evilquest | 093a9caf1c2c09bd83b0ae53ee036988a20601c4b8f28dcecb6bdefe2cda06e6

Analysis

max time kernel
150s
max time network
146s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
01-05-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0affee0586a245f75e950e163f857ff8_JaffaCakes118
Size

168KB
MD5

0affee0586a245f75e950e163f857ff8
SHA1

fd0e7f288dac76269d26191cf118392efe3c7eb6
SHA256

093a9caf1c2c09bd83b0ae53ee036988a20601c4b8f28dcecb6bdefe2cda06e6
SHA512

f29377a3d3c1820c1cd089ecc0ad23fb46a7a4cd54d5be42e4e15976e3597ad508a381c55113a14bfb2c2cf18f794f6c39ccb60eeaf9db265d437583cb5d873b
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Wxv0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 15 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af46-0.dat	family_evilquest
behavioral1/files/0x000000030008af46-6.dat	family_evilquest
behavioral1/files/0x000000030008af46-16.dat	family_evilquest
behavioral1/files/0x000000030008af46-24.dat	family_evilquest
behavioral1/files/0x000000030008af46-31.dat	family_evilquest
behavioral1/files/0x000000030008af46-37.dat	family_evilquest
behavioral1/files/0x000000030008af46-42.dat	family_evilquest
behavioral1/files/0x000000030008af46-47.dat	family_evilquest
behavioral1/files/0x000000030008af46-52.dat	family_evilquest
behavioral1/files/0x000000030008af46-57.dat	family_evilquest
behavioral1/files/0x000000030008af46-62.dat	family_evilquest
behavioral1/files/0x000000030008af46-67.dat	family_evilquest
behavioral1/files/0x000000030008af46-73.dat	family_evilquest
behavioral1/files/0x000000030008af46-77.dat	family_evilquest
behavioral1/files/0x000000030008af46-82.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/0affee0586a245f75e950e163f857ff8_JaffaCakes118\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/0affee0586a245f75e950e163f857ff8_JaffaCakes118\""
1⤵
PID:518

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/0affee0586a245f75e950e163f857ff8_JaffaCakes118
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/0affee0586a245f75e950e163f857ff8_JaffaCakes118
  2⤵
  PID:519
- /Users/run/0affee0586a245f75e950e163f857ff8_JaffaCakes118
  /Users/run/0affee0586a245f75e950e163f857ff8_JaffaCakes118
  2⤵
  PID:519

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:520

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:520

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:520

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:545

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:545

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:547

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:549

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:549

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:550

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:550

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:550

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:551

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:551

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:551

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:556

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:558

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:563

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:563

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:566

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:566

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:567

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:568

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:569

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:569

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:575

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:575

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:577

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:578

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:582

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:583

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:584

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:589

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:589

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:593

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:595

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:596

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:603

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:604

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:606

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:606

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:607

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:607

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:607

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:608

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:613

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:613

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:623

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:623

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:628

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:628

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:629

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e0564c282564a301b452224b9e142f78

SHA1
4ff401058d247f0c9c134ce9d5b86bae4f6bb98c

SHA256
725b62b5bf438c25e78a977a37d730e278912b78902dd25e3ba7bb5eb5003895

SHA512
5bdd9f67b33f0e6432dfe209e89cbfbde3f4d7652b0fe1c7fb21bd6a615167ed5cba144626a8cd9634adaeb384e7a71f0cedf3e1e477bb8d23010eb09eabb2d7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9fa531676c43a40b075bc636c524e4aa

SHA1
2afe6f8640966f5b3c6a419d7932e4903659402b

SHA256
c7b3b3ea6e22d5eb25224cf2af84504af21742099cced2cd7569ec4b7f8c64f2

SHA512
dde8c3cee80ac39b3bcfbbd0c583ca38193762ab7c01d3e9edff1f5af2d5f4f9734a49527aa4459fbccb26746d8107493a7e30b2b54e34731f914327664c0596

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
44ee52c84679ab7883b72429c95608e1

SHA1
47d914c7ab7c5c9b52ec0f45047e874065a053e6

SHA256
8a01d5861c81674ac157c9e61b7d8b4c23b19ebfe70e4c7169dafe5e29a8a415

SHA512
301e847826794b386b616eec4206d4b2cb7eef7e9851b61a843321d38cf8a8c303067ad02e4d09343eb12e4eb1522b01a813f7ad9ed73492746e9038f25f6ae9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f8767bcfadee0510013d322d6822cb9e

SHA1
518e3779dd9b3c5ce3866b3b979f915ff20738b3

SHA256
194667fd911d49d5458a0823b96c994cb14c13b43e5905c7d55d061ea9a5effe

SHA512
6d01164d774e19b1603ddbd55c440aeb643478f3d918a61ba09af20912765c32feddbade198d69335f98a9a762d072ff23080bb9509c8c5b363dcdb9ccf51a53

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ae05c93a7dd49a31ea1fe2654aa77fff

SHA1
e218e39145071092b1f81a697f37877200763d33

SHA256
5d8abdf3b5092c79c935968556435b76966aadfe21e6e60a9d139857c4113b9c

SHA512
263ce5c9e11f621e0a6c2cf6d587b146eb01634f382d28c093357262a0a8622b823c0d2dc6e8315b0e1af81c32af5ce7073258fef678bebc5ae03eede11248bd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
af9e740cacfdf48b6598c884e5997c89

SHA1
37dc35868c2a2ad84d40a00bcc684cbcc5658772

SHA256
fc4c6ae940daaf04d0a83ead2f7905b1b82dbb4347e41f84ab1058507c6cc44f

SHA512
b40969de079f09ec97576c36071fa1a397e7914d372f72bc7c1e023307fadf6b2c2ff209e9af8f56e642ab011c6eac39f13312b1e05c69e2f2d8e6dbcd185f16

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4a36673027149887c5742d21ef2da91f

SHA1
9e067d896f8d7d91f5356ddd86f80ead289de98f

SHA256
61546d39e5cadde849f05946bd6ec0f1fdf5db1d2b11a627ea0b5dff5c2de32c

SHA512
902f4b165d55b90d431c631faced5b9b602f1b522dbb036660c784250bd77e84cc7a84f5e930cf22f3f931c20117c9bf7c418f00169d344e5743643da0b41f72

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cbaa404ac4ce071e2cd1735e342a3cd9

SHA1
4535a7e4e2876c12bedb4fd421232f3cbe883b77

SHA256
2e039bfa0c55c6f11347b7ff38489740a30f13a6e5936e8e4c7fd9119f188bb2

SHA512
c343ab6b065291c4b8f80c99cef0b314ffeaccdfe781b922cf84a38eeb95165ea4dc43d4a774aab00edb3f11d412b90ae604c360b9d9d1e527378bdce70a83c5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
bcff02a48eb676366fe1fc17458af20e

SHA1
bd2b661a654b1699f4c134fb72c6f6593676dc89

SHA256
755a368f8e496b5604e8bf31b1aa0332ab2390f9e31eead59e4be5b5e50928a3

SHA512
d1ffdda5310f66dbefe17f8893c85ccc7f4b5b052820fdd0bd7f60ab3c6355b96b9d8da719bf84ce4aa57ca1099ca97ed9655fdbdfb58a2828c7155b7a476f8e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d4c49aec568070c4ccb49b32655189db

SHA1
0940040aa99c809d76f35fc9b14095660448bc9b

SHA256
b56426f16593ca32a355714902d259c057fb89f7ea94bb22a7978a04830f560a

SHA512
22020b9b429d5178929a4d73ffa339fcb287c3da075b274a2ddf27bf3b1d7d8a94a4380cf1bddbb63f14cbbc0a2dc654265b7d72889020d7667c676cc3e0302c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f38da621473be8f26d5523f2cb739812

SHA1
898c9c4113cada17e4ec9b205591579b458e6149

SHA256
05240a1bf2143db9255ef04dc1339929dd053037d0e2a972b88027698ce228cb

SHA512
a47fb639c5581ef35528355971bf223db9d3ff56f2a0ad7594c028df525e812ab7b8f40d680d62237625781f3097d958157296c99e5761450cb49ad796cc5cfb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
df355aa766aa2b66386e6083d2cce10f

SHA1
5fcd20b1294c51fedb18c3438fc9d106a190b023

SHA256
0778708c8e4ff7bbfbd50ac28cee25fffbc9b8ee847ea2984ad74790f37f1897

SHA512
cf43f79cc37feb6c6a33e512713094eb5df8285573e4f391be12dd1affacfc004b9a279fd45d5c84f028db3097d5051939f2fd04f9bfe7b8a06bada022b3886c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
66a743b6c09833c5a55278e820440059

SHA1
54230359ea7559aa54db338d5a50376f437f392f

SHA256
67cb85dd25a1267e25b9536696cbd2d258f41c5c4c094dee04677e4a2516cafe

SHA512
322ce43095288f50ef132c34d9b7598f29b290ef2b8cb9a359ccc9d4fe0caed483ffec40839aace6ad033d6ff42dfa0ff7757e83fc87ff3413e6de37b091d9a3

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
a60a7bcfc47eacaa66e5e3d701d3ba80

SHA1
7093ffc5beca33187c18461c7ff3259a1781ae35

SHA256
17e96efaf7f2e45e407a3c68fb57b78f09dea6fc1edf3732b888be4a4eadd468

SHA512
58736bd680d6c7a25b8d7db08fd4a258cf761dbaa44a5ece0c2b813ab12c20dc213ab40844dfc780687945cf2459f549f1a38bf3da16c5c332756f3b53e1c3a5

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
126B

MD5
95f24d2f9121654acd5a1c44e572082b

SHA1
ea13b61b35ef396ebe42f09e638a39f13b93fd9b

SHA256
2b7b2a1c679a5a0d2465351f35584f1eb6de22160daefb4cba351838f98f155e

SHA512
d1eaa0bd0b245f98a03d24197e02096400abea41f5a36905a41c777bedba15194f3de256c12b4f038e38267147986e8b9dd543189fdc6d1788d3c012bc63270d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
167B

MD5
1340033aca269b30874eafa2ec72adfe

SHA1
e1c0e123ffc93a5f22c906c7206a625a149944d1

SHA256
fb10f63de2c68693f4360c0c8cb0dd64e163dde54ffb9c97932d804df4a4f724

SHA512
587feb19b7dcfc422a0feb360fc1a855a766e518d8a16b0e6b1df509706c0b703270449e5688bcc584002f277981d6f1edbed996abdd81b8a402ba968c2d08e6

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
203a1735fc3697fa08130b19c38acdf5

SHA1
7bcb3837bd9f2dbe9e9fa18487d0600391ecaf56

SHA256
b7d2db3bc219dca142b6d24d0ff26eed835b05f232ced4595119e0b504e89578

SHA512
0e2b8f55f0b4ee8c8c72a8123b635edd7fab8f5353aaf96897d56177594ae172a6618bd98d5d6ac0426f68910074bac9711f304b9db5f9502b08456561b7420b

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1271.xml

Filesize
171KB

MD5
fc82f60979c70408eead10c3a17cb8a1

SHA1
733136626039ac73ef4033453d53d8ca250cca75

SHA256
780e932d83cdee33ab7c0dd34b329b32653e40222967bf32756bcbdb83d03f3e

SHA512
62a17f74e47b3e76323f86e4cc17ef7c40dc5bf6bb7b5d0062a5bca5c3677bf9f68e3d1717e328cb99a88c4a879ec9861d2a3869f7c4fd8157496e522c3fc4e2

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fab8ace580eb0161befb43665592912e

SHA1
56d0444aabe338664e2c40ead0e1217e93533862

SHA256
ca41e74c78cad12c6bc1495a32c00005e83a778b90d12ee9b2b4b0ec3e43f0ef

SHA512
cc783e0e3b367e718fa3b1fc35a1acf27ea36e8f3d9ce2aa5d331d1e1e81e0739a32ca9203420a68bc62b79f2522bb7a7cc3a7978dcfacb3401802e603e33142

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
976c0f0579da2ef22516c1d8bdd39d15

SHA1
9c78cf60ff79254944518ec670f010ff2aab5a49

SHA256
de7cb685258063587aa155f414ea219cd46c5557668165e25f3819a2758f7e83

SHA512
03af6b3f00dc3abc8d34a9f30bd61e5dd6be235fd80ec2842027acea0ec3b51d76050e27b368c2d0835f7ca75b5bd3a36bd82167c007437b3befbebce280aa3b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a63b9bd7705a9892f0179650f7bf83de

SHA1
3f32d5a609182e54536f274a1a9fad26b296b0ca

SHA256
ec655a0c3672f0dd25ab2855c43938e5ecd429721ae5856f7c38859d8cf390d4

SHA512
69b1e96b334c4dfee2ac6b811095b3733f9dc8d873cce8c65f36903805cf6d0ae1516477c80ac07a99f59c605281831be81c7056727e655da99afc8305ed30a7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
618151a5fa2c3051f5f6014d9b3408b8

SHA1
807e43d77eb62f89f1d8feef87f558d46e5e25c9

SHA256
12fd9a29d19de06087b0aa3cdf011f467e4064f30d2bd0f140bdb398334e586c

SHA512
e292f3842f4dff21638a3111ffb7bef5e83b946675ac461cef47fb29343eff9f847209086a29bf8b3fdda3b675f7f153967e405d15ac7c2a3e4af8a0105e5ddb

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b3be0f80f9eb8f89a171ba05975e212b

SHA1
1b1202cd018f3fe4a4150e8323202c3a1a7d4a1b

SHA256
b810d3acd7f266ea6ace2fe2a5aa11c91677c7ec9588194d490870f3ad3d4cc0

SHA512
70fdc43c7bae48fdb500a3b5825c0cfdf4cc3b89c11af17d7440801eb47e1e8c59e69cba7a44de63af947220f79d3877bd2ac3cf64e22fca6dec10151df72b74

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c742ec0b75cbcf381ff43f4019e939e6

SHA1
d6f2c0c496a72b497bf1b1bc3bea734a1a53afa1

SHA256
ffc29568a5eb8e5af7da77ada6a68e583f44ff353409c8fb11bb8fc10f5e9a5a

SHA512
25adb68d91e8c854572908a738685ca6eb8f5d833e01c5dac64e8669f0616b93685085ccb092c9edd28b981eebb337219a7077f37f1e5e12b9f5e28e72f32a77

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f10e86c4ccc79ec1faecab23a24fb1f3

SHA1
b113c8b98598010fcc331bdfae5bd9a202a95a7c

SHA256
639893d4ae3457e4eea25125de95bba2ad11604ef8ed1f20d4e4125e8ed9a2ab

SHA512
150078e4a6357fcd8c492bd5e931932ff3edc13cf81187f54960b65752d80312d4e39dbbabb6e8619570791469dae282eefce9616a8e5e5105eb5f1bee00dcad

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
76ce364aa20790892c65e0c71fc10ad7

SHA1
4b30fee0b725f6213568f0a5eeb64c6b0cec61d2

SHA256
4a2c7dc131837282240bdee3d69243be164df921d5bbbec1d249f7c005e21182

SHA512
1a37fe61aa624dd46fb64be538e7d4f57bf5871d80471ace7a4ca8296e3605d6af0daa15b0adbd27231c146a4d9e9be18fcdd7851f7c4a2b666a0dd02e7e200c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3df40d91a80b4f2c1fec79a151b8be4d

SHA1
53fb669dd8f5521450e20199aca956ce3de97731

SHA256
8d79b9d078f4489091b7ecf71bffbab0f76cebc219b14d4491855a3b0b0de1e6

SHA512
d738437bff76f5c72b7bd5752e9e7c6e54fd4f60f3622d404f463eeb17c7dd4974eda28af9bbb935b35bc47604065850fdf6ce6a20b2479bcc2f731487d84b96

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4d4a68d7b9e26623018934ae094fc635

SHA1
993b111bb75fff00e0b2f87b93bcb2c44ae602ba

SHA256
f5c580aba15ad4d5e29bcd1228f32f0198d538221eb9078923ad01d788cfc8e3

SHA512
ba08d497c7eaddcf4e8f50ff6faeab7bd0012281519da0ba4be1edff8dc64c444e54cd1eb6911f5446ab08a4ca55d2e0007de49c77ae17c0fdd52ddecb380c6b

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ccc95187a2fcd3b0f64d40b82e35964d

SHA1
029e7c44d701b9313a07502c72873a02d9bf8dbe

SHA256
12aaecf2980969e0eb882a2f52d41b8d8bde05f8a202b739411a3ad78d3bc4d3

SHA512
3a9c6d4cb852f61faa2a7699385f93236d86061eb52ac625fbe0af9889bec5a0aaf0f0ea43ba1dc9497856d137cef34453c741a084938d174b79f270142f0f49

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5723ca61a75825d07ed613e8bb459d21

SHA1
2c13d9ac6904ee3ee98c6c074c0643b5e2fe7f9e

SHA256
70757e0418c66797d5360f2fd5c65e27896b0e783cc74cd1a9ac229d7b484b27

SHA512
e2e4db2bc6d5f83d9c70e5b349aa7c9320d3e8c0d4690abbaa1067841d9bf3a49ef7bb0199b141c479dfbf6ce0ecc490a8420bf71b562202b69c4e4c320890e3

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9f2239beddd6f9a32cdefc9e07fd46f9

SHA1
ae6b5ca269a24d04bdc655c6952ad533513d9dde

SHA256
e5c6a47dacb5a71a5af2c99579642753b424d23bfac9445dab00438cefd4a13f

SHA512
fd3aa969e0fe069956e3b0c26aa2d9f73b70487eba667bf9e88772c9011ccfba501b7c5ceb74174ba62c985b544fe2eb771dcc5c403b89ca9cfd2614e75c282d

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
47032afd82cff205698f63dd3d6dc5a3

SHA1
ae2f0aca67df4a91b30c0610d0614e7697955cc3

SHA256
f24dd14bc09a55ac13dbd83c158da651c6d09c57094fa2586a61f72a23db3bb2

SHA512
df101a56a2ccd9f4427822ae7199897ed92528474af763b19eb572be1ace58b473c8ff739d3f4a53ffa19cd2f0df8a23a5932310b60a5d66aa058cb60e473edd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a8ec260589973ef68e1c9a12caa30616

SHA1
463f61cccd51d92f16a1f29690849d2a883f7bdf

SHA256
47825af67723f1e4edc2b8c2d1c0bec157c380613bfc99fafbcaec27db5be9cb

SHA512
818663ccdb5356013a53e04322b72dabed5d2de57f1912b9b2442047119b2c2a1f9c193719f6f16ed160c46855de56728e08e4b644af3a9bdb1a4572ca69cbb1

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit