affc113b3cb213f01bb9f

SHA1
ca0a94ae0ad2a2924713c2aa99c8fdea611cbc6c

SHA256
a054f7883b9140f4f793e3d6d83042131c9beb1239f043e6b05546fa028643a0

SHA512
287445ce3b70a2caf6919e5418256367cba884d600c737a2e25004a8a7aae3bc595a2e603d8be0b8fe34b6658195afb5da8e30694d32543c1e263147112ef7d7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2a4c97b23e0fb72b351caa4e7ff439bb

SHA1
d91215d225cdb6334a51bced4f7a4d93398a8e4e

SHA256
f0be7878f15dd91ae1e965a23589ef24bc5cf788b405675a1ccb1d2bfadfce7a

SHA512
655696afb2514b6f44723287e3d0463efff1e26cc48370bdf3dee37bf2696c10a9f966dfa53cb4be269d3e7fc208775ca13e956e3df502150584af1328e72724

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f535b90302c4eb0826b668e9a6137eda

SHA1
63acf2cf13b386f39a1aa24f1317d4f6c04d1f37

SHA256
ffa5c5010f97b6e7ae2b83b95ff2bcd9b4f16f4714b87abc45527206dd039b61

SHA512
47bb9d3cad078348386f17548721132da1984ed948d2bfeae2e57a62571bfa08d3d2577880b99c9f78667d4f934404bc99b30d760303686f4bdc2acbef7f9317

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2b77c660e3e46bb088f7b335f7c5bb16

SHA1
1b3690a30bd98854ea2665c75c1aa6727895ea07

SHA256
649f882c97815dfc2e0e9b5f954ed30c0d5a29b90e6cb48a89ec9be3d077d8c6

SHA512
3c61d8ea6e676dcb936169d18a97baff9124b81f340b1b1b239b3255b5756ff295b8bfdaad126ef5351f13daa980bb949ff8bbef428eaf3238a0a5a55663b87c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8383d65db81ae985aca4a25ae1d37065

SHA1
209bfa2af8adf14d32fcb3ca84d9a163fc8e306b

SHA256
63af77246d4d37881027ac44c54fe8be29f86843f5fb51da392c7111de3f9971

SHA512
b7f597114cc47573bf0f88efa22b3c2b46807b09ff08fd0ceb61723005a6eddeeeccc2eddca9e316121073abefa3c79216b9dafc896631c7d581ddf45109e751

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
638d162f4afc545bbafcf7d39e5f3983

SHA1
9234235603a2ec5f22a4f2eb1a8621d245a618a2

SHA256
84000185d92736c492b9d5604dbb06faa9b22e2423c5e58deb1e85682c767847

SHA512
2fab1f929988431ef4ba5e675d11d7ff2edff699e03f440fafc82fc80bd06bb27f4dcdafb2699decbc1fac76a92ccb3c42df6ecb6e1beb9d7417926564441231

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
571dea8371a184ccd24c226707a67d6b

SHA1
c6ea326e9c0e5b8c0c619fbbd5c697b06ca947d8

SHA256
62b9ce4eb2daf5b1c763735310bcaa9413f5d0242c46ab64f93b419a82bde8b5

SHA512
c55fe215d582c8aa4195207f7b9e09b9d882b44a7bb90225081651cef96b6e7bfd8d00c60bba449056c5a176da0271c68bcff2f976786aae326613ea4750e665

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
82fda527b5f6cd0499970adb75a284ab

SHA1
f3b94855a562ece83e2d71828942624472d44763

SHA256
91ad7866ece103b75060677e241d1e19f5d05be7777f66a16b1ca4cfeef3c3de

SHA512
f57c6ffc5c1f24d18ec45b3821d2b70f84ce4f75f2cb8e0be671659b7a172ff7191b067fb3d587dbd0a9461754a72c068e20a39c67aebcaed3bcf925f02a67c3

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit