evilquest | e21fc3f71bd49261bfddbccf1b8896315d8ebc55b31cb5ed3d1978156389188f

Analysis

max time kernel
150s
max time network
139s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06-06-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe
Size

177KB
MD5

27317cc6fd4351abadc55b4ac555288b
SHA1

81714beadab2148d88a3c4cd388e259ad5c8d819
SHA256

e21fc3f71bd49261bfddbccf1b8896315d8ebc55b31cb5ed3d1978156389188f
SHA512

5dd60102b814827b5725602ac6499b7af77e814409f6e5f8f9bb5b4b2c8ed5e9ca7683bea3b88b5556b4bf7d71c05ab86ab28fdfc130252e427ddbf712a0caa7
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq910t:5SeOQdaZNxtk8cqhSxvHY9q

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 11 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008adf2-1.dat	family_evilquest
behavioral1/files/0x000000030008adf0-0.dat	family_evilquest
behavioral1/files/0x000000030008adf0-6.dat	family_evilquest
behavioral1/files/0x000000030008adf0-19.dat	family_evilquest
behavioral1/files/0x000000030008adf0-33.dat	family_evilquest
behavioral1/files/0x000000030008adf0-46.dat	family_evilquest
behavioral1/files/0x000000030008adf0-55.dat	family_evilquest
behavioral1/files/0x000000030008adf0-62.dat	family_evilquest
behavioral1/files/0x000000030008adf0-69.dat	family_evilquest
behavioral1/files/0x000000030008adf0-77.dat	family_evilquest
behavioral1/files/0x000000030008adf0-83.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 64 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start afsvcpd
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe
1⤵
PID:562
- /bin/zsh
  /bin/zsh -c /Users/run/2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe
  2⤵
  PID:564
- /Users/run/2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe
  /Users/run/2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe
  2⤵
  PID:564
- - /Users/run/.2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe1
    /Users/run/.2024-06-06_27317cc6fd4351abadc55b4ac555288b_adload_evilquest_rekoobe1
    3⤵
    PID:630

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:566

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:566

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:566

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:553

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:590

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:600

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:594

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:596

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:596

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:596

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:597

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:597

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:597
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd
  2⤵
  PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:601

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:602

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:602

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:603

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:604

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:604

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:604

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:605

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:605

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:605

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:606

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:606

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:606

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:607

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:607

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:607

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:608

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:609

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:610

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:610

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:610

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:611

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:611

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:611

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:612

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:612

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:617

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:618

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:618

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:618

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:619

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:623

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:623

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:623

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:625

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:626

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:626

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:626

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:627

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:627

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:627

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:628

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:628

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:628

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:629

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:629

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:631

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:632

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:632

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:632

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:613

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:634

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:634
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:635

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:636

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:636

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:636

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:637

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:640

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:640

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:641

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:641

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:641

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:642

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:642

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:642

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:643

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:643

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:643

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:644

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:647

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:647

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:647

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:650

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:662

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:663

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:663

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:664

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:666

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:666

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:666

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:667

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:668

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:668

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:669

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:670

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:677

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:677

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:678

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:678

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:679

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:680

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:680
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:681

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:683

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:683

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:684

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:684

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:684

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:686

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:687

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:688

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:688

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:688

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:689

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:689

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:689

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:690

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:690

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:690

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:691

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:691

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:691

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:692

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:692

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:692

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:693

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:693

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:693

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:694

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:694

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:695

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:695

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:696

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:696
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:697

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:698

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:699

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:699

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:700

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:700

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:700

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:701

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:701

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:701

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:702

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:702

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:702

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:703

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:703

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:703

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:704

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:704

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:704

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:705

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:705

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:705

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:706

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:706

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:706

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:707

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:707

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:707

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:708

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:708
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:709

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:710

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:710

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:710

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:711

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:714

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:714
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:715

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:716

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:716

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:716

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:719

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:720

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:721

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:722

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:722
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:723

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:724

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:724

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:724

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:725

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:725

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:725

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:726

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:726

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:726

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:727

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:727

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:727

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:728

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:728

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:728

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:729

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:729

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:731

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:731
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:732

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:733

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:733

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:733

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:734

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:734

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:734

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:735

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:735

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:735

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:736

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:736

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:736

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:737

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:737

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:737

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:738

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:738

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:738

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:739

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:739

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:739

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:740

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:740

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:740

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:741

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:741

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:741

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:743

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:743
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:744

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:745

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:745

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:745

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:746

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:746

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:746

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:747

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:747

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:747

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:748

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:748

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:748

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:749

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:749

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:749

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:750

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:750
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:751

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:752

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:752

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:752

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:753

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:754

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:754
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:755

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:756

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:756

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:756

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:757

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
158B

MD5
220ab4317b16313344a0e032b1cac248

SHA1
bbc74abf2437082314e1d18343dfcb34a644661a

SHA256
91349c22732c75eca2e12a023476ddcafbeb1d45c08b4ec47bff94209e40bb82

SHA512
caa83d82e74b1ac9a353e3b974da53fdcc09ecae65bc6070274abdaed268b919f6fb2e0c277fc03e0e6e762f24d0efd9e674e3b08d644177ac0415be2c39c66a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
158B

MD5
a9d8b3b799ffd2e47fb44fd2aaa95a88

SHA1
01e7ed42083ca42e3dee7a1628921780e18beab5

SHA256
774481b0763e4aa5d437054d4e056dfcfe30c2fb139b7dfa7b18371919adf1b6

SHA512
eb62588c179b78b1e5ad13cd8a0a1cdb6cf944ef4d5faf0a2863c485e60d6e9c54c4b7b0f7bcdf0dce652a7e10c621524a04202fd62f0e0f22c9c85495a1bb9c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
158B

MD5
da5795166162ba7c476e9cb7be5798db

SHA1
bc43b34978e8c6547b675111e9cd2e3611bd716d

SHA256
7c158095be5b82fee00c9b4dbfcf69ae9e1a0e8a85d61ce59dda2588160c67af

SHA512
7de1ae925e9e541a6a51e12b552cefec51eb1fbc60ceabdd5c42684d2f88bd9c4d726568dd656ff133e5b3c07d475697ca2de7e6a9fe831d2b0ed5cc66642c6b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
281b27b27a4a8a04583a1880143e781e

SHA1
5efa95c7dc461003bc878c5e62e25c52a2458729

SHA256
11b926f21563d75e3d7e8d04e8a438189339875d2267e117f2534ed3061bc77f

SHA512
36162872679ca3ea8974b8ddac4c3ff8965ce4f3247ba77a6259bb97d68567d4c3df80d3cd15666ac1243c9122c58030ee75156edbd4edf2652a15f75ea137d8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
e4c01d077031e643f11bda2f4b8f0c3f

SHA1
ad7ad53eb38f50a613c6b27375573f999982863d

SHA256
957e163091bcc3648196f8c8c66ed426fc6055683abbc204f26735bb2353885e

SHA512
7ac19d69e13b6bd55e2dba2071100a165faf0ba7a9f2d931478fddb7c6aff3b4f1f084dfec708645b3bda7a37361295a9d6f6decb209541819740d3a4d64c451

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
6988ec4bd70585580172959fab323518

SHA1
f685345400aa3dc740b262bcf2c77363d8d71ceb

SHA256
b0d4d94a9f89e713f8190c469ae2ac044991642985ca0e30161535a93aa3516f

SHA512
5817ba77a08c1d03b6514b37768e54816cbd615aca57a6c019209625708f42109ed6fc1a55b943d979a053717b6c72d820d653ecacd553e0b3be58a9e951fec4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
913740c735bf2b0b01e383246b80a7e2

SHA1
ab34d24c41b583b21aecd738df17d03a9cf44f15

SHA256
1af70e678001b606ae953197fed03194f153443ae17036e57656f051adb2eec9

SHA512
df7780708c3c5102a6637e4ea37174b5a82699e9af569b24035e15a75af495e0d1e06fac5d42138109e8c54bca00547dca04f45dcd1081f678a17776ae821441

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ad64edd644373e4ca9fd68344963659b

SHA1
c463cfa49a984f412222c7ed617440a6f1907c21

SHA256
7d604857feba11157cfddff8f4bd9a19edb6a04aebb5dc465f82a84e5f8746e7

SHA512
8d7024ea42ffb36e98089fb475722ab099fe46a711b849d9bcb100a7b3f19225e6417c5d11f92dace45ad4b9c6e279f5f30f966da6363cc09e87709e6dd8e433

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
d86344b2f4b093ce4ef4655838d36502

SHA1
3e78b897806bc39654612435878ccf136c5f01b0

SHA256
03bb60c73b86f8c7ae695aa189524c8059741e20d324ff19cce7045f5ff0a64b

SHA512
3df484b046e9917828e34bfad19cce5747fb061aea009838edd958d89e57d4540ce7863abff26df505b2a166a4753b31d76e28989302bd3b3e1922492b642f17

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
03e9b966bd6041a6099b7002943e4644

SHA1
ad1045e5be3ffa29fcbda49be6bb2ac22b2fb9de

SHA256
9311660b188bcbec7d68ac4798b306b78e542b92738b1f8f121a9db626df2f0c

SHA512
0828fc73b2d1cddf532810cc774f5a3c199f8d441ce1253119ef134fd1650bbafd759ba13ff43b25bfdd13dcfee75bbb58e913134cd356512d0d7f6e069e04ff

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
55e5ad1c8b96a5cf102688a8b85bf5be

SHA1
ca85bf84fb24c1f843a07a38def069b3ccd0996f

SHA256
b287d694c5c6502bb5aa81fdbcd6fa09404a8384ba9e88013676d5586b069670

SHA512
3f604a06076da111ab593d37e9e398a50113b62735a9efd343c9f1f2263383b15a3e3d4f51d1f5f937e0495b18a3a42f71f849f75f696d0b981d51fa38952fb1

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
b3286901d7b995eb355bb1a80f0bd1ca

SHA1
db9356faf7364152391fc5848a60d3c7018de3cc

SHA256
aa535db2c11508b38c9416091a38cfd2b6030c85f0f449c9bac50e7c703abe68

SHA512
dc0823f0bd5870260876a8b438136e8ceaa0c02d1346ef8cf3c21c6e0818034243dc730deba9e4882dfcecae51ffc552b0c00d51709be4b1fb5a6adae7799f40

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
d7338f511658de269bb4cf89b0863da3

SHA1
41cd7392d066419a57d110346fd2bb257b147114

SHA256
48119ea0eab8df00b28aa5f0a5344520b5b1c3cd25d75a52a147d60a34f94850

SHA512
4f9eccd2c009ec11585a2539d9f235ee876c4a6a5ac41f67d528cc10620b12601c0f8b321cd487735827f2c87ded8b8f28c58b95a5ebad173ec107335c5affd5

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
e4c621ca388b2bbf70d9f5debb15f2dd

SHA1
e262c4ca7bc2b59e2d24a4d1e044239f090728fb

SHA256
cc763410aef3ce7f65ead226e96f7736ae3d6e97a6ef48610142bd47151dfa1b

SHA512
42c2beda3acd2e5a20c06451b21c0bd1508df41c16ee9c360cccf4d481a5e13d0283f5830eb549b110c27157dfe8ee9dcdebaa3fd717d367baad15ae6a22669c

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
0d9c1a7e30386b3bafb0c120910c755b

SHA1
f399f743fcb65eb28726e375b80401a145cf32dc

SHA256
b0db2150bd3843cd457912a1244d72a7509367ae1e7505eeb24da5e4d4014f2b

SHA512
3ae984f4c24fc055a77b442cf7280cc1a02d0c90889a9b973276614ece8f387d4fa938ab7ba06846eb4df3b41e05897b18e1a456c3e2672ac754c450f38b842f

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
3bc81ea790f042cea101669bc8b631e5

SHA1
06a7c7470c9e85f96bad343044a9c9536c5a5df5

SHA256
d01356da59de8b007b21614d2daf82544908a7ba8038d7c1af6fef6930c94fbc

SHA512
09dbb3c4fd63f99db16a87da747dc269aa05166f6092abc235386e68f2c90f5ffb316c78931abece24fd2fa5fb1f884f85ecb03f7717cd6ad65e55288a71a260

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
356c145c2079b30f62c93f7ef06487d3

SHA1
5c273bd10943a21dceb422f241cd60ffb9e453cc

SHA256
3592db5cd6be2060f5d333d4d17df65632aa069fc7ad63b865d0b965c1774e8c

SHA512
de260f29411159b980e9fc145543f2145f88a85104ba6752dfd7e8ff4c61bf923923daa1173d16aa04520c82df7cc55cc531a8b4d57f6eced14bb6cd92b341eb

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-06-06-190317_tests-iMac.crash

Filesize
41KB

MD5
5cb0995d43f383d5d9ac0f77f1190b6e

SHA1
3d8554e256e66c67fe60fc05c8c9b0fcc648deab

SHA256
e6a73db1edcd741d77030e888fcd8ef250248d36f0cffc21571812f4dba091b9

SHA512
bc181e9454db4b5dc37a41a46fa7a5d94b24de58f0de3be1577c5a95a72b83ec12116097c77ed46a2e6cf4cde197bccaa6fe3e4577ae8b3a4e3ad614ef4223cc

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-06-06-190328-1_tests-iMac.crash

Filesize
40KB

MD5
04af64a6ddbcd5c8f2f37ea0e83292c6

SHA1
8830bb39a7a3b9aa22a5566f203742b0a7917d4e

SHA256
641764b1f76113400d0cc9f3c0906c61b302739aaa0104e19acc33ed5a104d15

SHA512
5b0be109ec87a764f862a2ad0dc8de994f3725f4d965774184278d1707e3703de1dea718fda8dbac4db858f9454c73163ae6f8ba88fc552ac603366cc2943f47

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-06-06-190328_tests-iMac.crash

Filesize
40KB

MD5
d4e8a6305e2ad06b14ce22db72e27541

SHA1
8b0d9c2ad971c178a8f97e0da6aac91c17938132

SHA256
c5670ef553282082862ccafa3bc0e8b1d75ba168c08ac196552c44718ca9d141

SHA512
c8164acaaa29ed00bfba47aa5bbe4b6fcd7060794d543c0a756cb4c885e9c9b2a218166296c6e2fdf220933bd5355c32687680dfa42d27cb6dd766d68f6b5c3c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e387e8c45841284d00afeb23db94c67e

SHA1
aa1421aa8fcf51b379b0dd6199110374f57dd0b1

SHA256
33c98dad16bc9f7eae968e5dfa0d2ad1abf139a7714a48ce1c94f0474a15dbf4

SHA512
2856e4102520e4a758175aeab02430fec0df3de36dfacd90348dc5fc2d1525f00c8662eca696f81fff74ee959c360d479b85a90ee1ec135dd9c9c174ce6e21ff

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
21832436996ea1f55990fed23be83272

SHA1
d963d92c2e7d760e160bfde4d2f626acf6d1bf4f

SHA256
41fb8aa435c06561cbfe7c1d26c7e6f4d83edbd1349c201d1980a1d97594fe33

SHA512
8e0fb67c3af07285837fe4f20118697ae33084a42977411b61dade23d7ce510168075c9a506e457d6ff4be7043e1a80ed7a7593b794fe71891e8899e7e30b356

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
732d16586cfc1a8320c8a9b364868c1b

SHA1
968f74340d5762258d6045c2e59593f9ca7186d5

SHA256
4c5a40d1783f989091204da228eaebfae80784758d95439e69b721fb67d5e8bf

SHA512
04fd3667af9a0053fdb1c7fde6b64cccc9c656bf460c5efdde81d608a15c305fd77d1311d9f25f86fa187b65f266973f8fc06cfc9376b3c3b507b90bb1d89324

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0e557231ea4e1db1c2d383e229a8bf19

SHA1
2a97d065b702a50e983c99d9e0e4b51971acda09

SHA256
7900fb92da711063ccc021df97fb688556c4f699b2d81c3a8f98546fe3784f6e

SHA512
19c203ca1351c3cc0f7c867752f260656e08a08d198160048b437ed1aa7666ad0bf9a6bf4f343e715733d031dc8ed6ab3b1cc70769f3dd5834b571535e12148d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6997e56e613e6f67429f2636cffb46ac

SHA1
5724f497eaf5e11a3f39184f05a3f563f892bd70

SHA256
c88b2ad35fdb166d77e353a8ffc4c9d88202ca17cc8fc910a08356fba7a750ea

SHA512
7db7b6a48362137d52ae0e05bd3007cd272dde06e4eddcbc9dc38234e68c66826f768fcb838429c2257e7cee216b236dfcb194f1e1eff99bbc8efb9dbd55e11e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f8ed5ec916fd9db043285b7f3c259a2a

SHA1
a63f2cf7ea4231dba044e1c84381d0ef518d0cc2

SHA256
24428eae8762510ea0a575856b5d0406cc6473090fb678c3c91c3537798ad94c

SHA512
92715ae816bc8816aca4a42f917e21d447f82829039802d4ae42920da2035a70d0235991ff2e31fa3fd29a1a35e636df68f52762f463f63c4ab82e11a0b98c94

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
eb47e2df77a04273d4d152c8ad5ac546

SHA1
a371836fa199ead9fd6e7458b49998110f20f4d4

SHA256
9ae81ec5c655e21f152972b8380ac8064ffc473a2c8ac011d71946d6ec72d5ea

SHA512
5d6fcdf72e028259ee5add517c0170c87d649396e08fe8660a8a67d9201c2038e7ce2ec1004f9e475716947324fb679a869674a1ee0feaaaaa07aee468adae01

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0733a9b82401ea982ead4a277dd80721

SHA1
8858f919f08e2373bf027d73c2a2ef7f4fed3edc

SHA256
863766869bb60223c540cca146258fc8d9de35b98881bf8428e5d2a47c240174

SHA512
02075176f406a7d4bf6ec3483804960be436a203bdbfa1fc93484341e42e64d388195fdfdc2a51cef7cae876485b439e868ccbb1e6da6c0e6892bb874370d900

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6aa88495b5e3e7555bfe4aff4a182d9c

SHA1
b289b2da4fd5158cd253a0027dc61d0b8abccbbb

SHA256
06d63769eb58d2438dfa8936bc32cd40bd949bb368a6a4138ffdff772ceb8fd7

SHA512
c75069f00966b34bc6ad9ea1735f5f69a144393996963a596c8c4500598140241e61a785de3d5779aa9659993736dc5a7bf561155d87f953ce3c35866257867a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8e82948ab2302f3a86c491590fbe59ab

SHA1
b15e9c3027f2e96f80168430ec00fb47aeabe290

SHA256
1d5276b89c6c0fe903eb6a59533940e95ea01dd5be0c49cb361a600a38801d0c

SHA512
b157254107663277fed8afff740ed531c2b405e4bf7bc95667e8f2264a80838a449c14365bd2279432a531c0fb7e5a6a2406925f315d272095d55aa1cc7b4d1a

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
838c499fb18df8a534a5981812708885

SHA1
a320240c3e1a08458bb0705eac39c3b3c8c94984

SHA256
c468b14662f31cf70f757722d2ad39baf10667bbfc489911efa2df816789a600

SHA512
628972c8bd81d6270177fe704087fad64887e0c5b442ee65d13aaa735979ef2fbe97396be53dae1340ba8b7836c104dad5213f3d5001df147b68189b3bf4beb1

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
d1b0f7e26f99260c2e99ce686eaee24a

SHA1
956f55e604d879caeb42fe08c172169800be6153

SHA256
0ee39cb3b76223d154482eb9345f3bb5638b00b09acbea12b43fd1156966d601

SHA512
1dbed68fd28bfad48eebea9b7926a8b9fff3dacfd3b6127b6c746b2e2cb8a39ea57ec7dc01da17184d6f195777afa60003d261026a4369dc150a13abce7a3fae

Download Submit
/Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
430B

MD5
3d269391b44f568c96f9f5a420609082

SHA1
e2d49405da7ba6f883b366f71b6905b6ab556cae

SHA256
261e6af4aec0840afe0b4c75c21353d7bc8d69ffb1d26db364f5475962381a12

SHA512
81ae24faac0d2973a90b7ec7415273f95789fbbdeae164df6ffab10bfdfc4896d6ecf4d9b09ca13b2a151a385c59f48594d7b3d0df3b49e3bbc056f15908432c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1eb171f4fd3c06d43289d1b1f07ff760

SHA1
297f5f9a8219d3fe093fb8093273c1463fa864b6

SHA256
c766cf054a832069e6d293db3bdfcb583929b2a1f2fe58b83bd3b448ea7a82a4

SHA512
b2f7bc52922a5d4dbba2cd4431548963a63e8859df21c1c4e6838c03e12eca33605f8d01ae63733d52aaf4610c8224bdc9e2ffdba579a6265eca9d7e75d8e7fb

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1285.xml

Filesize
179KB

MD5
9a43af57707d2fb460832049d1f217d1

SHA1
056d813f8cb5198ca82072f7e3484f38ea5267f8

SHA256
7224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c

SHA512
1f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit