evilquest | 3abd75cbf412503ca2d88ad6dade1fd7f412e55c8c2478ad06629c14ff32b580

Resubmissions

29/04/2024, 12:52

240429-p38e4sbd5y 10

29/04/2024, 11:37

240429-nrj3pshh91 10

Analysis

max time kernel
149s
max time network
143s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29/04/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0793f5a839f86d51180c135f6dba34a2_JaffaCakes118
Size

168KB
MD5

0793f5a839f86d51180c135f6dba34a2
SHA1

813b8c1a4ef6469f49db3c4fa607256f0da20b55
SHA256

3abd75cbf412503ca2d88ad6dade1fd7f412e55c8c2478ad06629c14ff32b580
SHA512

ecfb0b6c0ec653b459246d3ab6389d120747feb085f47d2c5ac38617ee415d0531df17c3425a5c6fde5a68d61757f1c897a0e457ad36d4e81911f2a25e8d90d1
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq90l0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

resource	yara_rule
behavioral1/files/0x000000030008adfb-0.dat	family_evilquest
behavioral1/files/0x000000030008ad9e-3.dat	family_evilquest
behavioral1/files/0x000000030008adfb-6.dat	family_evilquest
behavioral1/files/0x000000030008adfb-15.dat	family_evilquest
behavioral1/files/0x000000030008adfb-22.dat	family_evilquest
behavioral1/files/0x000000030008adfb-27.dat	family_evilquest
behavioral1/files/0x000000030008adfb-32.dat	family_evilquest
behavioral1/files/0x000000030008adfb-41.dat	family_evilquest
behavioral1/files/0x000000030008adfb-46.dat	family_evilquest
behavioral1/files/0x000000030008adfb-51.dat	family_evilquest
behavioral1/files/0x000000030008adfb-56.dat	family_evilquest
behavioral1/files/0x000000030008adfb-61.dat	family_evilquest
behavioral1/files/0x000000030008adfb-66.dat	family_evilquest
behavioral1/files/0x000000030008adfb-71.dat	family_evilquest
behavioral1/files/0x000000030008adfb-76.dat	family_evilquest
behavioral1/files/0x000000030008adfb-81.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118
  2⤵
  PID:563
- /Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118
  /Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118
  2⤵
  PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:564

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:564

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:569

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:569

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:575

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:574

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:574

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:583

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:583

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:586

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:586

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:598

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:601

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:611

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:612

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:613

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:615

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:616

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:619

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:620

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:621

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:622

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:623

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:636

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:636

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:639

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:640

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:640

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:644

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:662

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:665

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:665

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
db238e8f3ff3cdbfafd8cdb8e2d59b8a

SHA1
bfafab4b91db6af66f5329e98fc9a50d0c026b78

SHA256
8401b736a98c2d3c95c6a9e0f6b96d733683c510112c5b5e10f8bf28c5f1f3b1

SHA512
fcfb24cac027547b58116e7d3b7c6e79b6bb6262beca7acbad72ce4b6c6f12ee5441801f84704ede9f245015f4a6f6fee32daf835b55deae9aa43db67d8f23a5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e2cc0c3684e19a3eaf87fce56773b309

SHA1
3924eeeecb55a0af159f7c7b4384fc7b675727d7

SHA256
3076c3d2587791c7aee8f3529d3a670fe2aeaaf03d376b6bb31009c2baf6d4e0

SHA512
3a68785626a2b572537034809e6ae57d8db5ef914c7920c032d95a19140af71ceb0271de2aa4eac16103dc4ea738388e6eea46eefe18dc2fa0e6685b9e532d5b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
fa182bcfe39056289d451c72a4117882

SHA1
4a7b7d2f979b6b874e449fd644b0cb388db8a91a

SHA256
ef81f9a8fb174524f3cafbb31a518f4d2a4891e7472cc4c57ddbd65fd7e3abb1

SHA512
4b937e9fb653e4f8bff39695842bf602b4998f79a1d5841b830ef4950d44b96a1461c272edbafe2c3be39a88e6f8cdfffa3b522e8b8f79c2398801227ecf4388

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d09f1bbd3a35de38ae2dc1e56bad1fbe

SHA1
7686ac2f2838f46d6e4d49a48ce470b67d5aedb4

SHA256
586574769fcb7bebd5c8267e60fea8dc3ddb3094a8570f14df0ebae3723e3a8e

SHA512
92cc636fb13dbd5dc1d934b698b279f5750c9e615437ca3014179ad668709bdba928e7b605736f20ceb39c0fa69ede0e7355f9305021945b9b92c813c621161e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a32919010640872ff69771adc9d09502

SHA1
d6b5608dd1898aa240fc7b7b0daa11838d716e7b

SHA256
69279219046e4416ab52fac9697a735a5d59b040789a6f3d1fbf847d2f729a0c

SHA512
888f5219ab4b906b4321558a0d3f51438307bd2ec12c89f3ac2ba2f8f05d22ff5f1707348621a64ba94963701d4279d3ada27aa2aacd09e2c611e2240d62709c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1daebb234985195b096baed8b07401ee

SHA1
f91e8e36ea3d19f1006cffce4baceefce782934c

SHA256
33183e960da1286fe76e671d8b39d62b4ffc6d482fcc85c746aba99f4ee53e5c

SHA512
9f7d7dc0c69e6f2202c6d81bb49e8db70d969353959c4f172cfbb03b8f265f3e3e406a76aa1564933816d26eb509be9221d456da1290b1154b17fbc42dfcb0bf

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5d037210da518bdd4f3f8f88f26f91c3

SHA1
56dfb6396830a7bd4b1d574a57d1c104e435c363

SHA256
46440e57dcfc45bc131c08255ab033f8464e2065703cd9532f0570d3932e9502

SHA512
9f049ec6afaccb767fb9ac8628d62cede820d5ebcd0dd66a15b62e66fc2f7e9e95f10ec4f0564e0adbb3f0f645d0597489c70807fad8f6cc24ed116a1b44f0f9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6f888285d1a34b34b533c6c7a4e51008

SHA1
dd033644e268ae8ca3d31ca85a63b30edee70b0d

SHA256
e25578da0cf909daa4e15669903eab1105923885f0dd18c2c6df860c6bc1ffbc

SHA512
e62566c387174222e977989c3553b35b1805affcdf7539d8d20c9660778e34e0eec1b41c0b7cd0598e20c4107e0d7178362c612be9c7665e6d1337feb99659c7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6393327cfed9fd304e0ed1793fb6991c

SHA1
a2b2723381336e5241df912a6bfd345845d871f8

SHA256
a6fa277605421273d8bdeb3a6814b4ee78eb0dec6ea467a6f1843c6af9dbf63d

SHA512
8006b6f9f67d598461d4914d30ac05988dccca13cbaac510e60dc8bc9984ae988433ba2e7bcd092bbb8841c03872a1e4c9d776082ef7f5a7f4e10ccc87db1d0c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7ec4315d83cfae61f69717e5cd145bf9

SHA1
7b771c4fba22a7728e9d51b080d917de74e9ce03

SHA256
5ded64751fd30e231d69e89538b4bb99a6f8932be1874801bfc6d78d1d777110

SHA512
8b0fbbf359f6eff01fc424701ba3623eaf5acda58c24bede31726a2bfaf0e93455699de70f8c0d1e296af8df82f6e4baa8f4947fb93a590f26603af6b5c5860b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9c9903ce8ad584b9be653fa90ffd9d45

SHA1
dacc61efab2c1838a4cf26dc26f620950dac06aa

SHA256
896f6235bd5a2cd94c8a6edbffbd773f01cd10e69211875381a9b86b197fa9a5

SHA512
5c032a07aee921d1d9061b7dca67860df385d952f49b3b82fce94f750266b5934e5dcf3918b775a0331079ed2bef166e6aeca6eef40ef318cd7af812fa6f6222

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
25e68c7e4adb30f82e9d7011576a423c

SHA1
0b1b64099fc4dda89fa7ea0747c141a5d632de71

SHA256
fc27919a92a7128c6c917b26e77afc0002cea55308f8065850b283eafdaa4cd5

SHA512
f9cbc161ba0c00c735a0ea484bbf85153cdfc2b5db3e74fed6e84bf1eb7efd3880f4f992d374b17943fa359ecdb604f7e33ba463ffc626cdb62b8275f780d035

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e143be7beef130531d509986c24cc4cc

SHA1
c930ab8ec8a95dd2e195bb355beb08e181856bdd

SHA256
3ef001adfca0ad6956cba4e0f89efdd300381f8fa79504be61dfc20e47479f9e

SHA512
fe4551e62bc5d5a5c766ad53484007f79cc1bf18215e2aaeae50f642fcf8aaf675cc70ccf27ec51188654d5a9dfb2d3c7fcc88954f295f53a01de10214911525

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c80ed40f75c7ec93333135e91a7c7ec0

SHA1
3bb08bdba511103b0be3d7b206d548f25447da07

SHA256
9ef51da3c292cebeeb5a82df08e90ee47e68428be4e3d17d3cd07b64655fc145

SHA512
3427c5d47b74b19f2526d7d3222470801e24f9088f28891fb3b238c68a13033b97fe4ffcddd6c508e149e4d65219cc816f8c708c9ff29daadfb50700d444b5d8

Download Submit
/Users/run/0793f5a839f86d51180c135f6dba34a2_JaffaCakes118

Filesize
168KB

MD5
4bf06522922d86cb693de30f3021993d

SHA1
6449490fcc50802a62624a48ecb4608418164f0a

SHA256
006b4de381bf32afa497c3f4cfb0cc9f6b6b8fde4a1c28e5360b7013c7c15237

SHA512
5648008722a3a35aad9dc30d7651a51dd1e5743577c3a59c541b5876a99863e4246d9a079362ee8bc9c15f791019a16088879fae5587fa11ab5484f1335631dd

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
9db4787243c2e31478137029b3495192

SHA1
318d6964f9d0c90ca8cec47576674285caec5b9d

SHA256
3ac6fb5e4f707e040e4894acd585ca8abdbac91807b719981bf3c310cee8593f

SHA512
c805c75e9606a67284d3ff74d33c5d91c47794ec1b4c4af94d42be24eb353c1c6f770d14938836e3c0180ff4f310dfaee5cacf4dfc6640688caf81a21b69ec5e

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
e1c8e53db66601e797b3da06d732bf69

SHA1
79775a14541ec310a02adb75997c33b0c4bff269

SHA256
fb2fdae8e8fbe368b1daf291fe8fd2693b2b7108e17eb141cf3e6ab8303f7ed3

SHA512
6c10ac221bffa21a5d42fb32503a151007b41af5165ff55b82cef20f517203afd6d53ce0d2c66160a94a4579b9d669d3561bf662c6306cc6bbff688765eb53f4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e69e935f00c46eb1937ab78081ee4c75

SHA1
f7def8aa3bbf2216e740b47166be135e3ab0faed

SHA256
ee26fa9025811a18ac402cbb47da9489e8e40021270645126f34fe954c859639

SHA512
e3193349725cda347721616bdc3558bf0e31e1858b0744206553ecd7c918c8d6957d28be117f3537f498958619e25799861cc8a9d4d88900210ac4c51ee9e2c2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5d839d665ffa39c8b8325fc57d9093eb

SHA1
fc24a8890552086d0c262d49f8f8549beeb99b36

SHA256
1a96a96586548819311ca292cefa729dbb360b20635c996abe9706af9f7dfb0b

SHA512
791b0c76488b2d8b3e584a06d31d9b05f5c34ddceb948b80e189233f5f06a034628b88712d94779e0bd4cee298376e051ac8aae00028053efc833a0e571ca5bc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
592f4f26b1349b7cf5afde2ca138fbbb

SHA1
cfca4a8dbb768e3c67dfd8526f0ef95f9edd8fb8

SHA256
ec98a01d296478f77247aa1fd6a666498438fa378854297cffc86e9da5da3da9

SHA512
5c110c578fd40e1fcf0604782307188af37d4cd3f95508b47c396276ae71fb9e6ad866fc5d8f20c6cb00aaa989ca3423f0ac154b97ea0667553adc06843de9b5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b9b97d942096af2ac661ea226b850719

SHA1
9a609f99ab5500c3a8488544f03afce57c327dec

SHA256
052aa6a2edc8666d844d705d7495e36d88c5fb5098d64962127ad5f4ef12db34

SHA512
1f2b314bff5fbf275d721cffc0416270bb7ed4ed52a55cbcd821ade5c2b0c648423ce99aaef7384beac0c9736824b5c6afecff4670c8374779476e5ed0749b3f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
99351c8d2cd948f074a4622addc6471b

SHA1
936ac515f3d139198ccc646eb0944d1d355e4f0d

SHA256
5cd3921acd84f1c585822a5e326254641920af106884558c1fbf7de55c13dc86

SHA512
79fc7aabe4aa749c524768e21c1005108eaef03e0e8823be2fe826810181acbc57c1aafcc358c24549de5fea0be641d652bd1650aa429abccb9d22c6947c38ec

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1e05a14d31b18e703a17dc232d109a06

SHA1
ca5fe89f5a42752fd7e6a91b9943c97c2844b7da

SHA256
21f5a130310a213cfd2d2c04b3c791f2a1cec9bf153edf25c5a42aa4b31e6688

SHA512
06e7b422add69e55362a72184a63c175d1318a964caeb2dc72aa55618461323605a237d5565d71d8b6ded4730a7f833c3b153390378dd5bd81423b540a85e8cc

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7f7ee57950ad1f1dc43c3fc93a4704d4

SHA1
76a0c3757071b7a44d28cbea3b351002117982ac

SHA256
dfae55e2ebf07661cee1cfc114fd2699efaf271528b174733bba4b40f5936786

SHA512
2389cb3a8b0dd450e6ed020d043ae0ed14cb7339e3e1696e37cde3339f35c55f520aaed9099a8cf86432a23eee12b5f3df1622c6190989c2a60c44d628c83f64

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
434916e246b2576b002db603cd1ba160

SHA1
87032866ac375232ffe794ff7e8aa8f1d5befa66

SHA256
3773dfdf41b4ac387c2a4f90b6e091b449492ed2eaa9b40aab8f046dba9e7f2e

SHA512
485a96653544387b8950b1fc5dcb9ed6c502964a907f3e543e372ed6c617c81eca7a20d8b8aa54b165f108cb30092604bf64909edc46663bd3803be9e3966e47

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
585da5e14342e815781379258bd174c7

SHA1
1d96dd71231949467a17bbb5428f1a9d349e1faa

SHA256
92ad83805733838219544ed338311774122575bfc0ba5252bc9a2a18072e9d50

SHA512
6a902548f6d37cffb154c1ef130867269ab1f4fec968a87f9f0a815ef1c375723b6ad47ff092021415ae4ba9cc61a0da43a26bb05ed65fd5bc11425d19ba14a2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e6f6e9bf66275526444c2e558405c890

SHA1
7b45cb8d94ad62d56905f16b6ec189437f7f35d7

SHA256
529831bd92a51af0c2cdc4df69d7548db60248c7c1ef40c67cc83976713488c6

SHA512
2aa891cf51ba81befb48c6bd1660cf5d99a8654a9920d7cb8d7103f955f3a213a1ab8b122ee87af052a785025c7215979cbfac6f53b72e41421d7e967ff4e171

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2c34c26e5d88102b3e965d7d9163dbe0

SHA1
d7e2f2c83656e4453f46bc097d49da940ebcfe22

SHA256
79fe6c3bd74290b0a871e847bea45abb03b9fb737d36f60b72d0f23a879c4fbc

SHA512
46a4e24754e49424a4cf24b1606c1fabe0da81b15989aeeb32a580cfec872bd067eb5e0115f22f021d49712bc3030e73f033e617837cdff69e87a14693753aa4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ff886e80952cbe5d64550eaab778e328

SHA1
399369c2c31582685e8e60e7da1ca0cd67592d7f

SHA256
d992fe9ed4c73940e94acaf9b1f77785468155afc86cd32dbb654a8ba1cbc295

SHA512
d9df046b7ab7e5f8c8bb770066f7297609016c29f04e66a5c20501ebb95908d92830832ca9cd5b43a396a6e0a945f08b1215f286600c4ff2598e58dcb5407124

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e34fd774cfd7b9ef6d0200a6a098d732

SHA1
02cf0dbe8b8c816edf90b93a47048907ada2c5b5

SHA256
9e992e19d7e35a11c2762f137249b9d7a20198c47584fe561023f24dedee3ab7

SHA512
68105daeba88cd5b62dc2ca2cc926c154fdba7f2945283a0c1cdcd0b2b8aa8a114e8fd70a93d5857b719b7fc6bf7d974526e467767b505d69a0d3dabf0621840

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9790c82672174e23d72f86ae7b226b67

SHA1
319738e82f0fd23ab48e1487c6c6bee2e68acc83

SHA256
5d20310225a703cf325a8160d7883c791ac6a7ba8c77a4539e1f6d5f75ef007c

SHA512
b88847ff2c28e7cc2669b06986986538e3a94ae429e87236c83fa3c4adff6f856adb4fa232d27223282d61b10cc66d20408ab6f5b419c79918950d03d44cb170

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
219617076599aec3c0ab54cf5ea2578e

SHA1
9287f27b4096a86dfffddab3f75e5f93d026dfa6

SHA256
dc17cb24b167d603038191accb85b4d9dd63087d77d22688994972e6fb34a403

SHA512
38ef132afb22e86e3a3571831b0d03081b3ea4b68c19ae0fb644a6d123f8f52cf3fdaccc9128a4051d245607f8f64bc23a42a98bbd7edbe02567b07080df887c

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit