evilquest | 04d382b06c47787397c066af8a3ab884e2095b4c26df8c76eab8866a30d4830b

Analysis

max time kernel
148s
max time network
139s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
28-04-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118
Size

337KB
MD5

05119a7067bd4e87e5d83e660cedbd5a
SHA1

2b605260e86b78b7862776b64749ebf7b9cd5238
SHA256

04d382b06c47787397c066af8a3ab884e2095b4c26df8c76eab8866a30d4830b
SHA512

43d957aed35669a6926a677be9845e5b087a5e3b2142c63482955438e4ffd6cb32ba141e808528a97837ee6024372129c628938c80e5ba469d1f3a6c60027d0b
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9hSeOQdaZNxtk8cqhSxvHY9:5LOQdaDxq8cqavHY3LOQdaDxq8cqavHY

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af38-0.dat	family_evilquest
behavioral1/files/0x000000030008af38-3.dat	family_evilquest
behavioral1/files/0x000000030008af38-14.dat	family_evilquest
behavioral1/files/0x000000030008af38-20.dat	family_evilquest
behavioral1/files/0x000000030008af38-25.dat	family_evilquest
behavioral1/files/0x000000030008af38-30.dat	family_evilquest
behavioral1/files/0x000000030008af38-35.dat	family_evilquest
behavioral1/files/0x000000030008af38-40.dat	family_evilquest
behavioral1/files/0x000000030008af38-45.dat	family_evilquest
behavioral1/files/0x000000030008af38-50.dat	family_evilquest
behavioral1/files/0x000000030008af38-55.dat	family_evilquest
behavioral1/files/0x000000030008af38-60.dat	family_evilquest
behavioral1/files/0x000000030008af38-65.dat	family_evilquest
behavioral1/files/0x000000030008af38-70.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118
  2⤵
  PID:521
- /Users/run/05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118
  /Users/run/05119a7067bd4e87e5d83e660cedbd5a_JaffaCakes118
  2⤵
  PID:521

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:522

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:522

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:522

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:510

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:527

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:527

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:528

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:528

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:529

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:529

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:530

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:530

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:531

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:531

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:531

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:532

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:532

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:532

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:533

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:533

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:534

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:548

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:558

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:564

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:567

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:568

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:569

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:572

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:573

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:575

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:577

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:579

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:583

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:583

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:584

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:585

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:588

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:588

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:589

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:589

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:591

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:591

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:597

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:598

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:604

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:616

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:616

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:617

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:617

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
956946b58f5d9ca74e83af116b7f2765

SHA1
0e5eae1b703ff427a6892f8b830aefec211e5610

SHA256
ab47428369b337f142d91f0243dc1028eafa6cbeea9eb45afbd6fab4e1cc8a53

SHA512
0ae0d91606229949bf692f58f1b9e984a2cddc334891b4daf61e18186b81e3b54a3cb163285883a61b9b2f51992deb5c9e401c0674e933598964fa3b01411265

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f0de0c6d4b6fd7d879c5f41a3e2368bb

SHA1
49dfe087b66a4bfcad94f9aaf8b48985e7064347

SHA256
e4d22cefcf6ff7bc99326435febe816bb067e2e7a8639f66797b85aa19f8d103

SHA512
de33a341dc5f6e6d65285bfe1ddf08fa7e44bdf1aa772bfd7d304c653f66467cb2830d463baf4e35545075aa8b58dec28a5f9a239b5a80f0ff7e07fa9c03258c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
52d16a3d9c1b82b91ebce04a0d768559

SHA1
07999282d265105a2fc03d2741c9689cb4d68028

SHA256
aaa1edd116637c338ca47120b20a07ca413e774a5a7cbf0c63e304158cf546d4

SHA512
118e53a83b223e80e04ff71463f7cfbd6b793224c4e2bec48147e285d3d2f2003ab8ecc550928926bb7f5bc87787df0692e31c3543dbfc2aef732c0cd19fa06f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
400b24d73ab9de636600acea58cf8c54

SHA1
26e4912f9242587f1de35d8a0c77cf3571112446

SHA256
56aec41b488e68c7bcf8ba3e072bd7f2e919214ac75e92b45f47aad29810c289

SHA512
b111b21fde4162028d1c2cc8fe607b41253ebdba2bc7e662d1df64a897c0907642eda02fbcef0261585cf931a012873ae7c73d8b131656738e980d11cf159603

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f54512b07e6ed5271e98d6af059c8128

SHA1
7ce2729fe74c2088265f0a4bda73d20a3c3d2077

SHA256
03288f564d17c4a61b8e6df508a1abb2f69b9cd71207201f1015ffb31ddc9109

SHA512
d3d032f5a9bebe63a7c0a30a4433620388496a9e352b58f21806894585d77facd85a19543f4b5a42d659c7e2a02ec6a01c55b135d048ea3638d97197c966224f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9c4fb0a1d0adc21a159ccb0c8815e4ee

SHA1
bfae4141d4e6b6c50892e8216778efdb0523dc47

SHA256
5d7cb427cc9120a96936686a64e5111bbd3ed016443cb7f534a8e4a1a34d6ad3

SHA512
e861a221e12fba320074e80d4fa1f6db2207addf14bef5f0d9900c2ca35a953eacaf290d84cc57bfd14a3daf89d2dd09274766076fe346dbdc19bc2d3ad641c3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
36f32bba22591956fc0738970020c06c

SHA1
7b639521b4521b2de30242f48ad18100e1df7ca9

SHA256
be6bebbcd8e792c6178efba7f6205e670b807efeeca7538a72dce644b2c9e16b

SHA512
9e4ec683b7b8f82b38c8f8f167a7f67052339a1a87e75e7d9a44b06044561373e48793fe19131625731d5ee029993228558607c8e233033cc621ce2e106418f9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fc515107b4d2a20e53235180efe4844f

SHA1
b791fff72a61f2afe54c061f9f5bb40092e8cdbf

SHA256
1f5f217f4828f76619ece36b9494101c7addbc669974e9d282002f7af28a4f97

SHA512
a04d8b1ff6212c0bd277cdd36b33b0d27fab2bfe5d13c627c8694c2c17fd80f7a0df80be2635fe25d32d478a8aaf1d05fc51e951819db075ce8d89107d357123

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
04c2e1163afa77961308f62ba6a392ef

SHA1
0bd2b40b2ec4bd15d28d25fa205a4d7240487be6

SHA256
9254fb11ae87b7aa13cac6fa5072907a728f835b59ce58c37817b419bc291b23

SHA512
b473122a9b87bc057c0a0e59530f96d843c0aa4003c57043c69179394e67f75f31a6518a88bd14636aed35babac7f3ff72e574afebed6c0eeda30910b07fabfb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6ddd331870f4bda3e07bbc3796415e9b

SHA1
476bf90fd5d967935eabe5528495fb4ee7e15278

SHA256
9ecbaf4768d2cf721a40c677c1cff355ef2e2cdddaa27f204052243cdaf34155

SHA512
32ff37571c5bc94919c7bdca08ff5e0247a455fdb5b52df52b9c6de82ac72326d4c870c4b216b738a9138d720108fa486c0953f639c504ab85be550112388823

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5bab812ed1a229af49c7dd6e829364a5

SHA1
9865b0b981f5152392c74f7a0e6346651b4ab501

SHA256
495152036f693424fca323692aa5bc6191adcf007a199f296d86375edeb9538d

SHA512
6ca9dccb1475e7948c84da28894facd290403794e6e9d7bc9b4d4296865a1ec34661d792d90259ac6f6f5220394293ce58995b65e42fe6674a623988769dc999

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ff99c7352ac858b793a5df66d5c7b187

SHA1
e00198381e52004d2cf7d09dbca8ac6868db8a66

SHA256
c1ab989a73ff16df7a60b282ab819c58590e4f0ad50e34f0245ed38735b3ea17

SHA512
7298c42aced76d3122abb4112b329329742ff594dd2f4da8912ef7b780998ad7299f47fe41460fc2b62c583503dc894f65afd3d6cd00055351734893964fbe1e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ec95f85fcc8ecda47397c6be9e625b93

SHA1
be3a74bf14806c53222e4fed3fb82e4a14d45e06

SHA256
30e2ff8c9a5b6b2d1d476b6d4cb63e046a1cb346360b18fc3f969b7fc93a7e80

SHA512
1fb9398244164c3487e790b76d3cfc2e7758c3a96e9a575d5418e7cd7e271b5207771f5216bfda5d663c5feb4749dd4bf96b1e76e4119d5028916f135dd80c12

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
29e6f8ce54f75fdd5742c9791f4bdff8

SHA1
495af036ddfc35839f2ed335137b3a846a361680

SHA256
eaa5f47e9afb12594e3c229892e63376b3b2500142969c5c6c09ddb62ccd402c

SHA512
339e1debd0ad6661bff6870bb655425249b5dda022b6c69c1d34b51e721d9d60b278ecd78cf33b44b6a68dbf8c516a3445229b1794ad84e0523b06dbaf72a872

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
077443fa5387bd993cd4b8b819f8e967

SHA1
c63ceac61f6bb94d681a7b025faaf35f1b5a7375

SHA256
d30f65cfc0a3099114765038bc8e3457bfe9844d614526ffb4795f4dee4a1434

SHA512
4f07ee708aca2ba68f1266b2f722343fb1c25bb1641e9e22f4a378960140a72390ac93bdcbc4b26daae668de973c7965043dc014aab4e4f4a6eb3bb025369ad4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
50eab9278b2df5495376b9f37f96a4d8

SHA1
6ae981646fba6d34c2a4df36e9e7b242320f9049

SHA256
e6ef14d4dbafc04fc7a7a2ecbe74219857db8dcad4b2e5d8b85fe84e80b2a012

SHA512
03a409c0c85b23900e032d4accb5ab799aeaefe7b94bdf3bd7fba5f290751da0b7566e9db58fac3ed98ae444278eca354b2ad1ed713167188c3b6d7f62257e95

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
4ada9c8609ba3a86a4d20950f2e858e3

SHA1
4ea192eb2394ad6493f53e28f7c52f4c6540cbd9

SHA256
5e29083d4064214d2dd28150f5ddd07f0e0cf87755f88c4704cf65c0b7650f8e

SHA512
d80abafb9199d992b8d09d1bd36c3ea7991da694861c91ce2da24852f5590087a9f474a7e78e6c67706829f76aafa190d235d67458f533bfa3625e76da9cd0d3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
fc1e9559f50c1b3b10f6c93d1ccb6b15

SHA1
f4dbf5f53986d583b202015cf2d6960357e91cf2

SHA256
88d9948c7a481555e8d6d6d588a8eeb5953e050621a81542f14b388db1b49edb

SHA512
0aae000053b8f177c3c96f7bef0772445b5f618496794967d2208fb5a7b01cd53ffa1e66611a53df17789adcda5fbc650d3abed95f7cc95df7d80b56c8a140bd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
ed0ef470615989858a3792c4d8f8c629

SHA1
c8a7e8ca030f598c3942e482e69282759bc973ad

SHA256
a66edb4d34d841f5c9a4cb41cfc273da7cc9e98b08b2380f69c3767bc31895bd

SHA512
1d77b0be8ae629a88ca6191eadb25765693679d5a0d818a3dec4ce541e13350de79367c16d74f8d32240ee5611cf7315333271d2a2e97f1b82f05911c473a562

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
525f0f9e023944ef5ec9dfc94b4263ff

SHA1
e2e079bf729fdcef14ea8a9d7d28a44481fd32f9

SHA256
0f5df16524bf867bf8abbe3f8a783e1b2f180e5fe983099c3d65ddaa1932f2f0

SHA512
7906cfbed03d7e61414c4c4eced7dc9cbe6e534a8cd22c2a7404a1f5301a24c707c74c45c7fed45aec81c4eee77a22c68f26a3de8f548fcb01f3fbbda3a4d811

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
64d3aafcd5eb8333d81a0b3b4c9b12c8

SHA1
eaa84bf8294f0a44fc86ebdedb35594a3aa1f86f

SHA256
bce130f63e170ed7ec08e621e181a8631326f94c40d19091e2799d2bd1ae52f3

SHA512
d3f0762c3abe3dbe15fa93ea5c0d8111105de27e04cc6c9e1247be0713caa8ac6a158222354a8c5172b59ea8716926c81b8307486cce98f623bdacf61c630a40

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
ac1bfcfa01616dee5dd9cf99e21f3d93

SHA1
fd782ced0789f8faebf9c66a7713f0d4ce05259a

SHA256
25078b6a8227dd19ba8c8c6a91f421220d21e9075fb3ab562f464f50d3778f3d

SHA512
0ae174938cc2f809bae76d5382589d757ddd52aa0e8f74dbcfc106afeb661505e6fe3961eed685cf50cc50c21874e5dc5703443db4a9b9c6e43b7b0aafdf7205

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
3ac5e7257a6f23030bab2de865cfbc80

SHA1
af8c0b27f4bbfcfdd830bd6f15d236c3704fe4ec

SHA256
2341cf688bf949a9f7c4110f03e819ce16d3c53265c5d99268d83f13490b6ff6

SHA512
48fb594fe6ca7e2d8373bde46482aa88a2a64b9e54800e02561ea7272fc6cfa023e77f6e0fa9c3d66754cbbc6882e1a2d385c8ef9f08679dfd86e8d3f443da5c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
475e6b3831a374825400571dd27082b4

SHA1
4c2ad2360304ab416130e5f4b60cb9c07838496d

SHA256
3a0b4add061e6a51e1e226de1f2abe82b2cce8a6b6f31dbed7e04b145f2d7365

SHA512
35924e5ad2f3b2132d4b9bb35ea52258905333d75f3c8d470ac41e15584adb75c1a21e7c06f410ade25e9cfd6860d1852371bdb397e229b486df45d00f76a3a6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
d25a33df0843d803f78e64abbfba3fe4

SHA1
a40eb507e913da50232a28d5b9f93140e8e92a5a

SHA256
cc65e6c64c5f71979491c72d9d1f592ec7961d914717576fb3f2d943fb7c8aaa

SHA512
77d4010c4ba48a855275e65db725a378c36d14b9f3d81b9e987b24400288ba786062d8b6d931ac667f85f49a54195eb824091fa6ab5c25e0304d09401754c8cc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
5b3cb6ee28923de0e8cbb502f0cc2e16

SHA1
0b863bdea1360ad843b089d5ee391ccca22ab037

SHA256
b6c967cbdd9ac6feb54ecb671fb859f19713b7a6e142b87464a84ac8b42cf5c7

SHA512
3c13572d4bdf555bf94d165bb4e78ef239b3d2bc3b8ecff5c3fea33b8bb6869b91909ddb170d666462ba85437a4596f41109c6f5815f547a1271823952b81f07

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
bc96ea410731c9c613c7c5b779d263f6

SHA1
5d78e7b29e462ae5b344f58c1a9b061057d30256

SHA256
af983bb3ffa72b29945afb1028adc83ee44e975dd474f9cb8ef2c88e99521bef

SHA512
35fdc420f6dbfae341a960da8e2893762ceb8188b4b2b3810fbd6c00bc51493705116c6e737d2b249e913ba49357d6f39272beebbbfd62b461970abc5d505fee

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
337KB

MD5
8242a3781677310f5232efb47657407f

SHA1
fb9c3461bb652077e52c8848cfbf6f7fdd8cfb2f

SHA256
1dccd04aa198bd131373d013f328585639a0eb43e16a0f61debb4e83903d47ef

SHA512
1bfcc10994fbf43ffc000fccf03dc0cdc5761f1b7d51f1ea9d6cec2f8800f6f282f262cb0315e2ab05b85bec05f19086d98fb96ffff4d1f3e42eaa5b52cfe07f

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit