evilquest | 0147be463b38338fb60ae4709a39d267dcd90f480596d7dfa29d87e63b3d3c5c

Analysis

max time kernel
148s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0874e3150817385b7d554f3505d864c3_JaffaCakes118
Size

168KB
MD5

0874e3150817385b7d554f3505d864c3
SHA1

e7afd8637be2346d3bf4e5248b908fea5bdbf925
SHA256

0147be463b38338fb60ae4709a39d267dcd90f480596d7dfa29d87e63b3d3c5c
SHA512

aac745103f0f0230ea3d4e10cf2a1573ea6bd364cc4e4f43f3070e71d8dbce009eb5ef09c573a3c1d635441c3e136cd95d53eff39b38ea545dd849901200bc6b
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9r9d0:5SeOQdaZNxtk8cqhSxvHY9r9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008ae02-3.dat	family_evilquest
behavioral1/files/0x000000030008ae02-9.dat	family_evilquest
behavioral1/files/0x000000030008ae02-16.dat	family_evilquest
behavioral1/files/0x000000030008ae02-24.dat	family_evilquest
behavioral1/files/0x000000030008ae02-30.dat	family_evilquest
behavioral1/files/0x000000030008ae02-35.dat	family_evilquest
behavioral1/files/0x000000030008ae02-40.dat	family_evilquest
behavioral1/files/0x000000030008ae02-45.dat	family_evilquest
behavioral1/files/0x000000030008ae02-50.dat	family_evilquest
behavioral1/files/0x000000030008ae02-55.dat	family_evilquest
behavioral1/files/0x000000030008ae02-60.dat	family_evilquest
behavioral1/files/0x000000030008ae02-66.dat	family_evilquest
behavioral1/files/0x000000030008ae02-70.dat	family_evilquest
behavioral1/files/0x000000030008ae02-75.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118\""
1⤵
PID:565

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118\""
1⤵
PID:565

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118
1⤵
PID:565
- /bin/zsh
  /bin/zsh -c /Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118
  2⤵
  PID:567
- /Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118
  /Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118
  2⤵
  PID:567

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:590

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:590

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:591

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:591

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:592

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:594

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:594

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:597

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:597

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:598

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:602

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:605

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:607

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:608

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:609

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:609

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:612

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:616

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:617

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:621

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:621

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:623

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:625

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:629

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:631

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:631

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:635

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:636

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:640

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:650

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:656

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:673

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:676

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:676

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:677

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d93ace178b1ea6a3edb7622bc24363e7

SHA1
4e3acf74958d42bdde1e9092bfac432b92466697

SHA256
56e3df0f48d27c8bf6cbfa938be8c5fb15b22f741be5a53c7d1cca5ef2d4e4af

SHA512
b1e0ab19a1f2b67c4f96ff61eaae30e54f58bd667a9702d461af19bc619172827bed9e1835132ecf0ab04814be035b73ef55ce4b34b3852ecab98e37c6786a58

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ac5105ba4f0b16952bac8ea6f258ac50

SHA1
854bfa00ae7ec94af2763f43c568e6f6effff283

SHA256
140d7368d2d3241699f5f4aef0a5a5a33887a9f5d732dc393afa969b800bcfe8

SHA512
599460d2470fb204f2c743ef512d7c7b453252417e427b0ee3f86a6de7167f8bb050ecfd428b38f5fd27325d030cc90b9e0f2092cb48534ffe1fdd0700c772c6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f189fc0ff24b006275f584c146a436ae

SHA1
447e1e9f7b435fc3953048910033ab2c19ed36c8

SHA256
f88ae25768cdb49ae62109dee30aa13e7b1d464397061d65b8025ee3be7279f5

SHA512
4fa96127b94edde7ab80459fc1d8e84be1a1f2d86f53134028a22fa142f5f099e34ccd6ecfefb683b98a33c05e1cf5422de69056c2fb17cbf8fa882fc5223ab2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b4added69aa1ba46c4aead1c9fcadd23

SHA1
7bc782152f3d3f27ede82182f07fa8f0f010500b

SHA256
045e375a605a56dde094d60dc9cf96c3162c39e33043a579195d20eac8ae3617

SHA512
63fb72aff5b785b1d09dff7431261610887b43f1996831a881f426702461da8cfa6a4b973af8fcff857196db81b0f8053aabc84e875782c9c9b5bf6f11972ffc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6d4531d80ca56b1e1a8fb7c14b45eccf

SHA1
7ace9bbd758bf3aa51014f98fbe1f92646b9ac63

SHA256
88da30ad734711bfc62e43844906304d7d9f432a388c0d1efd464f8e0494fef2

SHA512
19cfce5d3928c32e7a80c173f053e5ead39de62fab3b175f39175e995cbf86946c6fe231ae9743f0f37695f14e934282a77081542d7d7adfa50f5b4133441d6b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ce50e5122882aa218a5bdc6ea33ed5e2

SHA1
e58de4696e76c24cb8012e41087db9daeb6e8bb8

SHA256
ce6099fec1189db22ba68490591c7d43e5f98ab40626a6d938b231469a4a4f50

SHA512
3d794571ee78b6fcd1a273973c49da7a5f90441f1e27c04cefcad64217ad37c14e7c2e5673db59d5bd7ec14f9d5f7484c02b69ca1d68a7732fb1ff1e98fa56d2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0375d3dcea6b20f82a60596dad693c08

SHA1
0d49d09f77f1266f4312e88cef23361a351cb05f

SHA256
e6f3aba8a8023d5ed0f942c6f3c6662fce3e83228387eaee0026a2816eb9bcae

SHA512
674ae387dbd415a7994d71b57e3aca138f273323268ab8fbba18c64c106380c5dfe06e5d78a4372318de5b53aed48c16433109e7abf446c2331a452803311a9c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9bc57a6054306272b2638d95c02922ef

SHA1
922e6e1a9307b6e0412c0fbf27e0c61fed2bd84c

SHA256
1eb5b33a468bb462d8515d4363c28aae72ec942d0393f93c23ab4ee39eef7738

SHA512
5c80954d5c9d8bdd8086f2fe21bb3787fdd0ea2c28bd9c690ef5ac65bbdfa78480944de9c2c666451e30bb8641c2668a87c5887408a77cdc11444b2241235d95

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
841b62775da82a2d2a6f0b09e74a3ab2

SHA1
a0f903a316befd5de1ee5af69d17f880c1628a32

SHA256
199a4b02c57201a6461c00f78cd85298806ca33baa039794374c8a41f7e8343c

SHA512
4792eb49c764ff462b0e0685eb1f4bce20001cc70819c04853d0fae3802b5ff73f4ed31f3b96747d7569766927b568abadf4308cae857cfe18cf176d5ae7dafa

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6f971259a9b32e196cbd6ea5212368ee

SHA1
ed498cd83fee12c1417275124b95739335c15069

SHA256
2b21271127c39b3b6fad234430b19a3f844cac0110ab71576f8e697210386ff4

SHA512
b174f312b43d8a39d833ea33f1b0a31705f9e667689d0d7e3bb1375d29ba645d03005a7eca82d98b21efc81b4b11be166d30718835ed555117a6ade0c0cd8951

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cd479e0a56ebd1229db0ee0bbcc616a4

SHA1
92186b1a3c6aaef0ca069e881a1687d7dde30927

SHA256
2ca79387476f95a1b9e3241fbb520d9ddd893d44f22af7e1443e365526ef951a

SHA512
748d6e32626722f80dbd5660b2d4161783c267355468a00195dc7fff2e908edf2f45b6fac142a753e6d06a96863d618a1bce4c2b0c3f8d411d308ab1b793f1ec

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b66954b889f1dad4ec34d172d9551207

SHA1
f08a186e87203a21095ac08429f6a47735cee264

SHA256
a7ef77c5a8dcee7fa0c502fecce02b678c5d500f472fb730917872d05d534cd2

SHA512
d0550c600d2941ed76dbe95237d770dcaa32486e5db85267bacd8affed05a8b8d600e97f4bc472d933cbeb81d4a1e09b9a774faeee65af6f35af7f1da8c76fa1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
73e1f19838b5b7dadba2fad49f2e31c5

SHA1
7a73809a85dca51921ca75203e083d0060ee1e0f

SHA256
e6518096d765f5dc62ca2533289a47a52ca7e00fcf8ac37dd422ea0d72d51bd0

SHA512
5775ea04851c2ba01d3429835ea9a603bb66ff1e50a7ab924419b938212b4385109d82598e21329c986008dca78c91b3d3cbc8c69ad742f11cc4d7dddeab5f8a

Download Submit
/Users/run/0874e3150817385b7d554f3505d864c3_JaffaCakes118

Filesize
168KB

MD5
450b357e0818804d0ff1a93468126908

SHA1
4f779271e340a4846b0658b1e247fbeafa0389f3

SHA256
0d1c3fc4dc68f1d6a4e04e47d6c2ee1ac12e12a63e2765654687a264a76a80cd

SHA512
e66fbc817ab68eb3bf499f3bcc01dc8d85eb01565eba354f81297217a2e8439bcacc9bedaee61182b4adf90affab53e28dd5c6b7dc58d2c280e626a71fcbda16

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
31907eb11f90e699c700dd11fb528109

SHA1
80aa2be3edb6462c128f6c37663b323c207244d7

SHA256
33f6b373eb7624c3d43c740e8075550d7ea357da67584141e4c2520cc36b03bf

SHA512
cc86e84581b160f644da5ef4e6f2fa30a734898e23056706094eac86d5034c769908d585f6d581b2f67e82e9a49ddbcfeda96ad6cea3b05750f6d7ffcf05e508

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
74a5007c306eb4bff206138fb7bb7971

SHA1
3a226e6bc67349558737789d43968d8f8827acea

SHA256
ce712cd4db93b78403820185bdc372ccdbda7229a42a0cc06f909d3042e4a48e

SHA512
a9875d8172aab4b8e3c9ae42e2a02e92c1566464de0366a46b4563b1c8e3b0d893b0168ad2be66fa0a59128b4cf1b1ecc5179171cdb4e90ed0217c3bd2b0e3e6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f179ced0ddc12465556379e5a4448131

SHA1
0f4d5d7323baed2c4f53eb8df6f23037c1d9ef8a

SHA256
cbdbf8e03cc4a5bb28fed2912905045da1e5f5da1bfbeb92929f2b7d9f4e69f7

SHA512
fa017933def374a3098a172a8fb79f02d3d9fad177d9c6b5fcc6bc6b39b4b8b9a1444465ba2d45bf5b6a6660b6be8c52987366dcc65006377ee15ccefbd61947

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
675ed20cdc6693fa74e0631d918c76ba

SHA1
67f9e55b2c80090a3ef30309033492e496ddeffb

SHA256
9e350b1348aff5845bb9ed0ba2ec71e1648b3b0ede48284fb16c74a13f5ef0b3

SHA512
c2540a930aeea42e6f2b18c5c2e1f6e4ed9269bcb9e9583b0b834d1f4e959db81240227fe5212f34a80fa9216816caa9526ef1159a03c4664895bdcfdc92dbd7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1a00cfc8105dafee25098865a89f8310

SHA1
51394f9be816ebb314d726dc5a3a67282d536b4e

SHA256
a16f98f5a708e5f5ac2446284a2873446e3cf988a832d4de96fd9cb07efe49d9

SHA512
ecb157cc1ffc5816ffb8d4dd9022ab701a163729d38686606563951b5ae6370497baf4d7a344b96ebbe386044c73ba4748975101f20bbab4108b3243a97ca26f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
132ae62d2e071478edbf04194cb3fa61

SHA1
7a2d99b9d5856f1852984e6dbc2cce65922d2105

SHA256
a8fcec7391a3eb03ac471f812bb9cab406ffad21de2e91065ab3d43cdd0a756f

SHA512
fefb17cd180e6a2e135acee8cbeda6c8b0fee63ee30409db4f5d65737037655173e326fdd087364b6640f2d0f8f599940b5ac0c66c9849c29ed4a87515b39553

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8cb0833acf20b3543dc49d37c719413d

SHA1
267d6eda63f7dad76dbc020d181e8b5364a507d0

SHA256
8dbb75f52ad9c59e377855ac1cceeee6ac66b2697bd68387f4f439668e9b5616

SHA512
cace31b694a928282d42ab54e77aa75fe3b6bbfc7438e5e3c7c132899bb2dba772893cdf368ab0bef8fcb38c526a0e0daa9ec00fdfc35983c79f8008a4bfdcbe

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
40c0327ae0899d6607cdc0f9759462bc

SHA1
d84fbe044d296cdcea870bf0e7638adfc1a56e66

SHA256
b8273a3c0e2ae8cdb8d666e71dedbcf67b39c827820784776c57367a7802c56b

SHA512
92e8ac0e95bfb7a07c85fcc3652f2e85883482ab6e2bc7b734efb1e1f5bec375ae4dbacc32f981987811e8e7a5e3ff658b536b623a26d3282eb033687eb5356d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
101cc153520f21c856809b6d268651be

SHA1
ae6a0c90ed18c1ade80a0c4c8253deab4843c5d5

SHA256
f09e3c6b0c4784694ccaf3f92f5394958337a2b00a117ee644f9909e96448d47

SHA512
eb3095042df3931a7470c5b83d5e5649b954d028815a1c4ba4cb7a8428454bf20a3091a37963de61e311b7c0282ebfd30324751a5ee5dc1f451eeb3a622e94b7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
63e624e4a307d78ee2f297a58bcf2649

SHA1
710f266a8c8baa9af6f47f89190de0f9417df774

SHA256
2a937eeb38b8c3a8038a6b30007940fc005af059e41112456f555791cb3f5637

SHA512
00124e4fc2e63b6cff3475684475bf26fda6b861270895ab306b5c59e933de65a0d1b917843a37a6040722c057cf7803ccee62a43834acc107f0f1848821eb0e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
18d6ee9867e905b976785aaeaf9ae366

SHA1
be5884d3419f349e446de65085b80c2930a45226

SHA256
ed43990c8f7b0060da2cfb6aea75b7facf43cbc46a176b8ff580cf3ee321d88e

SHA512
76a73b54dd14168c43e46a1e4b9727f1465c8bf744d4843d39145064a2fc2f37f0dadc42ff74d011b1b3fc85ef78a50a1fb05f8a6cdf030f8a1b1606c73e1b27

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8a9e5bc78827815aa8b1d340e2cefa90

SHA1
7f166f6443d8078f7c867fa47a367954e42aadad

SHA256
73bf13f032f1a80955d321af5f6f91dda42d114b57e257c5d39b01f50b200769

SHA512
ef584804af8bc5a50709de737826ee54a197329e9274f859b5b8919b55c88636e6ff1ef61bad6fc07048cdbf72c87e9e2502dceadf4630f7787c951132c42994

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0632cf7da21a36aaa6242677a8a04517

SHA1
9c0469cfe92b86a5c32b65ab7f6b42cc84587751

SHA256
a7ba8e257e00f1ac7c8d5d2bcc0c7a4b118409e8c347557fcd8fa63f69fed660

SHA512
a0fa7e339a36d7f823a0e38c416331cdceffc759b7b4b134d187818172115ac84034a84b26ba87d401d503919da2af8fbffc554fe98c0cc1779924327f3a6fab

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
83ecf77a9efbbfc7a379148370bc35a9

SHA1
66314b9e5abba711ae4c486726d4a2c5b3bb9811

SHA256
50214aea8226709f25b050dcd844ffafa578fbae3139f1a594ab53d4128dbe32

SHA512
2d7f5e01ce87cd89f6ba837b59ac9bad1682d4715fbd76b6b1bdd85b1938fdce4ed73afaf10082e9d747d970d3e6d8df1f944c900e4fcca5b719502b31672636

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4e9ec906ea1b8a81e4b98eeba7077ce8

SHA1
dd4fcbc96f4eacf9f33162854a3cd97afd6fee5b

SHA256
8211870787bc4adfa34f209cd1f2f32c5f615b2c57d06ff7b03b97f433879ba0

SHA512
fb7792b09425c83e0512e18661c25451f2b61630aa665d05812902fb53f9c67b14ac2b87b51624311a401d0c96d3749f331d1073414612e08cf86f03bf8b840e

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit