evilquest | 62f9e0090b1085fe4d76fca4938b211a0b096aaa9c844a28cdb47c3bc1a41235

Analysis

max time kernel
148s
max time network
148s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118
Size

168KB
MD5

069b47a14c8c6bb8b5a1e03cdaeef6c6
SHA1

38100a77cdb19069cfa60cdcdedb7d1321737c92
SHA256

62f9e0090b1085fe4d76fca4938b211a0b096aaa9c844a28cdb47c3bc1a41235
SHA512

06732b97f4834942ba7e0388037d3c1683384b5ffafa3b2a13a2e6904160691d74de734bc31c99e8cd3f282685cf185375a18d29f2f62a98e9bb9ab297f06cd1
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9KEcUnz0:5SeOQdaZNxtk8cqhSxvHY9K

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adff-3.dat	family_evilquest
behavioral1/files/0x000000030008adff-6.dat	family_evilquest
behavioral1/files/0x000000030008adff-17.dat	family_evilquest
behavioral1/files/0x000000030008adff-23.dat	family_evilquest
behavioral1/files/0x000000030008adff-30.dat	family_evilquest
behavioral1/files/0x000000030008adff-35.dat	family_evilquest
behavioral1/files/0x000000030008adff-40.dat	family_evilquest
behavioral1/files/0x000000030008adff-45.dat	family_evilquest
behavioral1/files/0x000000030008adff-50.dat	family_evilquest
behavioral1/files/0x000000030008adff-55.dat	family_evilquest
behavioral1/files/0x000000030008adff-60.dat	family_evilquest
behavioral1/files/0x000000030008adff-65.dat	family_evilquest
behavioral1/files/0x000000030008adff-70.dat	family_evilquest
behavioral1/files/0x000000030008adff-75.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118\""
1⤵
PID:564

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118\""
1⤵
PID:564

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118
1⤵
PID:564
- /bin/zsh
  /bin/zsh -c /Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118
  2⤵
  PID:567
- /Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118
  /Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118
  2⤵
  PID:567

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:591

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:596

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:598

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:601

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:603

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:603

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:609

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:609

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:618

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:619

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:620

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:622

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:622

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:623

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:623

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:626

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:627

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:628

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:629

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:630

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:631

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:633

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:635

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:639

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:650

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:653

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:653

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:654

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:658

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:675

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7f6c511ca62c0b97522ee4740c03d379

SHA1
50fb08531ef19e96c4192bf713a86fa24b91b15d

SHA256
438997ee95f8a91320d47a8a00ca3b3e61b06ef924f77497201968eabf1a3d43

SHA512
4c7e0d8390920f6f055dea5ce7ef5b3c8c07e6437d30161b2484e23964c10bf1f2fa91427d41d11e7623ba2d1326f677b9f1ffbd9f343953baaaf9dd39d2686d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e9c66c563900502c8a69dab753a639f8

SHA1
5be791038abe9ba090d8c12cddec2d1415f790cd

SHA256
8f4f4dae858305a3953ea0e1f173f04c4e88ee0012e88da1116ba014ad549b69

SHA512
2df71346b820946c400aa4e82e39fc30ece762dccbb7c0e63eac5c9b57734a22fdd01cf03d8f1649769404b26592bdaa96544d158e065b6de74090435fac8abd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
af2d780bb6012730c0dfeb103571e744

SHA1
e9847b5234a8736cdf073a9a54c16579c0600c81

SHA256
060cffb69800a6047f7af85e1e9608f867242b00e39cbd5fba7347fa1a90393e

SHA512
6bbc63f022dd9e23ff5411857d0f086106b9717b88e5ce358ded9a45caa9f0ad4e50dd6c0054ec7d0d75cc1569672d0a7aaeec7e2dd4c4ca67724b8c12795fe8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4b4fc17ffeb7ad9c2429a28fbc7a1ee0

SHA1
6dc41bef67ea53526c343433c523c1df226ba273

SHA256
c54ea86b0cb53fa2e268d0c3a02d7a7855a7b3a98162d05d2e0a0b1d66d2e835

SHA512
027d0fe60bffc87c8cdb0029b43f337013111b3ded3e7648b0450a726dfcb6a86dba114a50e14219c04057135b410770db589eb1309a962395070c5e257ba06a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b5d04e89e66a60998bb6e7a2e066d09f

SHA1
8b2a99d3cd9d4789b90d230d1dc5de8b0ec0c3e6

SHA256
5a57e5775ffb18ca1bf331ff4683f7941545f09d930f186c9c84f126ba70f3bb

SHA512
d6b35352c11a8ecbb65fdb86aca51ac155fdc4b815a6232cca97d50ca86060590a77847eb8bba18e59267e5318cf042bec6bf8c6afb6eac6faefd1b9fadad955

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
81eb466106df8cf0761952016948fa67

SHA1
9c3e2ed67634753a86dd058b3b3656b696744037

SHA256
f610c511f5136bc29baeeeff7ad9dd98f8340cd754c8dc7b04aa67d4aa26b65b

SHA512
746d85e15022afacf44248459971e187d2f0e8b2e5335709d94b183bc67f508c914b0d7190acad269a56235fb82fd043e7a1f35b6e0ff5cad70faae484c26741

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
065073f99a77bfd71c6666f3a48d9dca

SHA1
7fe5ead47427efb62bfb94ecb9f6289b8ed96e8d

SHA256
1e2470c7ad81fe1bebae55763352a8ee99ffb7e94bd87384274e01751f890fc8

SHA512
c86e6580fb25046d261d01f567107c737ee70d8f25d5c09b215f48fce81674c1bb28e6b0bd18dba9d7bab20e1f55e95f6881c44271e421482c1fe82bfad3d82e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
37ca775fba9e1d66d5752f3bac29074d

SHA1
39d42006285dba21203e6c9204f9c2306b5f623a

SHA256
4f38cdad2da196badaccfec423a79f1e4792fe1bf0a9f9afddcd2f37a7a5e7c3

SHA512
5e9e1b05f20282374b0c0be022afb24384252f9ab48344e768a3c031ccbff1ec27851e27ddf310aefd9b9234d23930e377181fa902c35c9a377899073a79a0c0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
468b40f9428f26177115a7e4d59a73ea

SHA1
ae90aba14d609e0fa6e12554b0d3ecd85cc06c46

SHA256
963404687b6a6dfb0f93ba0eeae0c8bfb29a52ce744a66ea5efe60cbc8411a08

SHA512
465d4628a4f9e95492eea96f26037be8537f041d63c3a65ac36390e3b575e48c0579efaf39606554cc331011314f2f836e01451cf09e3aa955c49db53d2039f7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
00a8d9fc6221f97eac0b430cdb83daea

SHA1
833d8497cc5484a4dfe5fd4e06851520d7175ba2

SHA256
4a984c17563eca782ebc188b62c67f0a32a03068916e998aa9db9c76f77a2d3e

SHA512
19a2977a277c2cbbef95526d560c9533ff62f9aea37e51752ffb2595454232bc9cd989e1106fda72bc7a7e94ffd95bc2822cd6ed2b39aa0b1407afed0780ecfb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b450121423e81b8ddc2be2bc0001c426

SHA1
e7dd882aedcaaef7d4af684546fdc3cffdfd8a0c

SHA256
32cfb4a279e1511d55ce7c5201b929bd78b1ed4c3497c912f0d29d7b12dd9f3a

SHA512
f11d3422dc697765f97f4adf6088c29be64fe8ed4ed8e28b2ab38e583e2e0a8e6e0bf42f7501b1f50df79ea312a89e2196396169a14e986b6b02ff097c761600

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
641a87437a564a99f3d1bd34bcce6a1d

SHA1
a459fe56e39656b846d80ca16e78725184d00c5f

SHA256
c1b8c268706f01830dbfe6b1dd0fce1aa9cfd553c2cf34a0da5a9661291bb65c

SHA512
1383c263c5993581c0dbfc746a7f7849d4f7ba772a04328ab149538b6af57e8a9b28243f3f8ba60bc56428a4d2a797bd37904131f834c8d69af4d787149653bf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c83683589827df9dad032986f27dd55b

SHA1
a4405703629bd74b7409bd39d9c94e82b3d16c67

SHA256
9244ce9a08270f82ae140ef415494d9b74e4293812ec8422132f8be49a738793

SHA512
bdfaefa31407bcd2b3e606cf1bd632d2c75e4fedb5e85f320591a185de31d137ae31f0269f8cd13bcd9bdb566c409371743529984ea09c84e85c2c2e0b44ff31

Download Submit
/Users/run/069b47a14c8c6bb8b5a1e03cdaeef6c6_JaffaCakes118

Filesize
168KB

MD5
d2aabb66a3e4267d741b5c73baaa89b8

SHA1
6cfd5d9869093e3e6d728848b9b5e417bc11fcc8

SHA256
100cc8d50a9e69ba7e9bad69f92774978d61d6ffe22d84f099d5ed5b565588ac

SHA512
aed869aea08ba3a743b8f38c1808078b8d810253b955c86a36fc3559840fe217ac8fbc114f1f087f6bf04121eaa7cad45a276f12b0365fcf1d5dca256e9fc585

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
e5ba8bde561d61536e4dd4efb1329171

SHA1
59961f618d7e8785a77d720466de0e44eab6ca8b

SHA256
e6feb1fa04a753920ec25b3c0e46b0bec55f3a2580589d9a04da4c52a2e3fead

SHA512
5838fa872013fc7de032995fbde9d529f6aa7797309b03038da8bd9448608d4e04d462ee4319bd9a2cb13fea238b4908eef48524a31bff9447229a1ea33c4957

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0392203a8ab95fc1e4853502876fa3a2

SHA1
75330274d77b24c9e2955580549c5861155abdeb

SHA256
38aa6b26005ec96c8089dabf7dd07f6917ce01e9ced49c4bdccd6b9ad1a55718

SHA512
4e93852702a5a9b8d10b827867df9ffd1d1cc6bc745505675a244358539c905f054e9db5c2e7e99fdb67a6103b5fdf5c74d83610223514969c32c2546599e359

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
493b7efb905cf057d313feddff986e97

SHA1
58a522ebe3a71fcd74efc79b5914ae681c06c261

SHA256
1f362e26465a84d67055b88984220f91b23c311e8d69772f6beca516990e05ad

SHA512
68fb793ada3aa2711d939c964fdcd25d71026b65c5b8716f48e42b25e24354fb9e8594cf10fe083b793dc2fa503b2f3490d1c810708bb82a64b81b85e0cea6c3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e16608b994bf1347447de282ff9a8333

SHA1
30359190ea5508b9532e378a1f1f79aef24846a1

SHA256
c10fccc002253eaec7d55310a70a32741523e88b8f001d7aabc0f68ce9b88b41

SHA512
2202d9bffe66e403de9dc10634e1cc7b7e9b67a9fd9c62a2d5d0d8054b0ae915906fc7ecdaf89f51b774876158e817583432747a0a2ad8d4a15bb5b6067a2f32

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f808e2f86e630e593ee8101426b03dd2

SHA1
23fcbd601cb24532c59902949e2cce34a9e85d07

SHA256
768167373208f807ba8a924ba60ae4d2114711140c759f5eea82fa413c26f3ce

SHA512
527bb36db44c5f46b764ccf1b7d7e422f4babc7f942d5c800b8ed0076698f88e1190cfe5833c7d7df15465d0ac3601949c2fa84379d9eecabb36033698dcc6c8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ba66bac40a7c3826af3846328433dc3e

SHA1
048a785245a7252b846b1d192af5c104c3ad76e6

SHA256
6d983e47bea2c47aa57603d371f73dab26acfe0746a1ae12c3880f11cfa060e1

SHA512
d208b46e58adc0d48081823f251ffa041ea28cc9db39d65b144dc5e26880f768213654deb846599d33b6502ce9bad4e0b4d1d93cf5b85c467e911a7b2e2e831a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
320fa0421fc35884d879ba17ee91e034

SHA1
63dfa70e5a3530d911db4587338f0902b367685c

SHA256
5c4d8ba8fb7c60d44a1722bb0cc22e9a64aabe2b56d77bad657dcc18ad79daf6

SHA512
4c52ff83a928cc6c7310c68e11d0ef1dd330df870f8704f863f997f5bc1b31c049c0f8e85b9d09a21593889f8432b38dd402753b2b15ca23911c4389cd98b62f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5f926407f162f52dfca8aad9c9188b8b

SHA1
377723dc52aea399b87f06020cc089ee7945bc76

SHA256
e61c6c01d7efe2104a31f4475a440bf91c297a88b8e42121e38b1503445e5805

SHA512
11da94409d192e192cc2a521fc83fe99695c2ad8d04e7f9357fe41037da576f14591ca0b255571f5fb025a198632529ef79685a672c0699634ac86de205adbb0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2579519af0928f10129118ee0ca83c1f

SHA1
8913e9d53108b4d84a674a732da1d6778de9d944

SHA256
71db4610d4cd9bb890f4bf5963fb9d9957cf92c79e4ba5ec63a03fe045be7c50

SHA512
151f2263fd1912839ef7644130323a96c8eba4027e69cd5688d197a7a0fbb2410c5238ee609765af9dda78d9016657f3b9870e638f57ba42cf14f1a9f3c54fa8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
60e8bb3f0050a5a4bc41f101f377ce76

SHA1
811a8401d68a17c51254fa4ad0399a9a5ffb3fa9

SHA256
0216011a996db3741190f37009d5e2aa2e8736b163c2802e18b0b97a036ba580

SHA512
c9e2dd27d315019413b7a4f1366ab32e350440c45fb583b7346e866c3aa3d825d0f7960806c138c0fde1efe8c5c9e3bd29771747f150475fca49684b45669914

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f63ebf0c95dbb282122e2c4a022343fd

SHA1
d0cdd63c7ab007ae6b7805330609171da3f77b87

SHA256
b33015945658993787919e62ede7bd17ddbac0a1aa4f463bac4cdd6c40d6f0db

SHA512
d15d19756f27fce1321eccdbd2f65bffd2468f0aaead4a98644e0664e37731f12def789906035757a281780770f6b5fe77d0144cbcc56bf93f7e3d1873b05c37

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a70817d5891b242013e0ed55cc7152a5

SHA1
195d89d030b9561408a6472c0a5f69fa2ec1ab29

SHA256
fda4a96d9f89695207527ed6cce4523c1720da430d21f6cd4bef6013c3d95c4d

SHA512
5fac04ed135102494c090ee3fb40e7b03b7f9e3c17498a4fdf4095c0346b0a00aff720c8c86280705885eb955b6fbb69f9fdc7d775bc33c53c39deffaab322a8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c4c24696b5173cf747e3f1f7a507297e

SHA1
18fff63391c637a1c94b8f8ec931686a4aad1b3c

SHA256
8c1a6589a33cb399cb2d47804cfcac16a6a00980db4dbec8958db87b3d2a3706

SHA512
8deac73af3a963381615af5dc915efe6dff5ef30d55ea8971985ad548a8b62eb9e041ac649120eced262e026f0bdb2dceeeadfd0a0ec993d25e1c5437d0acb5e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9588a5c3a1ac0c60fac11c8472b8ae3e

SHA1
6ff1a70aa0bf33ca07ae1017b86b161c281c2a8d

SHA256
fc957669fa90e4d9eeac2b64ae26fe6b7e3a9cd589ace3a08ec0d161ce818f7b

SHA512
b5f270d044a1975ca29d81cffb2862129ae1695d6cb2ee0181c991f30a276af9ed46517b886f199356075d58fdf7716eafffe9ac0aaf40dc0f49c24dbc126ba6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
770867005f65c02e32272fafb9182276

SHA1
044d69e7a4916df65854333ee4cf31bdfca1f974

SHA256
003f8d511e346ee73b2bf5d0d7640629552b8c55a8704db29731f97ca8e69b42

SHA512
dc431dac114f7a81bf319a74d5078f725d956543f9a68b66118ea6bafd70a3e3b7d93e9c1dac79817dc5fd7a218619882a034160a5f6fd613f99f11e7ac56056

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit