evilquest | 54f41fe50c42a45b8bc587239b2c987c2919562505ca28fa1312eca748d7fbc2

Analysis

max time kernel
150s
max time network
146s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
28-04-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05aea69e23e15b8a962cc15f5364d520_JaffaCakes118
Size

168KB
MD5

05aea69e23e15b8a962cc15f5364d520
SHA1

24039cb0de1f3b913bf539c4686a538c284d34ea
SHA256

54f41fe50c42a45b8bc587239b2c987c2919562505ca28fa1312eca748d7fbc2
SHA512

c33a0821df728b68abc3362688f181173cc201e3fc6a9266c306b4ceef0eefcb995cf2558f9d8b92c46a374a6393bb02c036f00f8bd73aa406898a712b928c56
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9ByEj0:5SeOQdaZNxtk8cqhSxvHY9/

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adff-3.dat	family_evilquest
behavioral1/files/0x000000030008adff-6.dat	family_evilquest
behavioral1/files/0x000000030008adff-17.dat	family_evilquest
behavioral1/files/0x000000030008adff-23.dat	family_evilquest
behavioral1/files/0x000000030008adff-30.dat	family_evilquest
behavioral1/files/0x000000030008adff-35.dat	family_evilquest
behavioral1/files/0x000000030008adff-40.dat	family_evilquest
behavioral1/files/0x000000030008adff-45.dat	family_evilquest
behavioral1/files/0x000000030008adff-50.dat	family_evilquest
behavioral1/files/0x000000030008adff-55.dat	family_evilquest
behavioral1/files/0x000000030008adff-60.dat	family_evilquest
behavioral1/files/0x000000030008adff-65.dat	family_evilquest
behavioral1/files/0x000000030008adff-70.dat	family_evilquest
behavioral1/files/0x000000030008adff-75.dat	family_evilquest
behavioral1/files/0x000000030008adff-80.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118
  2⤵
  PID:566
- /Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118
  /Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118
  2⤵
  PID:566

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:591

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:592

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:594

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:594

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:595

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:595

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:595

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:596

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:607

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:607

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:616

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:617

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:618

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:620

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:620

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:621

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:623

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:624

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:625

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:626

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:629

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:631

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:632

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:633

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:639

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:651

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:653

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:655

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:663

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:672

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:672

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:673

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
00ada55d3d10805bd18e573d0e6cfb45

SHA1
8f879af9a6316c530955ecaef590fe6b98df7e8a

SHA256
0934da63a4622e6c41b73268af771cd52439b1245d90a91019996c151eb22c8d

SHA512
17ec33ddb746ab7dc452a3bab9e9bf009caeefac271b74687f41715c7f5cd8a9803bd74bbacf8cfa25c62e5f53ca11587e9478a8ec3abd5742b2020062ba32f0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a9de58e933fa1f232c10235537c73255

SHA1
306a294230c58a4cd3af719f880fc5f8b419b699

SHA256
c26f64a1694a9daca801da0b03534f239d01b93dafeb3e04a79604d8b8735281

SHA512
334f88a8bdac9839f46300d3b82856269e6d2ed66dd48ae026b2a8bb33836cf10d4360fe76101139797a48e70517f0d9f28408173dd98cf864e8162eb49d47b3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
464b5e7a7c924d4134452cc251501975

SHA1
2063a5798d1bda23363f78c2d7d1e0221309e9b8

SHA256
bf95834eae817a07535c05a105a727cfabadc9c466818da3389a301a2b1b7cb3

SHA512
bda2b702eba5b430fed3eb38ed708288ffced8b69f9ce05d5fc0c764478f65d91fcb7feea05688b0904c6f8d57ae5b4090f0102dc654cf162c776ba36685bbe0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
da06bda744139b3a7b30ffb220560c6d

SHA1
d88df913f538259ed251d59cf8bea6c2f03e1eb9

SHA256
e7325d34e8e63ab7a99d42b85f4d28df03c74953077e76cae08929667a27f151

SHA512
2918b23be856830a1bf9dc5b4bcfafd51f9d2f5a55b4583ff029c3b362ebf9cf861991b81429c9df439967ffbf4798c0cee4c0341cc776a4ce170b6fc8a8bde2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
65239d9248d6ad9f0655473e4df9fb11

SHA1
98a25d5ed6781f3f3919d51712aba493465d153b

SHA256
4ed2c88d2bfc9f75a6488adb2d539668ed4fccad799a876f4ec393ae9a66ce69

SHA512
da804da118314310a84be7c6d0259a697e25bfdfd0e323e02055d00e645a72e55053c13dd1b69d64d63a6a108485fa70f7e980126a5ba058976f84ba2ba74d62

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fb870ce329fabd5adb3960a146e1a2e4

SHA1
c5b874ee964833281e45edfccf5c0845b691ed2e

SHA256
8c84ae57fbb9630abebab9ce8b43d0e7f9ea79e8645e6fd6f2ebb83c737cd1c8

SHA512
7dfec00283f2ea45ac9c56e0567149ec07b856dd9f34befca9ccc5cdafc16386f5f0206b11ae53966dd1e74df46cb3252df9e5841a1ed575006ac6cf2bb39120

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5e99231c99cfff7d9999ad46e69e72b8

SHA1
a86574fbf4fcc3e515ea2421b9d92520f2f75817

SHA256
f76c13fc325a8c98fc529e828dd390ccc9476f4c6585c7d62b75a9f3484c53bf

SHA512
c017ee67bb332ca61b7ad55738afc541415d81c6f4b3a3ae07e376bf97acaa52bacd01adaead53408c9e7ced5490e5c02ecf67cc25111b455282eb7a1aa8903c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
daa4ee99a8c8b7e5a787d2c33ab86e5b

SHA1
4eb0e2f5fd56e0283b21aff370805e8ff2022abe

SHA256
612fef7a2a58d9e894b4b30a7b49962592698ea9f25bc84c41cca29b4dd2a738

SHA512
d1bd7c877c8f8baae81c6f26c4901227a8ac21a7e0e76098cb22a61ff3a53da57d9e91abe5072e48f0b00219b7f27925c1baceb97619dbc4a7b4b11ab1318d15

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5eebc666ebf8a3d6e96bb96974932aa8

SHA1
f48637744aec3596ba9db433a500766b728b3c36

SHA256
03b9f36ae1df96a5ba6bf3b54354f512353010388245a132070dbbd1e84c657c

SHA512
79f2af47172e56c52cd0db488c6ee2ee0be3085c38aea04faddeb1dfe4e153c40367df7dc79203ebe55dd492ca062d45a2b16372926beeb799a468f17d39b4fd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5b281fd8a6902d53dd09a765d523e46b

SHA1
339203bb910d419ff0d452647367072cd8ba6bd8

SHA256
0639753ab0f660f7406bd846bc5e3f6c370ae172f6773825f9d3a5e9d70ece3d

SHA512
125cd9c8fc823b47ced0c21878891b090e9f096110bfa2cc21739b611c0c6549742e57468fd0ca39f7deb87a6ede63ca7b51b9215b96b60c52659f549452a008

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
792b23bcd1eac8dc2c004a56859e6cee

SHA1
f3a0e528f6c9febf79b436fcc35e01365ce69af2

SHA256
2e85f5712629ca5f3e1850522963d7c53cf253f1ee12708abecd25acec5dda96

SHA512
de300cac6b19cb4f583346af84f7194dcce14955679b8d4677a182ebaacd776a31448a6ce8b14f27e2132172d406b65288a8f29b7a1969b63ec359b50c13a0f1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
488ae9f883d712670db0f4dcfd8b4744

SHA1
945d6caa5c4f779fe67a5eb68cbb3364b775e793

SHA256
b5159ab506a5ced306c370bd43e852550b7692f06fa31228327db71ff6227f9a

SHA512
559687694a46dd772bfbc9830e76a5024fde5425e10450ae0ced21434fe189736bac4f2e89347abd95c0630b6b79fe7285faac5ecd4b82539d031dea0eaeabdd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f72e179f0583d9ad6ee0595720650f88

SHA1
f520045273a4520194625fe015c163cc8928b16f

SHA256
6c4e3aa72ac2d2611e4e70957243fa17b8420f9a5b3b56066e11b80fdf032467

SHA512
8ae6547c346c66a004376a49e610eeb50ce84d950a29474609357ef5704b74f52b9efe82dc05698217fe06eb67dc355a081a3806ff80a9ff04db9a5ec45adc46

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f1b23e5c3a4702fbc3fd524873479fa7

SHA1
8143ecb38bfccd08db930a9731ea40504096bef1

SHA256
8f1a518087c108a44de1c491d812fb8d9e8ab172908ccebab79648cf86c34ce6

SHA512
6979ac451c48c23c70bd84e9259f6e3fa691337d6197ca2ce32bf1100cacc9ce48fc2243a62d8b30fb7c8ce0e6b087469443480202114aa37a28af1655ecbf90

Download Submit
/Users/run/05aea69e23e15b8a962cc15f5364d520_JaffaCakes118

Filesize
168KB

MD5
00116d1581baa43dca761051220e250a

SHA1
0b6a2e4fca0a6d466f1b4ebfc5bcd42f80ad1515

SHA256
68ab92f69c18e42f97cac0a641eb2e86516c3f5f242893e855c37bfa4efb2dc0

SHA512
bd61abaf5e96a2f7fffe3f98481ed00a7658423a4b0c49cf1d455448540d9a2751bb431e5bb2b427cbe53f5ac602e6801a0c49816ed98f5bdeb216b9c5869a12

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
9b64c13eed4116eeaf310f7eff7c19bc

SHA1
6f8b6a05da10906c049bc42af876bfacbf2cfb9e

SHA256
5be7845276a5efb0cd6b79be20618c21f590a71f9d9721ad398283ea2bd10670

SHA512
f1bcaf26d0d89e4d68dde9864eb4e44c5254fe8be7404face4ed3fec9f4a9c60adb4c51781e081a459d6f8f67f19cd21565f2d832134a371e70aa8ce6c513a4f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
89a0fca45bdfb75155145814c0fdc031

SHA1
7418632e4ac45eff54bdc19560137d48cd50c331

SHA256
6d1c74f1884c67f05b5e03f772970f79d0bc4d4007d6a562e33065036b16804a

SHA512
3144019888dbcd8e944e28d5acf510559c62624c2aec4d6addc316ca95ca3d1de53713a64de9388985c411113ea5cf31d40244fea96a8595225c9deb35674452

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
97195685618b5fe540720bc61b0d8738

SHA1
71b56183411865b77cdaaa75aa0844f384460a29

SHA256
7ef36daa2874ac5b2dabe9fab9180995213e91fcd01e2a621742e33aef783691

SHA512
3cc1046400fd5ea5393f9d6df3d8ad9185c030f28b301d97b9814b7ae0216592c411dc3d5630ad77344d4f1c87849f6e6a9f809068f12e09e9bddd45273ec8a0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6c59bd81c08802a17e6cdb662411d631

SHA1
0533245d4b60123911bacc5803c4a08eff380e48

SHA256
97e0a5088dc948583b13f934c18fcd4b533a0aff677050b290a13b9a34f581ec

SHA512
b8077c9569d01c156203231d4ee8cb81e64ede009179c02c581847766d39e391a70d5945858ef32c17bfb901f8998b1471e16db0c8834d97380f2ffd8c27aec9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7b572a904f776d7d78deefa0dd3d9997

SHA1
af947fd1f6a0d434f2d9cc1c668f866d89996946

SHA256
352ee1b433c7a1be4f9fb7aa4d33b81215144dee028981fc52e7dee229d8b365

SHA512
2d746550d66a9b48ed4431aca1ed9e31cff6fffe26bfbf9cb2fe74e78562a2ce8ab416815cc617a6a88fc358f1eff8589eecd78f034c8b576ef5c2f907f32fba

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
74ce6f5189c5fcbf027693d4178ab379

SHA1
f6c847a6dd6223666956c59999bba03c4791eee3

SHA256
578be022dd8ff47775a17c4c7a0b6c6fd23a64e1f95b7ccb88f1a6aa3a117c0e

SHA512
4b32b303548f59b272dc111cffc7e3643383321ab9184bd12a3549e3bcf6cbaed919cf0bff67047bebe9e0b5c940cea62e4e29f07f10fa9fedb2323bd3b1f79d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e8e5970d152757db7f1cbe5a9ecac53c

SHA1
634a82cd1163599e07eba5132e7694ba7e5a7afd

SHA256
4cb7bf1c6d729c60f0de910047259239fc955423626f4437d5be0140d13d9ca8

SHA512
d91d59f979920a4d78e720d267cc9c1a5580a5cdab63663869e79e98da39f7cbb6d3ef9ac6f942d3528cca96686bc34f5bb526b7b095c2efb6460b92c3f1ece4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ecc897224f481c0fd7c46088bef7a67c

SHA1
1857f347947abca8690b91a3d821136e7da6bd9b

SHA256
e87fd0e09d0bee98bfa409f692dcd9a4cae3a172ff694ed159b7c7355e182b5c

SHA512
516e47f3618932c49281e0cf9bfe1052d402e461f008d7d366a91619554b1c88b1ee5c9e64b519b2116c775327acb8cc18ac46e9df8b38c3f1a970c1922722df

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
421ec653c25c78e49af935fc83e37c0a

SHA1
22e638f8099e3f5593d7c81423802399fcd7d7f8

SHA256
f9ef75fed5c123a748e5c035150df616bbe65acb251356497a9eb0de194f280c

SHA512
cbf74ddab01a74cd1686ec4e4cfe1d4200ba8bb8db7d916246bad8dc60ce93414c22a49bde9af09146ec191c69c08b4dc6a8714c37b0317df32cbd6a8e704add

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e61e06f5f3a04e6d507c68ce1efc0206

SHA1
bf4644fe9c392a0ae129e4e563091970427d20c8

SHA256
a392cb4271df3658c06b92480916cfdc7a3e7c8ddf7174ec1e97d2e42d22c75b

SHA512
906188fe65b3d3c422ec09af3128c0973b9a29df337fe57f3f4bded0a241d9986f5d075ccf64964f060652ff140f8761f9d8b5d700eccda7ad01e5f964503736

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0b1f7e164c90d4fd5da8c345fa54f4ed

SHA1
d552d08f38ac84b6415aca687b3d829d24115bd1

SHA256
339873df0c165ae599f0b8fd5951a7f878f42f0959da9d74e2a493208fd97ed0

SHA512
3acefe66fd5380f604dfae9a0264c248e7b6636ab362b58eec6f0814ceabc906bb6cd39dac8b25209e38f9c8a6b9dee374be96fc5735aceff0ab758f60c9f3ed

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2d0bebd48e478c3ac1394f60daad1e0c

SHA1
2b792a4ccc256bf82e67a126974fb2e1eaa885b8

SHA256
5b512caa6a55ee28bc0365a4a0a0b35c7e0cd99a0c7a42961604d36bee54e246

SHA512
f0e2c82d226671820693b117e555bdbdf8e8c1f94c089ce7f3db602c2674bdcbafa064b7145115eac4b8eb841432638843f995458335337651c80019ec8c5c27

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4cc5e4a6f25832ae21b7387766b33ee8

SHA1
bbb414e750dc0547f622921085deb18f1032d4ad

SHA256
2cef863d6f75df3896fc9f24a59fff5f6a4a9e564d1c1e2d434e6c7633302388

SHA512
e622c9fe696adb1c59fbc742ff35632c928749d173fed679ff5505fdb541304978f24cd843ea1d4400d306ccde64ac9afbee401ac14e4199ed2c1499a1e581c1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
24017110f09f4595b371fe3bfacce530

SHA1
e02e0f69bf59e229119f364273e3af3251c90895

SHA256
3b358d5bd1306dd96d257244a6fd46dd981fbbd50db5fe50ea694b64bc0c5ace

SHA512
d8e641a8e932b4d339c1afa7b0bc5f7aa20f0948636ece66bc40f125837141982587e5fc85905913f8c862431ca31b1669c841b34191d1a6e7cf79339dfa016f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
41a5da4d3f7f34084b10b529a5d5c2be

SHA1
11f9886a27916efe6dfc8607beb7c1d495e2ef2b

SHA256
4fbb6e4c29282d81aa8802748bdb8c44ad7b3e882898838dc960320adc39a349

SHA512
b246dd15d19afd12bb38789c3b3fae9841b9fc51329cb6030ab5a43d3600c80bb46db4a5e972c6fdb4d2eb7e17cbe7a27898f76dd1a1b152873ab0e7ca7abc47

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
66e90f3c69ac8e39d62e3bca6b765c1f

SHA1
1f66af9a5137e6fcbfc3d4618a20778eaf0df46b

SHA256
d034437d23efffda1376221320c1c7f7846633cd62c20a63f3aa5ab75ef5a3ca

SHA512
f50ea0e57abad84fe0bfdb40af1b53782fcdfeaac15279b4ae38d3640bde2ed0a2005579f0fe6d1ea646d83f9361d46c0b45dd00cc68357af7ad8199f337a77b

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit