evilquest | 4a5a162a5f155505fa8870efc37fe7c238a36c0fae6bf5984d97b1264e75ecec

Analysis

max time kernel
150s
max time network
149s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118
Size

168KB
MD5

078eb7f7eccdde11919583b30ff3d82e
SHA1

b31f12ef69912fac418c3ff70087a01475e9cc5f
SHA256

4a5a162a5f155505fa8870efc37fe7c238a36c0fae6bf5984d97b1264e75ecec
SHA512

ab35bc53a40d9ddb3435f7bcc4969aea958ec87be607092e3e77be15cffbbff2b35ddd55beb9f5c9c5ec0661ce717e7ff50f65b1474caea7f3ddd41de4ac1b54
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9rh0:5SeOQdaZNxtk8cqhSxvHY9r

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adfa-3.dat	family_evilquest
behavioral1/files/0x000000030008adfa-6.dat	family_evilquest
behavioral1/files/0x000000030008adfa-16.dat	family_evilquest
behavioral1/files/0x000000030008adfa-23.dat	family_evilquest
behavioral1/files/0x000000030008adfa-29.dat	family_evilquest
behavioral1/files/0x000000030008adfa-35.dat	family_evilquest
behavioral1/files/0x000000030008adfa-40.dat	family_evilquest
behavioral1/files/0x000000030008adfa-45.dat	family_evilquest
behavioral1/files/0x000000030008adfa-50.dat	family_evilquest
behavioral1/files/0x000000030008adfa-55.dat	family_evilquest
behavioral1/files/0x000000030008adfa-61.dat	family_evilquest
behavioral1/files/0x000000030008adfa-66.dat	family_evilquest
behavioral1/files/0x000000030008adfa-71.dat	family_evilquest
behavioral1/files/0x000000030008adfa-76.dat	family_evilquest
behavioral1/files/0x000000030008adfa-81.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118
  2⤵
  PID:563
- /Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118
  /Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:586

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:586

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:590

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:596

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:608

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:609

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:619

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:620

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:621

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:624

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:625

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:627

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:627

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:629

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:630

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:635

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:636

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:640

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:651

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:653

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:655

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:659

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:668

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:668

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:670

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:670

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:671

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:672

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:672

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
32a50cc3403def08271d6fb64ac88c37

SHA1
5423889bc1aafb60adb1092abacc92e7c295ea4e

SHA256
feac94165f904a7230b37430f905d333bf301c52bc32a2c7db89b82e0d173ef2

SHA512
0d8f2d45bb8de51eddd4a50620efdfd58057f4b69d1331ab6a7412fac7a6624abf6aa4653608e13d7ebae5f0fe479c251190729633aa13ccda1479d451c79245

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b442379934aa558ea14aa8e73a36d94a

SHA1
947d8ffb86ffa2de8518746b22dc4b7103fce559

SHA256
b29abb83deb9bc1b5368b49a28753f30cad8d7ea942721fd7e6b51eeb43d91ab

SHA512
83271d1d2d778c3cba30699aefc18ec36ecf5ca5c3ae056854b8e6512004be00f516f24725988fb787d06d27e639af8710b142d2d91731487ec78aabcfdcb276

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7ef2407ae8c19d2fa916e214682ea1d6

SHA1
d7695d88c2714cc9358633e8a17f83036f935e5a

SHA256
6b59d371bb5a7ab0f07cab68aa4ca56c6a8d5d60689a396ce7ca900f2bc6f9e3

SHA512
0d810b9b0e3b744e04a2a88c8947485d313546e7481c0913035866fb35987ecd9dd08e59ebbb516f0965ff181d7f4514c8624a8196a2c0e4ceacf132bd92ae87

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fed523f0588938438bd0a6de1552943c

SHA1
2516b6bbee8a08f54af497c49039d4c034952f43

SHA256
73445380d45c747aa499bcc335c05c5db3ba602ee0139569d06271e66990f6aa

SHA512
bc54929300e93a7dce45590e75b15da8eb9545ad4e60e39cf38208315b24e72ca644169cc3d1bac5a0dbe7051fe5ec8f7b4c0ea9dd3b19b8d6b1b14900081892

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fadcd1f76e3cb75b2c141033ff336b0a

SHA1
f74476643a411a769e92fffdfc90dadc778adc04

SHA256
790012c84b05a877c17b0dc618094cd4782b72523c9dd12235e102e5de81c2d0

SHA512
e2a8aa852c2a45e6b79d02a89eba292ffb8e31b74aafa762afb89be74255d6d8863eea4c494f02a4d0fea81ff62af1c94a81d351f25ab493bbb78f24e51a4716

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a3c20656e910f157c804e41fc57bea2f

SHA1
0823bbace3e53135f65578dac5d076279066ece3

SHA256
721e112f8e770a649358d10a0b4461f980835b2e03d1785f9c65b1c3ac107870

SHA512
8b1f1885fa44a68fe050597fe00ad952ccffdee2b5e2f75fc878971e0f4a4f0c71b590da7f8f2be78e4801e74733b21d8970bba1d43230da34388060aec89324

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
abf5ae96671dd881c973d998b9946e11

SHA1
004f39e6492a054dbbf96f65d49705645bc69e26

SHA256
8a4c1bc46805d8125ba9d5a51cf1ef8c894a38abc246bb46eb2687f4eba57178

SHA512
0393531f6ae707ae6ad63e011825c692a9e085986a5de641bb1db567d3453d53d199421e18560e3ad03d23248663355a59691957f2136aa973f75a65e25a75bf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4ead1f69901fab24bd38fd73c3797606

SHA1
f72c120fd61fb7de647f3a8309f96707a413971a

SHA256
f26073c26749e7bdf2ea2f5d5d2e3da2785e0f2f8357723cd758bc94e495d6d0

SHA512
13a6a5d735b2cb05a848327635872bb74e143d5b6ed465bd9473fa012a170a9b0878154df9076829725b2bf3754674874ad6fe93acbc92cc38ae010aa54f0de0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
da30b5a7c654bd196e9a7ce786449164

SHA1
11934efb74be7bfa0afa034bdb95264d09a47299

SHA256
c526610e9ad12cbbc907a074d31422f14e34887e28db95f0a21d73cb9352711b

SHA512
14687203522eefbc4600628bbe71b423f9d3e6c5e9ca10db7665ac1367f33ce0d7626a847f577a1e5d7aab62845ffdc2e9b424c9a3ba7dd06317f323be76b347

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7020b720d7eb093ecbb4793954aa70f7

SHA1
fba67b2dcd8eb1eee51d0cdc22c4b1cf998ff85b

SHA256
30bc51a066deb862c17c7d25e5c85c4e70c1fedfcc8786fb53aa8a6bbc4e6bb3

SHA512
543af5f088c64ea06662a234fcba1f582994c91d1f2176ffa1ce1138f89ca2598f4382d7b6379c06317740c6791523438dbce8e22d6e9fdc9de8506b5c635109

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d5d829fced31cc1addd8a68e24af7b17

SHA1
2bafb3c0c4636d34f3dc6affeb30a32cadd2a259

SHA256
fbe7f5663c1b3a37baa32f8c5b74fad7c63c6df3a8d56fec8606ee222dc09c59

SHA512
442417895536037f1a27330b1aa283aea0693d373dc62274d931abb4dcb052cb039899899b45555d508f2dca5ec016b8cb607ff5a2b9dfd065ae3bde6d5062db

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e4d0c2e26bed79cac28e4d6f2b14c5d1

SHA1
b1c2ca27d6292106c947886261f52692d3b7df10

SHA256
7dca1f534b95d4764c067bfabc615010f5010656b59f9fe1ca82852b44327e41

SHA512
0054fcc839150a884f3e083462cc41084b7ce628d06e44f28166caf9822419dad6aa9f8bf819ea7ec62c672d98fa3c510530e928f3d1ca77b738653502539655

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cd0ba00495732ee71e906ed71490601a

SHA1
b9d236415a53d334cc060232d3f26d48f88b7134

SHA256
7bcfc7bf45e20ab862a1a15a8c9b414153c5db7c7fc556f9427d6f3f41ca05f4

SHA512
9c9e3428aabf0c740b2cb8531e6de613b40f6671bb3e1e7dc1d7b0cffb28bd6351db8bf4a38e1a52784c0cd761593ad69430ef06402fc9400f505f930f5db477

Download Submit
/Users/run/078eb7f7eccdde11919583b30ff3d82e_JaffaCakes118

Filesize
168KB

MD5
1d5c90807e90fae7e74c3aeae895671a

SHA1
f973ba3f1bb35ec059b2d04bd2575ac1c70135f9

SHA256
731dc6373357467c2f634d9ecfdf9be301977733eb741970adcf6ff33a712b71

SHA512
82967db28ebef96059f0f1584ba09de5755b5d5d43364bccab179b626d3d6fb031d9b9a9f3c7c163a2595f9aeb3351ad0f4093ebd76e253e8b0c1370a38bbd26

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
282d500060d5f7a57cf9ed539851dd9f

SHA1
a9c523058defd0b1c7266f83913002231fe7922f

SHA256
cc13d54bf479984440bdd46bd708a59cca16971de84bb05501bd6aa11ab28a4a

SHA512
c2bb0f2c1c75e382ec80d918529ac682f6a613122190ee6126b53e917f47153fa3e814a5b33b3714423876787f0e35a973dc3fa1f613e4e62cb9f02c44b99903

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
b313e51ba2da8529b8105feabdc9bd53

SHA1
9442d8129bda919d32adf2dbf97c81e413fe9918

SHA256
4a7eb0beb609adcde9329a25b60550964d529755679b325a0d95fe3ba102690a

SHA512
4e965cb32f628ab34400727af886c9dc59c3bc05e053641d03914894e52b814c444bfc69e32d8a7ee3136d22f8f0c95c3a264ef284626ab7ccd252cad0855315

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
21acbc63157d13885b73b729bb28a2f9

SHA1
fdb8e0699145d369531c2a41a7fee35629cf8953

SHA256
a59b7fa98c13a4c27f9e3cb2d9d9d7dbfd1be624b4ed6b58ad353ed8dd1859d9

SHA512
0c63f4bcfe6427d041cb99dd9ad23699602f1c4a2550d7ee52933ad8415f07fb135db99e3fc48bb8263dc036a49d60fc644bb51bf1f0686d7a53adc02513adb3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b8862739bfbb5f0bf8bbe5aef113c345

SHA1
4f4d3950a1aff5e031f73b384efa823217838aec

SHA256
5c63d8b2bdb9f6840f43f7d63827544aee5549eada04717316fa2be703fc0c62

SHA512
e4e219ed3947c66b4c9f7cd981df30280e40f8e84804788c6b623c59958b1aa827640710654d5f8685c3bc02ee92a8caa6e05ff0a1cd99bd32ea9b906e1fb5a6

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9a2f86c9669a75db25b0b0154365d76c

SHA1
2ca330ed55ec190a28d77e4a79d6d4ab75c6bc6a

SHA256
9778cc59137bb0f2fe484b48c14a210bdcb0d1fe4ef17e38dfa9d118faa056a1

SHA512
ffa6f9c682e9717a03f6ce9dba4bf0a48c30147c6278d17bccc07aa27d228ef3a6703e88c05d6216eda6f846d1467e7a638e5995ea56e60d2e9e6dce84d75923

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4ce3f9d686e6b1a55218c251ccddd784

SHA1
61329b7e43c0c6673a967f8830c2ac45409451d4

SHA256
99cff261766296ab2560fb6032769cae69bd3a13483e900c96f9ca78d2dcc659

SHA512
0501f862b570eee6fc4915fa0dce55fddb1d20bc07ea749fe4acbaf86b6c55394c6c43d320e095319a30e227d659de28143a8f0233db8e9b887e8949bdcb0d33

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ddcef615984f72e6dd5cc399527d510a

SHA1
196176eff57448b7f3a27d77d678446f5b511de8

SHA256
1552d31b946e4456938ae204b9744e691483451d6e6c2c4cd8988b36b20301fe

SHA512
e4b94178f2bcb1e3daae70b3b9a1b617a4e91a3a36d6f69a2bae7225e6b7ce5335171213f0cc8748708af4525b02ac6372d73505da7cf5007f81c5c0b24f806f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
55f42aeb9ad39f477ec35c48691d3ea0

SHA1
45059e2147cbbd42ec2ee29903dc73323868b059

SHA256
6e46f510c66a6eb6f277b5961da0f0b926b03afad8ce6093d77e996115fafd97

SHA512
e360032546959fc7ba05942f4bf597602ea0a400120be159efc858f59807da32a8dfbfe5dec3032e1fcd79bd4860dafc89af09a1eb07bcd510fcee56693dc85d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9c73f1d40f42792074fc7d1e4c81c8b7

SHA1
a9a1f29b6a3d41822925e5cece6c69330bad7380

SHA256
6fcd193b74572e58489cba3d576d2f5299a5f66021ade120bb3dba6f339415c8

SHA512
87f12c4086f96e3e90fbab5e7e3ecce74d1fea4c08bfc4b0e34ce720d4572883f169b68686b326a31c3b8bd0a1427e12b476fcb70c2f4fecb9cea091d4a0b3c8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b181b7a4db038d1e086e39ee7649fd1b

SHA1
7ea106c6fa7d677b1f599406f2cda7af88700262

SHA256
226653bba7750c73a634fc2d4be3efe6c0b0e79da9b3e72ed97bbc4d7e90062d

SHA512
c8f5da0406be1e0bf4f0e6868db5682ff8189ec481492dc7482e4f0762c52b0cf48fef0792395fdfba25d59934dbc4744a014ef872dbceae36499064163715fc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a1efa42f4ff890a444aa5ed2f62e361d

SHA1
4db7db67dce4534b8043f24a96bf9e7dcf14b890

SHA256
1aad4b339ed1cbf2ceee6c502f7f674317429a82c4cb8333fb0f5b77b22ca917

SHA512
c4493bcc09e9bca9fb582e99b82d1d4b5ad34e6636bd148b19c73e58a4b9b52da00a2b4be43fb2c93a389a81e720fdaaa954368132278a31539f46545668d56d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
188ae29e5a37ef91c5b927a66140d088

SHA1
3fdfc6c559ac6821b4101420c99e8bbf704e2775

SHA256
6c5c5aa1bd40283e2fa32a70ea1c22e24eb5ebecf0c4cc0eb6f2dbea643229dd

SHA512
65c22e9092d09a81bcbe69eb83e3fb4d4db1236e2d6a4dfd6805cc4e63121d7c775b3f90f02c460cb2ff7db042554b71d2adf77cc7bbd549fb1b11aa43799351

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
95a9cb34f213367a89b4a6026b0d0b72

SHA1
a4f809ad2e071afd72f1a3282a3ca7a7b28cc055

SHA256
221ae7b2a89b7ce7f8d28d97467cefa8357af43dff31e616703924f611fcf3c3

SHA512
e6a1563009d20d1b0e4f10428ad1989f95e7a6b5c732f18b4e86533a04717c0b7fcd6daed048a28fd2dd7a18b757ce76b1a094234c27a48a16b265f6162c5bfe

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7e614999ed8e19b6682d6163c66c5ee0

SHA1
ba47bb13b92de77cd114f4e21d5bb6366a4594ba

SHA256
6717836dc25454105f01c390bb9b46fc5666d3b9f9d956ec878de3146f2d243d

SHA512
801eee43b0d9ff5ef2ee54d9889509a481fb306e3c77c079df8c25012b05a968908c1ae8c295637d531a175c69213b1f48373b8921ae21761810182793eb5a75

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
44e4e28c89277bf2322572aa956d92c0

SHA1
d668217e7943db93b3e4bdc635a558a14ebfa310

SHA256
121b2722c09cf310de32040846b89759364798b98c9dab3fcc151823165ca1e2

SHA512
1b05d6fe379f790d9bc8bc32fe890247dbc743f0257e48d8e97fa924d228a1fe34977240a1fdf6aea578b8e854d471fff16ac6b5c65c8d28a09e05bb932383c5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2c3926ffacaf7d11aa6e3f789d94a4cd

SHA1
dc9bab8ed8ac8ec387032d6a8005ed3f5eba9ae6

SHA256
11fe189d5569dd0ab5446dbdaeef06944749880819c5886f8c41fb78240f7929

SHA512
436c4b51612a38d5ed38b5804dafd5ceabbc65cb8cfcd3646890122bfd80a8e74f9d6028156d59cad151bc1989164510a4fdb370b271778b8961353cdc5d360b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2ec5559f0e4ef0db58004ca6734fbeee

SHA1
bd08f089c82af41f4e06bee6b235946feef31302

SHA256
f6b52bc3bf3d37c063f8f5b54e5edca2b5c35194aa6880b786098d8006148ddc

SHA512
ef17e7104a2effeea5a6aabca90b789f51311aeedcac0833c0436026413733a977de22ce72023564f7539681889021032f5e5e4ecdc2fd69c6997065fa64c3b8

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit