evilquest | 4176796036582daf4379c94b9a3b0dce851b174643bc7a5951ea5130d328bd85

Analysis

max time kernel
148s
max time network
151s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
28-04-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118
Size

168KB
MD5

05e9514c7ca251c7cb3364903dcdca0a
SHA1

06e688f57f0544abbfb7ea0f3d2e66caf6ab9176
SHA256

4176796036582daf4379c94b9a3b0dce851b174643bc7a5951ea5130d328bd85
SHA512

ff01e9af3243aae60b06b4d0ebcca00b3a72aefeebe0796741e80a257de867f55eb2673327369c34efe4b0e8110fd8cddfd1f72d713e26a755c4efa622dfa716
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9upWZsTwnh1V0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Users/run/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118
  2⤵
  PID:563
- /Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118
  /Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:552

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:571

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:571

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:572

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:572

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:573

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:573

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:574

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:574

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:574

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:575

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:575

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:579

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:602

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:607

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:608

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:611

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:613

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:615

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:617

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:618

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:619

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:620

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:621

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:622

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:623

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:625

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:625

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:629

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:629

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:630

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:630

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:635

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:635

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:636

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:636

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:640

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:640

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:644

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:648

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:648

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:650

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:662

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
07ff08773281ae43b287305eb9eadbf6

SHA1
239ed1b41ecda8112fc18d939de485756fe476a0

SHA256
ad0973286b36a6555a864cd71af2dda26f9feff5e5d038716c021e9f7a539a9c

SHA512
2d50dfcc40fc9a9f91ae451209d1b39ad6e1a9b1e93bfa6e61e863a873575f735d94e4a7721df82e509893449c77a90c90584ab19d56be3a6f83e45320e4a77a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2dad9a9c511addb3ab36e49e94570799

SHA1
9cae5f5177910a3e4bb7945ca7b8b269bbdba687

SHA256
851a8436fd45a30ac6bec515ea6ea98d6d7dcfb844865860e4415e48e4d83950

SHA512
3a194e1e93c12c8de2a662751f1bfb7e6e24d4ff5466b85b03b4633f845ec7aebc7fdb013ec83806b0b61e9c915ee9a343e6739543a3f7524a12b818e23ec3b7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ee8aa93d834fa7dfa49cf2f6a5bf4c9b

SHA1
0e6614e4dae98378712fb6ad0d4dfe7f1b44cecb

SHA256
d6ce52ff905b7329e6ef7eaa1d82985099d59860752654ecc183242ab9b23390

SHA512
6ff2429eaaa0763015fbd35a3b36fa1c2220bd11dd201201046c395c3e2dc52718132f44d81c904a953b5af99d649f6fdf7687f3593b6694cb0fbb4c4c5ece65

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
76e2a27ff6b589418e939c5ed8f19547

SHA1
2f26c2eeba8858927272a94bf4ebd109507d22e1

SHA256
0c4ea057afcc0967a413b1dce3dc2cea31ed685a394204024bad7f5f54ae8fef

SHA512
88f715eb4a9caae17eafe5586d9bb49c9efea2ab3abf96f600391f40e9e28fe9f90ce0a88fc204947aa62061fd5f2944223de8f4d719f893d7ea780989ba857c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2c298958ad9a5e5d8bfd2fafa1fae6bd

SHA1
a43b731da3fd10e0acd2fd9f4c9d07583fd033b7

SHA256
9666e7b9842048a42a647b3b8d19b910cdd52c1bd89708a4ce5399d7da71f00d

SHA512
bbfb1a41797ff8d866798ac06c8292b19815e2b9f0df827950057c14b5bad9371a062d06ef015f0692826fc2df513acc14bd53a8b2620d63524fc8f7a0801ab2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8c03c1177bd14912aef12c2f9001d56f

SHA1
1e5ec5b2297bd239e343269db5fff675d5afb948

SHA256
9e78f01c0a4985deb23d319307555c7016a103a2297b699ebc274d5a5f074423

SHA512
8e01a9cac2fd8d7fcc75a269c46a3360166d900e157442d3e4833d0c223fd6662d8d757f7857dbb1d4c538b2520dc08457da90012c20c17151a69a8a23050317

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
32ba9ddb0bb168a38e635c9bdb405de6

SHA1
d777a1dcf16fe7ec095d362446900703d54cf7d7

SHA256
89529a99268a4730f8229c0af320e245d51704a6e3190024e9a24e74d645690b

SHA512
117da3f1ebf5dcc27eada95e13cb5f39679f251f17fd0d7b99a8c1dddd1994467dcc3943441789cfe3ceabcb367fcd1066be37739353473a5569ad64508577bc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
badb443092c4c4d38818da95f16046c8

SHA1
fc71f86ae961e844e2f2260e68ecada50d2b6544

SHA256
da61194204e047a5ef63f95ceb4adf3d23f59bf574d917255f73a281291f7e6f

SHA512
74cb172d0d1527f92db86e9600b605e21bb937a953e03657f0ccaa0fdae32878452f8ef682bf528bda325f05e22b432c6f45a20e4aed24aacfdc83ac29b51318

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
2b8bea21432d2649abad91e1ba339e4f

SHA1
14d4987baecc59a54c0df785abde983c50ee92bc

SHA256
43eb9f50ec4664da221d07deeddf406d9ad82973ef02725ddc416bbb3179b681

SHA512
edae9fa9a6075d19bc755ca9f0f60af5eb5062246ac9e0ea379ec292e747985d9025e325256b04962ac415e408793e4fa2e29c456a67dd00b914361e72a072e8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f993b135514e479370bd3292f3f32c30

SHA1
24f82a3cbefd430ce2546d6437dcd9aca832ca2d

SHA256
bb83013e78e90df8ea3a4a48fe4c882920804481a33cc269356382ad3ff3b1e1

SHA512
b4fe8347d5626ae7687cd88d066a0ab0d37e6e130f4b3e6578e4f9c939eaa03941c4c5af78d87dc1087b59d5d0a59ee557d3c0a35b6d77a0b9e91b71b46e9a3f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
333a2d4993d514094b9226fd3bcb934c

SHA1
667b1b787b04fcc8769222a4c8799aba638b4924

SHA256
9aba4f146ca52716bfef14d473a0bb144eed5ccd6903c4efb03778544c6dccf1

SHA512
6af20421d277fb33b38beef1588c889f3d7918edc2dea2a6aa1299a3d22ff3aaa8dd40be7509505e9a660334e8ff426c450ed9181fa5420e291349d452de02db

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d06253b628c9cf91b8833266c82c1bce

SHA1
3e500ad01894d60c5865d318b78acc80a1efc97e

SHA256
230e70fbce651d5482ccd293f5611858444ed13b044420d0106c1b3cc0e08aa7

SHA512
8268b87578b3201f29e7a89c854e8ff00c2cd232fc9cb8cb4a5424e8bed8e30683bf98bb376020c2f6562524e5afd8a607753b03b002e9831a5c375e381f1b2d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5efb2539d6bbe61568bc407e24170e81

SHA1
da523c06a5e4c2585a8408f75f8d38f78b2aa768

SHA256
f4e4d787420ce23ea81c4bc195cabcda10c19df297e3d3800de90bf64bd71e21

SHA512
91c11d122aa3c3f960aed15c2092045b0de126528f2970cca5ee9c648c423851e5098c759d885ec1cf5ed86255eba598a7528e17bacf21988fa4cb884f8520d0

Download Submit
/Users/run/05e9514c7ca251c7cb3364903dcdca0a_JaffaCakes118

Filesize
168KB

MD5
06e90ee06e166d656b41158e0b4b2e0d

SHA1
8c9e81354885da8c3a89ba31593fdfc21d632451

SHA256
d861df3f9b7157fa33c05cd47ff95206edb79eca943e39eb738bcc362198f3fc

SHA512
8038642246d2b20eeae5dcf2490059368040ee54d0fb8cb25b469ac1300d1a3aa5cbb0603170173a1a7ca95621cb8150b1591be814be987fb2afd61ea35ab8fe

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
35efaeb1613688abd744d8678ea39db9

SHA1
10e4343463f3df56c33646b4b6edb5918124997e

SHA256
13a2ed9e8b1e3850b6854599fe4c1deec27b99db346c00e076f45b49388521b1

SHA512
b9f051a3019f6a5663983d82717cd63b5f091e19565193216c2384e09eff48f8e058a860b55f4d97836edc51e7b13d6e80be1354a54982e614f9dbdb271b1098

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
73a28e3513e51b551a464db2a9c3dea3

SHA1
3728ff9a6bb38c56558b32386588059d3876dd7d

SHA256
829213a048e68f7d414551d7ded315a2f9d733fae68ad20fe14b181db634dd43

SHA512
d314339830bd751e60ce386d22f22e926e5b2f79d17f0115353d4340f2a8c6c5e9c4d9a4e4d6953d052ac874141fb383e2d951121088f68a67b533404c405165

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a92940498e253da36f1f3eaa218261b4

SHA1
2ac158379ad183937984ee464ef4821cd600fe7d

SHA256
7c572e87f0553802403039f1d04c8d4ae87b2a3ffe9a72c8d983183990680142

SHA512
e2bad09e41203c23c8d7c2b752a7d6f09c736a49ea2e7e1bd81c1bdbe8f4f1179239767f53105231c4c8c7fdc750471e38b1e21fe5c4d9db30030a5a9fbf563f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f2d3e8118816afc9d59242492aa6b440

SHA1
f784d3a7a90188b0b8a5f78a8736d24ff635ead3

SHA256
b0bf46d685e313efd6fe7f94d46b55b6ea6e8312166cf9cbc6ed9f2923c61749

SHA512
056fc5b1a44144842634bc6585508d094215c1144584fe12ff71a5baf69c33afd006f4a7ac201404a818cad3259114bade297e757e41e4e3f3eb7e77271e9c5d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1ddf765dcba52f964cedb558c59546c2

SHA1
b239569caad11d257c584cd15773cf2d622fa762

SHA256
eb60f3088e3a7708f41147766bfb3a8ecaf6128e28966f5cceb90509e3f2b227

SHA512
5531a7b9768ff4d48b591022162303d894e4cb5787d8c2011a6b8a3d4daf3a42e1ccdba0f9f94ee231ae6fdd56980297e1253b5d78f5eaf02c6af54bb9567082

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
46e1d6d38a234d08ab9b1d2ee7012333

SHA1
50df215261739b30cbf15a8f9463e3b33be835c0

SHA256
75688006519febce3c90e0d937e5ae60332e19c7810f83ee3f1a4b9b40c9e773

SHA512
5a0acc1e19a2b94ffe2ccdf2ca1d40d8506de0678e90fd2aedc7599b0ee286327c4e2f7976404623aabec6b3d258cb01cc9594abc1baf32db72fdd07b58816d0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
041dd906f365eb5128291f78fe7010d0

SHA1
ddd456e61e864c38efac05c7623b51439cc5f758

SHA256
1d8b0ce5826a2e5e2b81e92d4f80178d125c185100a76c8afc9a0d831b934af4

SHA512
f39bbfa73561088c76b40d552b3374448b58261d93edaa078182057b84f115688328e2e3379a5ae181ff00b2d7ce7e17e71b1b5d7f7830926e40f9e14bf076f3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
94b9070480b659db197d8a950377a3a3

SHA1
2e3572a5f06f0f2b310badef45a76e819bce0923

SHA256
489c13a8e5f3582ac206dcd80cd724b19f2045625ca2e4c02e26d3b2f11528cc

SHA512
d1f75dee353041181433e651694014c2ad684c8e58f538a41975adaf00b33f01089ad2c02f13f3bf05a5dcb1bdfbd6ce8c6275d986e23decb05036cdcfb8e2b9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2a4a71e8439dadc1d3f78b2030bd5edb

SHA1
359fceed59c64a98647b29ea0c9972e86f8aa393

SHA256
4da75233743382a9942884c84d3158596a85d2b006b3a60b1b8b37eb68fe0296

SHA512
301fc9844728034c5db4e1d90e64cc7eff951cf427f0e23ed0fb1ed92cabf1ad1d3577490d0b2a8029d1bed09000958be3caa784a40681509cf9d7f72f6a80ab

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3cb0b535581cb8c51c51dc3c902b9d06

SHA1
9c194c670d608b753b1752f9e919094ba42d7fe2

SHA256
24b3452ca5bbea351bb03fa9e1f97d44f53f39bf212280ac80b1d82c5b27c991

SHA512
6d3fbc8f458ec43895717b9bcf5ae5100194a35d4d7163d1cd2939893902ebcc3ba094807406e4eb40dde7f2a02042f901ec66e06e1880d947e21555d3b3c84c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
47161e2141e0ece1cfa1f01e572e0701

SHA1
5f611b333804ecff5c6b8e6748433ce8ff7404ee

SHA256
11e81721f63367e334ffb82fb19d3f97d890a42ee9a6acf6e1f3879187b5d4a8

SHA512
d72a0237ef621c9c0fbbcc67fc5d59b79075060ed9ab60e1f0226f3aa8396ee12ddcd5273bc6bbdfc513ec5cbaca01722a96433a13c909f191610118fa00dd72

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
02508417dce679011952185f5c0b105e

SHA1
823e40e246919de77acce85970fe2f82daf0c6d2

SHA256
afa313938f8385f44d7b544ff5338ce19d4717bfcd80e953005e105443ec6ccc

SHA512
a28613ce65163b095012e61db9aa14669ebf734307f9227d34c67ecbe19c6a5764f4e611571555996569cb959bf5de245095741e291d54f57b0827cf52e85481

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1adc631e254b17bbf888269eb8bfdf37

SHA1
fdfd93d363181f66f21d79ccf76cefeb9bd21e8b

SHA256
18433ff46c07ecb6d79a6a3c6b3367aa17c36e736d9f790bbf04e5d155989f3e

SHA512
37e0e2fc46f2fcdca7ab5dfdad8aea99497fcd54e6801a65b59a14fd00d953f86dd91be9b42ad9d82d430ffa4539de0615d13659bb3df955911ec79de2274895

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
48aef86a3be3f7964fb24a00a9ac1230

SHA1
e394da82d811a8fc90f2177bb68c6d2ef7a4e3ac

SHA256
db7ec8ff4d7b1e7b7dc9f61b5fab8ba223e49590b04e254daaaeb24f839553ad

SHA512
6b5e5f709fa4d17579af0560a8800d40fbb10c7bd0cc741b7fbfa18a1ed7061505dda15186dc76e437f0f41a1f82b5205ebcaaa202d99106a7f24173577ccb7a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ae81e4afa3777509409093a0fc00051d

SHA1
46685595067312dff968ec7d523b6252ff2872cd

SHA256
94f211d77d07bbbd1c9a94e7e92ed14c7a60433fd4e3e00758845773b0535897

SHA512
d04159734b34a93ea9cdc4307f422cd3ecf60def9a7cf359b392a69d5bb17c372cb5b34fadb658dc114c8ff2918fd71cefdcacd4b5a8533a3eab36c89435b0a9

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit