evilquest | 39966df62b9a3df08f2d5912b4146c5a2c09a9ed44c0f50451993a20d1e883f3

Analysis

max time kernel
149s
max time network
139s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-04-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07bee436d1680dfe9cee9186661f564d_JaffaCakes118
Size

168KB
MD5

07bee436d1680dfe9cee9186661f564d
SHA1

86b5e95c66ae1450826b35c19d359e3554edf558
SHA256

39966df62b9a3df08f2d5912b4146c5a2c09a9ed44c0f50451993a20d1e883f3
SHA512

bbff43d7134a23473d83b60d92f704e0571ce227fba5a590864d33c5cdcc55c045516c0571b05aa73bd217f97c788c3316f732fd6e8b06e7339f060bb57bf330
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9E0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008ad9e-0.dat	family_evilquest
behavioral1/files/0x000000030008adfd-3.dat	family_evilquest
behavioral1/files/0x000000030008adfd-6.dat	family_evilquest
behavioral1/files/0x000000030008adfd-14.dat	family_evilquest
behavioral1/files/0x000000030008adfd-22.dat	family_evilquest
behavioral1/files/0x000000030008adfd-28.dat	family_evilquest
behavioral1/files/0x000000030008adfd-35.dat	family_evilquest
behavioral1/files/0x000000030008adfd-40.dat	family_evilquest
behavioral1/files/0x000000030008adfd-45.dat	family_evilquest
behavioral1/files/0x000000030008adfd-50.dat	family_evilquest
behavioral1/files/0x000000030008adfd-55.dat	family_evilquest
behavioral1/files/0x000000030008adfd-61.dat	family_evilquest
behavioral1/files/0x000000030008adfd-66.dat	family_evilquest
behavioral1/files/0x000000030008adfd-71.dat	family_evilquest
behavioral1/files/0x000000030008adfd-76.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:554

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118
  2⤵
  PID:564
- /Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118
  /Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118
  2⤵
  PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:589

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:591

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:591

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:592

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:597

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:599

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:601

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:606

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:607

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:611

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:613

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:616

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:622

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:623

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:624

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:625

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:625

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:631

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:632

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:636

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:637

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:638

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:640

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:641

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:649

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:651

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:653

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:660

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:660

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:661

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:664

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:668

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:669

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:675

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
de994a89a806d21354447754136f86b9

SHA1
3190910020960c6af728ce15c5c8aff56d3dba2c

SHA256
dcbcda6fc62f4bac13ee59c75b5ca51a2850ec1087205a7a333e79d83ccf19ca

SHA512
c39b2f2de7dfe9e33eec79d2f70ba8a80e31341db17f355c2f187d5447414043afc3825299499e4b6ff14b90d9d1b7128252955e7a6f78000e708cd96e19f716

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cb364bf443cf4a01097a57a4fff08895

SHA1
ddbc80a70075a04343f021b1098e14e4aeb69d3d

SHA256
3365fcf1a652894244435fdd876decb7ee12adb416f61871f6acf1ca313b20b7

SHA512
ec60608e96c473544701c98fb97115b263795add1627c09e9c13cc87198fd1a587f625729d02a7f723c995b8a54d4c6d6d74999d717a7e0e65387f0efdd0a487

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
5efaf5b4dc8d86b6cd8eaf5bcd627e2a

SHA1
6442d0209fc73e5950408bfa237ea5b058214ace

SHA256
686dc19a2da2392a868ef4dede8f21a44bdc709d8a599fc736612b2860a0683a

SHA512
4dd56d5d23db84ee9c21e1b997d97762537d42f2c47172da5336ac7a9b240dd7b31afd99fbfdb3eaebb5c83def3e5c1c933eae99b6293d1b842e5002e3930a0e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c0d3665407b7888f8e08c773a67504b3

SHA1
c7daac14898b58882148561572e239f355d65149

SHA256
84ef7a2c407c52572171d6173c9e11d669bb6c8b4d214924b2092de25579667c

SHA512
52219d7f0c25e823d2dc6fcab07b4b01de680330b3fa37da64d9e74271001c985e323686d116711fa4b0303ddba63549220d7033913838d6189c433cceb5c4ac

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
dca81349dd62132431829687ef71d8dd

SHA1
0295daa1acb496eaf4c19952bc93bc41f198fc07

SHA256
72f3d55b617a12d0ae8b048feef7911197838408ab1a9128dc90255c1f7b1259

SHA512
6ab0c27773fa5bf4ff20ea9513aef79ce6df42d30b1753a570d718b7430c08950fb82848347c2a94aab823674b0c0ce2a439febb5561448354f3cbe876fd233b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
06fb2658779b7b23ec7224cd4d970e4e

SHA1
573cb94b49bfa6ee7ef9d1d0409d4e620c00cd26

SHA256
5576b16f99239223cec14dd89e11be6a8d957631eccdf35223d597cbed2f066d

SHA512
e4e7d16599e93d4938383fe8b89db1f654b751b2061b3e43ff0e6fd0fd53129800166923a29a3a7a9a649b3a6506570060b16de2b36952e331d8b14089c98f1c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f129639fc9305ae86e3a3e9bdc1d9a20

SHA1
da9b6dbc03e173d20ca22663d3c1d0982a15a5dc

SHA256
1f483f74eb078e4a5c6465c3f679acaa35da12aaf438a19563fd2bc82220f396

SHA512
30ad2df009f240c9a175e98fc79c606019c3ed6516cceb4e993460302fafab41ff0a1457158940f084761051a6f07e5eb5f7687aa5f81603762e6a50de928dc8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3c69ef5a7d603292b23f961866e325cf

SHA1
1846aeb52bb689f34f16e63496837b9c8e239821

SHA256
1036daae08e1147657c8cee220d517e8bac71dea6e2b59b66cbf148eb79d8f72

SHA512
3cd8700bc3d0dfb263964f170435bc27b9ecbe4d91338a683c83f25a12bc7aa5353912fb7958d52fe6df7731b9598aad814e29b4cdf3d39c22b72a2ab636d9ac

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8729ee4b0466753051de7abbb88421d8

SHA1
e9f40e56fb585e6d9e5de405c9002863286424d2

SHA256
d0864925ce4853ffb7bee003c13f370ab983dbe9d78f5e4f6ee8b22df0475ecf

SHA512
fd06ef1097156477c749200425725904daf8a0af7ca96d6982c2f62d1c4b9b895459586da321c7fa193a1fd6512b2db5fc5efdc07c75e81e7135b43d935980f0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
61b9b9a0a55d42c11d7f0811ea10d246

SHA1
280b6526ae46f4d9d68cf807ef8e40460996574f

SHA256
c5b85ab0e57b0fce06909821c2493e0e74e3fbc974ecc0f8c5d9d92aefd328c1

SHA512
189ddea0d8c6fe1c8e4ec58219e7e2c860d8aac9c6704087c211081a3ef6e14430e44eb5868942097a7cc88a891d9fb057330b60640a5eb16f598e6c84c4f3e4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b4b05245370fd0054806dabd46848fae

SHA1
18956bf46610527c726d7fa3e5ea9bfe7b5f934a

SHA256
b1a049bc5022b11726e191a0e69a3d270919d19086856bab21508bb36c44e11d

SHA512
d81339efeda040c9f91dae96d7a20859cd3164da67a5adcc5b94a9367eea5563feef99c069ae698316a94514df3905acd57cb9d2c7aed8b49dba825297470a2c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6025397b0080f981ad2de38f38ecaaf5

SHA1
b40ead50b81b2164bd90e5d8e2447cc432c267ef

SHA256
75f8a6d17f4761a410e52f67d2237d95298d5092f1efd43f6c049a6e10a35e51

SHA512
d173fbdd1c597263d906c810cfd422daf202eae3840bfd0dabfaf1f0e157d1bb038cd08e2453e309bb6fd78001896ed038b7c765b8648c49df80575d98b51fcc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
1cc07bd546e2ab00f33b25b5c0cdca5b

SHA1
1567a2893dd82b01bb6c3c693b7eb634f85bfc86

SHA256
1825ed848877376cb7878cd4161dfd8c030e82d4a22c4b6ea9bc2d019bad931c

SHA512
9c927dc467f3d3be2d16ba9a508b4c71a4e3b0df881f81fda8ca0cd37883a0b0fb411c3514c4f9ce26a16f942f784913e146805ff4c1c3e1045f65b916a2793a

Download Submit
/Users/run/07bee436d1680dfe9cee9186661f564d_JaffaCakes118

Filesize
168KB

MD5
e7bc164d61954b25d78fe77e19c6f10a

SHA1
66ee7233d0a83a96504b93bfbd3628b7b7bb7602

SHA256
1a0c744a19db04d5556457606ce839f4291c6ff197ee3e78bc991fcd423bcb58

SHA512
226a3224e143244f00bd82e86190069fabb2648fa830c3b055d6377ac8ac3e64144cdb8d926fd39b55d63b999dc14db4b4ccf79b8146a442b1e4105e1a2c7735

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
5024fcefe044057db82c1d71a15eb5f9

SHA1
f2f43404fd8e731746a6fe989bb5f1be3d1725dd

SHA256
99c87e19db6d3cab22c8e6853e5b224a0fde1bdcced68777dec79e5c8f3ffbf9

SHA512
e43f846b48a9424ff2f50f656ad62f76dcecd2165831f926887609e4f562859dcca1cac01754045d993eb268b85d1d6bea3a7400c3e871ce112cca1a1127435e

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
afc278be23099906aa58001d1154025c

SHA1
1498c821256c7e3453e120aa7ed3a5689d2bed1e

SHA256
12e0fbf2343d31c8dfae9413aea11e0d5108aa5ab4b81df825e8e42c6bdfb11d

SHA512
871ffac30770f3e235693e6b44e1873a6128420a77d55dee5ef3548cf9522d68076e77627f0f324501b4261d6d7dcbb71a689fb15d1ca3f8c0c84b5d3c938ba5

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7d45aa386c1025fe76eb1676d6683ca2

SHA1
afb5895492621789ad49641a3872dc374e78a7a0

SHA256
bebae606c21bf1c3894949c23d01c0ef09724da27c952d7b41a1a4aafc14519d

SHA512
201d8b432180665270492065ceadcbd34452f0d3230ef729783f83c9530217ed129c738f30ba8c752a0710d420b74bee927e50c0330ef2e624b16c39f1ee581a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
51be17ca936dfe0f95126d2e1e90b4a7

SHA1
658b664fbdd43dc6bb04a0320ed6fd45aa6015d0

SHA256
620efca6a4e507b20b57a99cf488470167f1a96abd77ce02674d8ddf096fe264

SHA512
9dee33c5db4c4384020c2cc272fd0b69eee491d598c998d861c7add0ae5363490bc5c74c7d4b9db4066464ea85f16ad17491d7426a68f91dc79476dce4969949

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9dc33193e7a7aab66880e07495b54a10

SHA1
68e55a46678aa1e8c1b30728dd3ed4243850b9d5

SHA256
4bcc2d6851073913846b0f89e874b617bc1f841f99d954e4086bfa1e03a5a57c

SHA512
a219a535b70783d45337ada68367949d5b01be62e8ce77536b3e462d584f1dbfbe55f7ea2cb39eba1ddf5db4e15ab557b259c5053334db74b961fb9a43aab0b1

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6c2dd8030442251fcad5848b2abf1cd0

SHA1
09ce9f52c203ca6a6d0dbeea50fd281f13d1252e

SHA256
846f27e2d633a7097e6e4f323635b2a60d942c2a5e606a336e1a17b05a26ca6d

SHA512
b6953c6d6511c57678405fa269b3c003e768123766109be96e7ceb1d9c4bd6df01bc8be98bdd96927e9f7b320a6b87d92c1e585971c60e2ad8b6870a8e137890

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
501a01a422fe7f71c5b82ad4e3e8dc69

SHA1
33060f3b7c8b5393b93f4b2d43c75a856687dba4

SHA256
6f5e757f434b337c3d4ede444354b5bb219788f4437367eee24722e6c4db791f

SHA512
d77ebff0cb99192a39b781ac9907d198ad4be8c89592630aa5eb8213363d96027a8dc6378df689166c141d262e38a55a0822ffce9e8464333b35b2b2f79db405

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3afc774e88742e3c175ade338569cc45

SHA1
4a9f894bd9dcca361c99353ef86c3449920a7c7e

SHA256
af5a518b658048f010b10d2a3e9470ea7e2bbfdbe8a515c17998a86dd5fc095c

SHA512
ee9f318ccd3718cbb23adce1bfc390022cfe47d02d211cc9becea07bb3f89302da543ecfcd5fd728792957138f71b0e3cefc95b7fac6465c8b4d85f9966a7086

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
78e3d4dbdf430df00c2dfa963a1526b4

SHA1
375eff0a0a0b5ba38b7e46eb09499091d3b53058

SHA256
0efdc9c22671edbba8cb768fb6f4224ca6759eefe9a0f9908270173327ef5d54

SHA512
aa10b6afbd15e590d91a979cc57c5a4a031831d21566f6cece80dd65f671e35eb754f2d461660abdf7d7a6753f35fe5ae1a1cbec35117f56269c4a3d6196eac0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c8df5a65cd1281ae00cc35abc43fc8bc

SHA1
bbd00ff89cd48326d0681f8cfcb21d83ba3543d8

SHA256
4dd06cfef6c82ea2c6b5908902658a20b8f436c8643812ec4f4f30ed34cbfc82

SHA512
20ea98a59aff26622e4e84bd143a734ef7dea12447d1c73e493c9f7d2db88e8d9001d239b07e5a8acb20c3ac8f3b3dd2aedb25070974e88466c236bcf0c6caf8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a1ff90ba02e94e0270277604444fd833

SHA1
7c174b8d4e49ba2b2b5e45bb6bb7d0c8b63e7dc6

SHA256
8c655862df9cb8840b3cba237327318c3134dab170fb70644062e5bb70c9c67f

SHA512
feb88223dc7efd54ae0cbdc1e57cdb01ba1174401fb129675c98caacf101e5441ec439f2ba0ee06372787dbc258c89c059fa0ed13561c55f698b4edc0130a802

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c457478309a659f87615400a5be926f7

SHA1
0be84285553901b88fb615ccc049e68d29e227c9

SHA256
a1655474d2e414c012ea611b3d58368ef2e5d5f359d8cb1b761af5479acfce51

SHA512
9d0fc29578f4034425e645ea73c0c64f724b1264bbad925f117fbe662af0c478a8ebebba02cb514b22eed56592519fb60eb25574e22199d69586562577e3793f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
525fd2894b0090e015a959d610e9bb8d

SHA1
edde7656439ca3a0e6b35d3c1724df54f4079dc7

SHA256
fe4d75e83c3ae1ad9fec0aa0093fb901c8d23f5ce071681962b6e1cbc40e8b69

SHA512
dd607ea40f6e09b172d2b3753b168a8982f100682b2a75d507af9b0fb0def2a4fa97494d5b633552350d1b765b7511ae2e77184e8be638d01cf2a351d38f134a

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4581f086f64dae9081f99dc35329705d

SHA1
ad1e12e8fe103e391027a78d907aec12ad58b587

SHA256
a81b137332673f0c462b220996acc233888a064a944bf4f8031c24b616cd7f23

SHA512
b4f0fef3fc2d8dca993b29d488af98485449c1361b4f01523c5a572b622835efc0897ea66d0e86725d6e30d4691fb08c1a18d71af4734247020ef5809314d1df

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
13a0936a468169e043d1405fb2ff0eaa

SHA1
0404531dbb8e43b52f32de64be685444bf889d3e

SHA256
997c8d0886536d0b87327e70c0afc7e55dd4cf4569756f5104b5845f0c7452c0

SHA512
bb5d977fb9753709bc0f4510f8c0e4e7cdc207efe619c09ce9abb72ced491cfbffce991095208b9f48ac66438c2c11a4c9a9577d76b5c730b592b1222c935793

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
56565dc1a901d925dc2a682eb0fe4a7e

SHA1
7bc56f56f371432d341776a1dae2bd45cb98c7c9

SHA256
e8fa550a750d588f885fd3f3a0868d5a7c8c0c820318229a6e71949120bc77d9

SHA512
6054d10b98ab01bf20b211d250f07eb0953e46f99b3e352a5c77c407bc622ad4f52b83083e1987222fcd86d4c6543d81af53edf463d301ea866dcf3778047204

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit