evilquest | 4eeea08d16c4e5c7fca7f44a8a5d37711c8d5e2e014cbe280ae641da7d823c38

Analysis

max time kernel
150s
max time network
134s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30-04-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118
Size

168KB
MD5

0a38fec77540407fbfe0de05c2b911fe
SHA1

e629230630a1c707de6e7f4a988b6a43a9576f45
SHA256

4eeea08d16c4e5c7fca7f44a8a5d37711c8d5e2e014cbe280ae641da7d823c38
SHA512

49524b2fc49fa0dc72e7dc0a80b8278a3ce8201ce8dac4bf227c85f82c5d37ff8208c105087601f7fc0035b6be400e35d66f350f6610a281ed96b5ba0cafd150
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Nxk0:5SeOQdaZNxtk8cqhSxvHY9N

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

resource	yara_rule
behavioral1/files/0x000000030008af48-0.dat	family_evilquest
behavioral1/files/0x000000030008af48-3.dat	family_evilquest
behavioral1/files/0x000000030008af48-14.dat	family_evilquest
behavioral1/files/0x000000030008af48-20.dat	family_evilquest
behavioral1/files/0x000000030008af48-25.dat	family_evilquest
behavioral1/files/0x000000030008af48-30.dat	family_evilquest
behavioral1/files/0x000000030008af48-35.dat	family_evilquest
behavioral1/files/0x000000030008af48-40.dat	family_evilquest
behavioral1/files/0x000000030008af48-45.dat	family_evilquest
behavioral1/files/0x000000030008af48-50.dat	family_evilquest
behavioral1/files/0x000000030008af48-55.dat	family_evilquest
behavioral1/files/0x000000030008af48-60.dat	family_evilquest
behavioral1/files/0x000000030008af48-65.dat	family_evilquest
behavioral1/files/0x000000030008af48-70.dat	family_evilquest
behavioral1/files/0x000000030008af48-76.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118
  2⤵
  PID:520
- /Users/run/0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118
  /Users/run/0a38fec77540407fbfe0de05c2b911fe_JaffaCakes118
  2⤵
  PID:520

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:526

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:526

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:527

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:527

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:528

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:528

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:529

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:529

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:530

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:554

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:554

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:556

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:556

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:558

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:562

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:562

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:563

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:563

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:566

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:567

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:568

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:570

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:571

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:574

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:575

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:578

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:579

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:580

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:580

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:587

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:587

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:588

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:588

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:590

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:590

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:591

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:591

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:593

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:593

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:594

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:597

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:597

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:607

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:607

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:609

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:609

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:610

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:611

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:613

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:615

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:617

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0a844ae8fa156e1a4342893183219ce4

SHA1
718d982ac6e1fc516db82ed20b9887f8259677a3

SHA256
3740039de13328dca2daddd473e8c2a2debd8c0a6805e7a036dc9ad9029dc143

SHA512
c714db9562fcbed2c7d31b006f0637d0acd195974f4b82d071d3e9d1a3753401f81fa1acaa67671272e91530670609b4c35793c93deba06944dec266a1418826

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e2fb8ec1081bed99f5aa2f1f78c69702

SHA1
688d615330b8ab6336f6ad1599acf381e2464f89

SHA256
211909e4899a4cacf97f388282cdea7079fc55b405d06811c109273c7306f06c

SHA512
ba84b8f78248f985ff6e67b98af88b0619af73c5f62777e4f7169177722122518fe7f0fea048ee8a12f33966435bd66fd5753298d579686e5066a6ec30059ae8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d1e7e24334b9d71577a49ee6d1f77cbc

SHA1
cb1f303ac126723f8bf5fef610dbef62d14a9264

SHA256
473c2bfbd18d4fe56f92a0ccf34fff50dc8fefb5442f425bd7d905c4fd823372

SHA512
780dbcad855bd9bab70e9682f1f94ddd677926254603ce57b185ff2328886d6309efd4b05fc1485ce9c8afb074ffffcfbf6ebd5935b868b08667c3a36984cb99

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f0d0e50009d7c723cf6706f1d9b1fe21

SHA1
574685baeb486ff3ce66c1f01d540eccbd05a92e

SHA256
7de35e0a96f8a482af17a5d306334307012423b527321d24c9a1f7250e2ad248

SHA512
6ff3fa399c27db732c1cfadd7b970f22500292d2f812d5e3967236978b47f897ed8dce7a2933e1d644ab27bc860609fe80f44d9a511ff63db71863cc369d45fd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
34d61119a7a3b4a6e7205b83191ff8f8

SHA1
6a759336b18ac783e68a3bc40cd0b8155ce0e84c

SHA256
4c4fd73d0d5cf967104528c9bf0964d497bb87e45b597d3b3a9aad2a926fbbf8

SHA512
158edab4fe7a6c27e3f2cd7ebf61f42457ef8f6eb47baddbae79c454944c198f96866993f824a35374d8b750d777b2ce018c41c4d9b59b5e86a3988be91637d1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b64bd43a74bc593077bac089be46edd7

SHA1
bbac42d8ccd4c3476df5f55979e317f8497d3483

SHA256
93d4de1796ad3a4daa3eb91a3b0f15a943013ec53c5e547a0038a1413c3684ef

SHA512
ec0b0d731e55ac190a08b5e33db14f0813a0ede3ac8bad15f6505899b7a030e525a8d3e8c86b5d74fcd12f2b4d0d3ac3e3e04539bb070e811e5ff69940ae4fee

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6050b78041452acae7a1e86bba8f6568

SHA1
a9e17754773623ee83cf4292a7850e0ec6554993

SHA256
a2c56cc5b7bea3dac480cb5f6fc49ed2dd8b0f7d0e75be7c6bdf53f2b20d0274

SHA512
099c4739973a5b705f3c8594749ea68dfd626798b16d800ebe994a4e7065007e1c17f44ec566fabe08c7f33a67c31648611559f289c4922ace76fe23b9c9f024

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
8ada08c99b2ed20fbcb8b3521e03d243

SHA1
425c10855719267f5e2a0a18ce1ee9b003486ffe

SHA256
ddb44dd9391ee341877a8e81b6de013ef7b275b2a89ec3a7f94fbf8b7b94cf36

SHA512
c605f527357d322a8926b7a826d713854681d0246f5032e2bf8e4444463b310d4fbf617e5415441bc0baeb72330e0141e84b60fd8c9fe9df0b17756dc7ddfef9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3ae2b2e77bf44ea191ff839da5c73875

SHA1
c977d048753b0213d07584bdbcc0a3e60af9cd62

SHA256
182bf8793091e2ee15eaccb6c946073850779c298d9c3ab21be74df1356f73b5

SHA512
6951521e2469907373acb1277dc2b08fa91201338766e828721833b2b16313bba7adae7689d7b9cc03b39773c7b19b193769faa17d0c6778812b436f42da6f04

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f7380702200a46705cad754cba315582

SHA1
bfa1f2b45270dbf3c83133487a443a4b3573165d

SHA256
f3e5559f542326143005ca3e1d8246271a957009b45aece9baae69a920abe90b

SHA512
643c7ea69102f93e9a951b9072a701f36f55fc9b0d14ecfce20795e674d677479c9a9385b25f3d610d7c83b97cabb4407f20004720e6d6f7cdac90c21fde5171

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0103ae946835b02dec0a45b80d9eb35b

SHA1
c6320f21ca2a3ac65d9b9468b1202f9c376739e4

SHA256
32c84439ef5a9a1233d9e6af2839f5d4143b4225c507b46a4701aa579ccbefab

SHA512
17120f2b7f1edfd652c3b61f678f83f27c2231368ac59657dfbfe1c5ee779c61222216ff4f04faebf560e7616aaa2a9170d40bb376842f886eaf6c6f0fc31288

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
480f56af7e77b202bed533c5a6a7b32b

SHA1
4657b15c0ba593b857f5c9878de069b859871707

SHA256
331d33f03b08f35b473e1ec5547789ec09745a01e8917b999016be527d1e15cf

SHA512
8e55e165536bbab0cb831173e69895fc81e514f75b641b6237faa24ee8b46898093ffb381d9064a2fd0c06db8c10948e7138782022757d1edb4167ec595090f7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a22b6e63944b2bd068225176aa4d916d

SHA1
7ad44befc31694a1185c6d3a1d17c01fae730017

SHA256
eb54581e18b2915ff746de867b7a45be9eb20988a470da48a99c86ab4be2276d

SHA512
efab4eb0ded140f911037b7862aa06e27b3c21c6c6a21e9e8112fe8514502fd62db9b33c5aeeddd32d3cc740b9cf2e72e50cd8949230bc486e61be80ca9f1a46

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
77ad158b4504f8044127ce42681cc17e

SHA1
f3b327a018591f5564966a186f69df9226a65f05

SHA256
0979efe3a496c9f488cf8a2cbe77d935846b9442914b4680c20b7e109210cb09

SHA512
bbfe6aece3be945b2e0d67cd5d28757c97c871273a9346784e1b4b53358b187aebf4a91ad53a0a87042fbe5a430b4158d6990d6f948d0bdaf78e75150c2fe5c7

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
b1ed708172d55fd3ca68bd25e5770245

SHA1
94786e9e5f5b6746fb4f2edbe4c07a6270ff0f01

SHA256
e11035ef17ed8f58afdc8c6281d1f0d51c7ee27b87cccb73319ff004abe01767

SHA512
fbe5ee5cd56c6b2aecf38a081ffdfe8950f41aaf54bf0e0f4801009f7fbea6aa67f0d75586b1b9e14c93d556f06edfda199f1ddaaf6c0ff25bd6a454adc8faad

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a99c1190e88f4baff3786008d7217b05

SHA1
d8056f9cfc7af0cacdad1ffe490f441e4022f35b

SHA256
3b91709be9c6f258544293cb6c07262a75c53df6d979ae597d62ab1a02ca73a4

SHA512
736b50163a75d1463595ce4a5f6b1cc04b5b559e6b6f4d5ab0089d8ab066697d72c0e3223a07682712a31b624f551bcfa1e3a7e3f906728b1abe82b6bdf1ead8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3a3076cb50f5a09583cc9dc83ed5aa92

SHA1
deed1dc4b19a66e680d742f7a34ef3e43110ec54

SHA256
efd50b911044b39287b2c2a2e617475936947ee3e5c1efd7da78c65c43317a98

SHA512
0229acc34043bf3d5e4e07c153c992b981587c96329ebf36fa718ec0ad6039fb0286dcca8976f4041129996c256ca6381a7ed532f0b486b45cf3f73d84c328c4

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
be9f497b9796fae24a338c19e51ef017

SHA1
5171bb351a79d554fbcc69a69971fc5df658a557

SHA256
2fe1911cb89edcd74888168c8982eea7f135f7b678917522cc89db524ec41f50

SHA512
9ad20f5bc34e8378dc1b9a08e944db9b73dcfb9917d8d89446dc30cff31a9aeb60ce5f2cdab7a602c67870599c414b53146ffe569e95d15662508a537f72b8a7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bf3d6fdabb6b1bf62b49106093a2face

SHA1
12f34a81f53a0bf2e39dc385b544f2857b3d5c3d

SHA256
067c22deea552976a5b9808f94ed124475aae76bcabd4cc989d74d84ddf12246

SHA512
7a25aef36639b6a83d15c74779ad8451f12e7018559ca1285d87fa4a21b2643d315e2e7b19e4dd91008cad345c7cc4bf8bf286f4893ccef8e014e227a25e4325

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5c1819bf42e2cbdbb22918fe4197e947

SHA1
6e90e99987459664f0ebc63263399a59e5cbeb2c

SHA256
51a8b28e076917d8a0d967e7794ef025c66ff137155ac4dffb42783beb14182c

SHA512
c0c311923c8615fc1962d2bf1b238ea09f1d6d495e14f116c8dd85b41bc5b249ec6979c6ca58753dc87d1cb31d68f57e817efc4decbc8eccc6a319f4f900340c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e6c2f929dafa3b1eb6b1c67735c38fd8

SHA1
8e091ad6f4aa694f92c476a88b013e262f753084

SHA256
8e3441335be50106cec33faf83d079945eb7ed2ffe7752996b44c862d360e7c7

SHA512
c78c5eea21e118608b9a71f7e8de73254cccdd675d562b2c141beec6436b0b15022c123fa80bc12f2bbc5aa3255c625b6670ae59d28de0aefc7f533857944c6f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
72b2afad442775e372e67ef69ef8259f

SHA1
669bc6c9c936a55d7c6ab75f5591a23d39633e8b

SHA256
dc410e2a83ebda9bd3ac77a5a833d096a3b21e7cc11fa2271e5f8b97b6cfbde8

SHA512
81f8dcb708ac07f54914089bfd9ec923858196b9d0e5cdfe7b1dd1b84740b5f2c208165993dde5015d9d24dca2e28ffc3464c42947586343ec1a94f6a8c167da

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9cd779849fe2746a8308c74fceca941c

SHA1
6aa76a86f6bb4e1bbdb917496d018b06a1e944eb

SHA256
1656d729846302cb8e286f0f4bb0e6426682f39184de92f2a5e2ba22c6592a1c

SHA512
48c96bc527138d3e2d2f9638b763854fa4ea58693ba0cb6ee55da2fe6e6dfceac769544415b245f40bce1c154c451a9aa70e03c7d1890d818610198133ad9be7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
20c8eb82a267b5964e51d579b6cc377f

SHA1
b203e1db20c8ca94e51dbb54cfb5dd726fc801c1

SHA256
0a515e632743ead75a7898180cd2780ad672a4efbf37c0916a19497706c48afd

SHA512
0fca4de9052b34ec2397a4383a8c61c585c4407be3f7c851d665f673bfd3105257283633752b7a46a1e1e290fe617b646f0b9476c2ee7752705e29336ab0c6bf

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
22d0e640beac8858cf66f77411014953

SHA1
148f313faee4546cc5f52c869ed856a31978f92c

SHA256
e4d27a4e0f5afb5e22df5647a6fe9dfd631a26922adb18fbd097e733826ab0d0

SHA512
4c6bbbd4a1c203778cc53d34025d2642628e1c2ded7c99be358f406f9f70834ad564a749b79d22f3ee8d1e861e35651ee232b70c7f2a6f850b17cc2142594725

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fe658f866d2f72eddae2b13a9f5f29fe

SHA1
33ac607228a17812069b0eb10b9bb9fa2eb7bafb

SHA256
5135b78f62bc401b448615d2819925b29ffc8a0badf07448d737fcf9021bff50

SHA512
68b25cb52ab18aae857b5ac8d5396eef022b73194f55d6326994fcbc492682dc417a455d79b05770d948a865ef5b7c9219792fb1974829c8bfd3fedd7798c530

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
19aeae5b65bf3aefaea733ca48415a44

SHA1
85ee0bf0646c08abe6a5021d42d8f76211b27d1e

SHA256
116ea36dad8252cba4d2f99ae64109b982acd63e22c27c230d520395ca27296a

SHA512
9ee0bf1ae338960cab403c00851d2f5e4df120ee3802ebee8cf54651e71f5d1d65a32a78cf78823e2d6b246f93cbc6147aee19c6d218f483111a541deaed6048

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6d26889959477447ce783c201c935b5b

SHA1
5571450e264b5d83f2b316595ca0514b3c1c2298

SHA256
973b4fc6960c1fae6142f821480c6f22d365d0abeecc68d4d8bfb3e9c5a1b73b

SHA512
1d4fcc119321796deb54a165839d5881649aefdcae6df3fffba3efc44b79f7ccc7ac93ff0f9760bf918bc09ebf2ff6013a970fb7afb598374e29d0df48552d03

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ffffc60c811a78179abda888e08218f2

SHA1
fa23f0c80b0c938ab07b871a6f19c7792c00327a

SHA256
115ec1c447227ce4b0e20d0a4f7d971fa317b63ed656af39268af8e67d2ae03c

SHA512
a60d43e178066f47734c6172d0643b32598413e08479a55a18d0e6423a8ed7bdecb476e6369f2be57726d4cf33e0ada33117bd6b1bff0f929ccb580583011864

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
870627e7d09b888b35693eba2508c5ab

SHA1
d57441668929eb418c882f0435db95c2fb5b83fd

SHA256
f51163f154e9dfb85936b1f54adf7d69f72a40509975f66b6731bfa2a335b32e

SHA512
2a2fffcd4c25554ecede077f64cd1e1a333502a2996dcd7d57da6cb0f87e660d3a22b6f0b6ed85033234cbe4bfcb6ecb7f76d2dfda70144419372c0264e99383

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit