evilquest | 01282fce4b0eb96c7d133fd550ea5a4a969a5d39051248e19fe77821cb6e8651

Analysis

max time kernel
150s
max time network
149s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

077cd5e6938ea048af084a011e61b468_JaffaCakes118
Size

168KB
MD5

077cd5e6938ea048af084a011e61b468
SHA1

b71f166b5dc522cde1e8bc4d05355fd2d90ec563
SHA256

01282fce4b0eb96c7d133fd550ea5a4a969a5d39051248e19fe77821cb6e8651
SHA512

f99bf5bc8bbf51b9ef235b42dd7972cb293e87d2597a712e737fd54e378eb11d1453153ec5b8e938c5e9a0226814e16897da960840c9daf1947fc0547f8d1e35
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9x1sk0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adfe-3.dat	family_evilquest
behavioral1/files/0x000000030008adfe-6.dat	family_evilquest
behavioral1/files/0x000000030008adfe-17.dat	family_evilquest
behavioral1/files/0x000000030008adfe-23.dat	family_evilquest
behavioral1/files/0x000000030008adfe-30.dat	family_evilquest
behavioral1/files/0x000000030008adfe-35.dat	family_evilquest
behavioral1/files/0x000000030008adfe-40.dat	family_evilquest
behavioral1/files/0x000000030008adfe-45.dat	family_evilquest
behavioral1/files/0x000000030008adfe-50.dat	family_evilquest
behavioral1/files/0x000000030008adfe-55.dat	family_evilquest
behavioral1/files/0x000000030008adfe-60.dat	family_evilquest
behavioral1/files/0x000000030008adfe-65.dat	family_evilquest
behavioral1/files/0x000000030008adfe-70.dat	family_evilquest
behavioral1/files/0x000000030008adfe-75.dat	family_evilquest
behavioral1/files/0x000000030008adfe-80.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118\""
1⤵
PID:563

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118\""
1⤵
PID:563

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118
1⤵
PID:563
- /bin/zsh
  /bin/zsh -c /Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118
  2⤵
  PID:564
- /Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118
  /Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118
  2⤵
  PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:591

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:592

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:594

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:594

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:595

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:600

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:601

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:605

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:609

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:617

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:618

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:618

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:619

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:619

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:620

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:621

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:623

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:624

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:625

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:628

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:629

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:634

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:635

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:636

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:638

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:651

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:656

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:662

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e22834eb77a4c6cb9260eb09d1d01143

SHA1
538efc56a85fc5589f0635fd2b590708b54c8de9

SHA256
ea3b4b98ae6a1fcc5490b4b9d42f283dc3a93a89135753d822ffb11b6c5c1980

SHA512
fa2ed3e2547a07f4f72b86a0b991fb9e440917cd71117bd2e6e6fbb53fe14189218fa9fc0015b14ee8421ec33b8856abc458bea0fb04ec724231442c4aaf59ba

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
468b7ef8706c8c1d977cd91f95a3092e

SHA1
6ff5055d5ca339d4faabc757b160136759ec75ee

SHA256
58495f56e80905ccd6981f15b16718c58cf30a8a1277fda88b260ec631360489

SHA512
01ca0ad807740a2941f5202c29267b669cb9139bedb8db3d1f8142cb8f8cae92e5534853988e66a6b671c4014138c17dd56526bbf421f4189eed5c07f5ce421d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0165ce26b26c8e8e8aea5211b7ec5ab9

SHA1
e94e8174c1c84444fcd3a515814b6b4ab488aebe

SHA256
a8f629fed77600ab63d0b2848ef0b970da4fe944be47459634ec57d351050cea

SHA512
acbdbeae06f20aee9ea657ab5b24c2f438414f3e04bd806e958a3e7cff1328ae70024362b52479372bf82e4220f7a00328e7e28cb6557cd157da9441e653d251

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c7e7567638788c93540aba2f99e2b1d7

SHA1
fee77f3bceff45ee7dadc1e4ba9ef84ce7856f09

SHA256
69ba73f42c17f379837da593911d3b6a92fa45d7acee4b3fb7906adb6ac3bdaf

SHA512
4cdb23463f2aa660d8c0d8832d5130ed9b23ffda9b5c8a49a7f8f8d61683cf1b7dbb153874bfd780c758cc1baaaa9c07e7f8b7393ba10e7cb6b96b126b82f743

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ea8a769cfaa83b75000306d8aeafb32d

SHA1
7ce9bb4dd07780473f64e782ffaa2ba3f82fd91a

SHA256
466f49f2c48b5d63ef608da3aad95ab9443807b7da02a08392bcee72e2f1999c

SHA512
29e7cf1453864c1ab64c7f143dd6357c50be05b5c59ced2a12f0f8b5b9bbdcb6f8611bd027990c66e09722bf502bf855d00108ee4cc3044a3394d29e32c96835

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
dbfb637f14002092fa3c990e0e4f1f05

SHA1
6aaee54a4cf259ea1469ea01f3152c17fc76181c

SHA256
279a6ba34d2d42d025321941427e59df8ac4a2666b8d828871d27afc1314ee32

SHA512
175312d43212805d9cfed8087ce4a8684ca3c18734b36b8e9e43ae9adf92b8c42db28e73cd5ff06fed08c17fd2859fa5c72bcf426c651616d140c3d3688bd8bf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3cd61efbee2b58a5ac1c19bb774db5ec

SHA1
fc5b479723ab8301b0e9b45e7c9f19c21c671d57

SHA256
7723e0178082eac5d0731ed8288dd8710c57179bbabdcb03e3e689e655c52a31

SHA512
6bd6a4daf2cd6ec844cb9ca61eadef6bafe65350e70304dcd1b386dc625d0e6805350c229e8c887c67cef35d59d948076d8b15f608f0af37773f7636f197f43e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cecb51d09c06ac1a15e74cfe1bdc11d0

SHA1
c299afa66a91790323d21b57a22aa0d3aed94fba

SHA256
7b607ba0d2c0469bb3a4f25fa008c4db8618a979bcd85f404fee2e4fc6177138

SHA512
ff5bb78ae35f365bbb947b7698dc976482133dc85c682901ceb2a02300b7ed31d5e5d2c5851ae870a2baa622a8c2f0ac15f68cc9c54fd6b39007f24939ca29d7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0619df50dbad66e1b4827e03605959d8

SHA1
20cf11b044a531d137b35cf3cbe233586a7c0867

SHA256
890076011b0b309cbb042f912e41af8c2b174208db96d34178b8833f8dc64480

SHA512
6661060441317a94c068486dc58d6225f49104aec6b638b446c66fae63688a08ab13d7fea29475261be4333171450480a0a4e720b60ac3eeaeeb353a20941e41

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
64598304336e8f42debf9c62f53718c7

SHA1
ce4587061cd2e8facebfc5e240083a5da771d2a4

SHA256
e7983f006ccebfdce28f346b022f721f9838bdc90be02c712dd56a4db8806935

SHA512
253bf6ec653e0256e296aef124b1969f18645d72a35925c2388190a58262f408a7cf958cc25989edab2e0b476cc311b4a1da5e9aacd83ae72ef213be2e94fa7a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
39b8370ed1289b20ac40acea7125a263

SHA1
b6fba637de18bad3131ca85c44ffad077fb42ecd

SHA256
0de8fc64c124611506904b5c6a8da45a41dd13a7b7aa4f49afebb8860bff6600

SHA512
6aee87f764917a643c7ad7f148c06d253522c014e852edcc122f3dc786569032327a4c937239b7b231f774e0ddb6944871e5d1b390f1cca452a6c73964044eb6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f8d74f573ae03aa0e6d023dc0cb77596

SHA1
860d3535eb27492e564f3873d8a5e6fb6495ffae

SHA256
097fc756665df6b609bd0e828507fc70d38e5982070ba2fde2bfb3789f931bba

SHA512
dd55321c45ac64de2fef440df0381c479a7b9bc58465cd6a72a608481e2ea096b8a703bf7384de7d92b7de67dd03ddf57efeadcd349c0c37e06440b1a8e7b704

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
711f44a85e6297363d0b69c5b7826ef2

SHA1
2a0b103f01287245793ea27bb9384891a30b2e9b

SHA256
2ef921f3288e0115d767d55bd90ada86957240fc0169c1a2ab2196f1e58a0a62

SHA512
fa6c53cb23d7ffda5b6194d5c2c83901a5dfaa2b3e6c788385325cd60f5239493aefd679ab500a5b7e7824f3aa787d8a122d6f5a84499ec607e0c3c7e80a08ba

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
26d204818e8f7882e650ae989bd4754a

SHA1
ec1ff32bbc3c77949f8aa1841397fc395fa4c997

SHA256
82982e2b2102394c9b0ed94b3ef6292046de349ef1cc13746bd27ffa1d8d254c

SHA512
ed3bd391e39a80b0286884aef03d9c619f9dfae633c469b11d3dc42537b8ff7b6d5a549d9454fddb27b306eb24de8288517ec85b97dffc71ce042b81c6709d3c

Download Submit
/Users/run/077cd5e6938ea048af084a011e61b468_JaffaCakes118

Filesize
168KB

MD5
3b4ba7984efeb3bbe54449d6295bf1fb

SHA1
703dddfb6eb79e2ab5fdcf140e3545501cafde04

SHA256
dff831ecd6c162739e32713a4ac7a0d504bac5191292f9c9f4eef0f26f23e5a6

SHA512
2bdb38be5c6e5ef23c3e2fd17366427a57a5a64f488c42be0de9eef4819e85da6f7103b917f727ca367bd45f3b32b6a2fe6ea508ecd686c7c69955b32229d768

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
aaaa5ad922a24239b907838728699055

SHA1
3b045431271befc23f8154e4b50259360037f0cc

SHA256
c2511d3fd9f4368985427e6234b555f5e792f9c0df559aae9d883215e68ed8c6

SHA512
92af1e33307b4d7939778e25c45ce9a0df37594b1aef3b95299e84635577c698607ab3dc79671ebdc7f681e9d8c2423ca485643e70307acb99d88a4e6fc820a7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
af8a6340b10b575986e2d225fdd3e1a5

SHA1
1c838324826e783ddce6dccca024d6f8ec4fb092

SHA256
ce7476ba337f49cc68ff5821614585ef223c41bbc0786826aca595419bfb7699

SHA512
bc3a84708bd10f14d4a5c178842f7958c83e69f5a2859d516652b3f9b6e1dd41e5b9fc181bc31b4c1df501b1cce5232db73656155e77ac2197e784f42a40dddc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4c7d955942709b122ac40904fe625bef

SHA1
ce4f2adaadc4aa11aba8247c3ba6634f95a572f5

SHA256
53266665780ca4c4e92e4749252372cb7a611c40f3bed551d68db0c4d2f5698e

SHA512
3ecc23a998ba8cd9c9ed3fcb9230b972944af957b7a1736063de9c39d77dd45a0da9e9e7b175415efbf52b55bdfb5095e900c068ff1bd47135b50458b312b10e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
44c855cb9d71fa57fe79dea07cb43f38

SHA1
2480f764db0ae8ff014cd35d88386771b9fee85c

SHA256
3c0c0705c7294147cc93331378d0ee3b099ae5164158665767514431da7b02e2

SHA512
94f2a97dc22a48e6d0787057974dfd3bea1f2cb4f6c120d198cbb1b18c4690a29a14db5362fb51955dc045749017c7757ca422f1ea20e2c234231fc3b82fffcf

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b29d62e17d2ea2b7cf2d3fb01e5044c1

SHA1
22a33aa2bd32867f34a48aa322aaa9d9f734977a

SHA256
9e20c0d49efb4c685102125a1ae089a4549aa4de0e304f198ab86662c0d6bbb8

SHA512
45d3c736061539d696f6ad028c5842e081684ffc17939a237d522ae13f4f48158ba0bbd826befb23c8d4a21a094175fc4d73e1a4652aa68c938b38cd3ebb2644

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2c25654a775f9041e86f83a3d6b6e6f9

SHA1
2fb2fd2e5d6686066ee2e685fbd02ec2fd5201b2

SHA256
7bad10b71632f49bf41e8138bdd065966622855457013f06c39eee7402e7841a

SHA512
8f2dc12551f3c363310dd3e5052868e2fcda6575d5260411f21e3d82cc6fcde44894401621eab32d0093e5d47e3142227e6a623817fcf0f43b77e93e0609dec7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5abc88196529ce7201166f06cc993e1d

SHA1
c830e838e7ba58e37a64eb7b434ac3de73d28107

SHA256
b8894b97acba7eab78f50a51ae47489ea63c0f52bcaef25af68218550f3e3962

SHA512
ddc6f527f1f3f2db08d0e4d96b7e667d2cf84f5bdae1f8ff5365aa6c5aa6fc0d66dc533a8a2c88388c82fb3ae040a3f7eeaa417345daba1859a1353bdc83fe3d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
eb5bea4c8768e0f85d400a223e2baaab

SHA1
128e0615cf029fc91dff134ce2a51d9b3c6a3ad6

SHA256
79d5d4a366f36e830b93bb358ef187f8b5669fd11a63f24e3e6f246f0fd9ba8d

SHA512
0adfe14d4ce446d6257c12b144b0a7f07f8dbca6b8adc0ba8a64d0cec1b4ae97722358eda38372cac3b476146c6e5bb82b67fa4f809e2de4bf794d9a18d56001

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0dcd337a9f6bc8fc316ef4bc7b0bed28

SHA1
19dcc00fee9a59bff87cbd5c783128c45677bd63

SHA256
b6d850c23b623c7ee5fda88c08efedbd1c7548ff962fff1f46e48c61849164d7

SHA512
f045193803bdf39172862ef3443f56102fd369a9ff222ee733a364913bfd68cbf361d0a7cbbf761f200d8fe06f74c0e3290a6274517333c8650bfd7af800d313

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4714f506b2851e8f4e0178965d1b78f9

SHA1
2a1919bf64734909cc30c94706cf4cb10b215959

SHA256
f37015dee8c8eb76bc18988d92c99404d6930d9accf29532b6868a22f3b0be90

SHA512
477dd380af77672bab41eeacf62a304cd165f9f8729072f6e6eb037e74ddaba327c2aadd2bd59d84d56d54608a65828166eec23090012a6c330c6aaed86602c9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7fae9bfe6adf9af7b4ef15c759ca74e1

SHA1
0efd127bc1ffad5f9cc4c05e35b9d8aafc2a53ab

SHA256
d232d600224017bffb217e4e9be6d845cd1a6f194909871130f05df6ef08547e

SHA512
7e38733c06913c2736437220bd22d5b4f0bb3bbf5bde4ececd7436d934c3ba27fac5dfb12c00ae5f5b63afa4db0091f8161c491cf6bef17169724a980784cafc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
88b91bf728903df28edd6c0d7f5627d2

SHA1
9c77f05f33ae561a028dfc1d921fb76613ae734c

SHA256
76a41d307032d7220cec72ae5d84f8f74d1071d12e9fe110f7532796a1b1b743

SHA512
de55f1c94191e8307d3fcff75966cf683c4cd9e1b46ee0e5a962ed80d9cc627d996ce6616563787f21cc44a61a3d141a79687c528c25b2e1aa20cd57f1110be5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7c87a4899273a278e186bc9d2a9ed60f

SHA1
16802603d1169a2569540e923ade2dd7f3ec5b44

SHA256
21a856151ba3d9c455fcc3b17b2114d924d18131cf171ff70c1596f9d4436fc1

SHA512
0fa4d997f56f08f0417cea2fb8abed1c4b55c6b051830ee219bd3404ef83c953b132a402cc2a20943a5764adea196b0716717702c8342637d03752bc494a4fad

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b8ecd1c30ff97b2eab1f4343778c9bd2

SHA1
afe1e7da80ca0bd401b9aa691ebb44d1c7e6e780

SHA256
46f71d36fd9d9b200f8af263d0db2aa366cb94bb10f26fc52f67bc568ceb90e4

SHA512
e19889bc818570882812b6c1dd6f64b94839b27773469e5f6293a2c3209e9960a24e1e83e6ddb6432976eb7a29d49cb7ff21000a2928fdef512388bc1f5c7d66

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
220a9781bc74b1f8d1b2bd19cff40ad3

SHA1
4f6b31220e2553bad2ec215bdc5fa9938ce7408b

SHA256
163c42a72467a9293d73cc3c54ddccbcb67f78acfeadf9506667ebda22b3be9a

SHA512
83bbc483ea7ac12666809be97ba76a761ec7d3fd632f68abdc582843ef25be3b306afbe3f170dc76c8535f9b63c9e57ed8113501c97ef9ce486513a5f4daf378

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7b97c7d396b2b0ccccc219b920e2b2f7

SHA1
82967c9e95456951bcc315eddeb492bd3fd826b9

SHA256
a54ef4a8aa8d2c170818867efdbce364ef93757d910f47c84d4c741379c7decf

SHA512
8c37487cce2291ea5ed51c389473134269512e5079a2e945c88e1ea52b0ef06932616fc7257576f99c7385f139688f0bc5648ecdc995c225d7222b67eac5a2b9

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit