Overview

overview

10

Static

static

10

2024-10-05...ekoobe

macos-10.15-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    05-10-2024 04:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe

  • Size

    190KB

  • MD5

    2bb6bdbce1793626f4dfeb1a1179bbc4

  • SHA1

    c7372c8f8ce2ca2aa5e0e698e1d0053832835a1c

  • SHA256

    0dfe7e6e2bd79947d160d69186efa14758843cb619abbbaa71710a22ef5b2124

  • SHA512

    7a3f5ed03a511d9f6f71064c112c7743d08f2feae75f866d8e142a07a695b62a6c9f43cbb897ba62fc5b607103d169656eb133718291947b0c9d1a0b28d8f0ea

  • SSDEEP

    3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq96w0p2Dn5km:5SeOQdaZNxtk8cqhSxvHY96R2Dn5km

Score
10/10
evilquestbackdoorevasionexecutionpersistence

Malware Config

Signatures

  • EvilQuest

    EvilQuest family.

    backdoorevilquest
  • EvilQuest payload 1 IoCs
  • Launch Agent 1 TTPs

    Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

    persistence
  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

    persistence
  • AppleScript 1 TTPs 60 IoCs

    AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

    execution
  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion
  • Launchctl 1 TTPs 64 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe\""
    1⤵
      PID:483
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe\""
      1⤵
        PID:483
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe
        1⤵
          PID:483
          • /bin/zsh
            /bin/zsh -c /Users/run/2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe
            2⤵
              PID:487
            • /Users/run/2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe
              /Users/run/2024-10-05_2bb6bdbce1793626f4dfeb1a1179bbc4_adload_evilquest_rekoobe
              2⤵
                PID:487
            • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
              /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
              1⤵
                PID:468
              • /usr/libexec/pkreporter
                /usr/libexec/pkreporter
                1⤵
                  PID:471
                • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
                  "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
                  1⤵
                    PID:480
                  • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                    /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                    1⤵
                      PID:474
                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                      1⤵
                        PID:476
                      • /bin/sh
                        sh -c "sysctl -n hw.ncpu"
                        1⤵
                          PID:488
                        • /bin/bash
                          sh -c "sysctl -n hw.ncpu"
                          1⤵
                            PID:488
                          • /usr/sbin/sysctl
                            sysctl -n hw.ncpu
                            1⤵
                              PID:488
                            • /bin/sh
                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                              1⤵
                                PID:493
                              • /bin/bash
                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                1⤵
                                  PID:493
                                • /usr/bin/osascript
                                  osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                  1⤵
                                    PID:493
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.security.authtrampoline
                                    1⤵
                                      PID:494
                                    • /System/Library/Frameworks/Security.framework/authtrampoline
                                      /System/Library/Frameworks/Security.framework/authtrampoline
                                      1⤵
                                        PID:494
                                      • /bin/sh
                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                        1⤵
                                          PID:495
                                        • /bin/bash
                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                          1⤵
                                            PID:495
                                          • /bin/launchctl
                                            launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                            1⤵
                                              PID:495
                                            • /usr/libexec/xpcproxy
                                              xpcproxy afsvcpd
                                              1⤵
                                                PID:496
                                              • /usr/bin/sudo
                                                sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                1⤵
                                                  PID:496
                                                  • /Library/osxmobiledata/com.apple.afsvcpd
                                                    /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                    2⤵
                                                      PID:499
                                                  • /bin/sh
                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                    1⤵
                                                      PID:497
                                                    • /bin/bash
                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                      1⤵
                                                        PID:497
                                                      • /usr/bin/osascript
                                                        osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                        1⤵
                                                          PID:497
                                                        • /bin/sh
                                                          /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                          1⤵
                                                            PID:498
                                                          • /bin/bash
                                                            /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                            1⤵
                                                              PID:498
                                                            • /bin/launchctl
                                                              launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                              1⤵
                                                                PID:498
                                                              • /bin/sh
                                                                sh -c "sysctl -n hw.ncpu"
                                                                1⤵
                                                                  PID:500
                                                                • /bin/bash
                                                                  sh -c "sysctl -n hw.ncpu"
                                                                  1⤵
                                                                    PID:500
                                                                  • /usr/sbin/sysctl
                                                                    sysctl -n hw.ncpu
                                                                    1⤵
                                                                      PID:500
                                                                    • /bin/sh
                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                      1⤵
                                                                        PID:523
                                                                      • /bin/bash
                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                        1⤵
                                                                          PID:523
                                                                        • /usr/bin/osascript
                                                                          osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                          1⤵
                                                                            PID:523
                                                                          • /bin/sh
                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                            1⤵
                                                                              PID:524
                                                                            • /bin/bash
                                                                              /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                              1⤵
                                                                                PID:524
                                                                              • /bin/launchctl
                                                                                launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                1⤵
                                                                                  PID:524
                                                                                • /bin/sh
                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                  1⤵
                                                                                    PID:525
                                                                                  • /bin/bash
                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                    1⤵
                                                                                      PID:525
                                                                                    • /usr/bin/osascript
                                                                                      osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                      1⤵
                                                                                        PID:525
                                                                                      • /bin/sh
                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                        1⤵
                                                                                          PID:526
                                                                                        • /bin/bash
                                                                                          /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                          1⤵
                                                                                            PID:526
                                                                                          • /bin/launchctl
                                                                                            launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                            1⤵
                                                                                              PID:526
                                                                                            • /usr/libexec/xpcproxy
                                                                                              xpcproxy afsvcpd
                                                                                              1⤵
                                                                                                PID:527
                                                                                              • /usr/bin/sudo
                                                                                                sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                1⤵
                                                                                                  PID:527
                                                                                                  • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                    /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                    2⤵
                                                                                                      PID:528
                                                                                                  • /bin/sh
                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                    1⤵
                                                                                                      PID:529
                                                                                                    • /bin/bash
                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                      1⤵
                                                                                                        PID:529
                                                                                                      • /usr/sbin/sysctl
                                                                                                        sysctl -n hw.ncpu
                                                                                                        1⤵
                                                                                                          PID:529
                                                                                                        • /bin/sh
                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                          1⤵
                                                                                                            PID:533
                                                                                                          • /bin/bash
                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                            1⤵
                                                                                                              PID:533
                                                                                                            • /usr/bin/osascript
                                                                                                              osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                              1⤵
                                                                                                                PID:533
                                                                                                              • /bin/sh
                                                                                                                /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                1⤵
                                                                                                                  PID:534
                                                                                                                • /bin/bash
                                                                                                                  /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                  1⤵
                                                                                                                    PID:534
                                                                                                                  • /bin/launchctl
                                                                                                                    launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                    1⤵
                                                                                                                      PID:534
                                                                                                                    • /bin/sh
                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                      1⤵
                                                                                                                        PID:535
                                                                                                                      • /bin/bash
                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                        1⤵
                                                                                                                          PID:535
                                                                                                                        • /usr/bin/osascript
                                                                                                                          osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                          1⤵
                                                                                                                            PID:535
                                                                                                                          • /bin/sh
                                                                                                                            /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                            1⤵
                                                                                                                              PID:536
                                                                                                                            • /bin/bash
                                                                                                                              /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                              1⤵
                                                                                                                                PID:536
                                                                                                                              • /bin/launchctl
                                                                                                                                launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                1⤵
                                                                                                                                  PID:536
                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                  1⤵
                                                                                                                                    PID:537
                                                                                                                                  • /usr/bin/sudo
                                                                                                                                    sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                    1⤵
                                                                                                                                      PID:537
                                                                                                                                      • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                        /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                        2⤵
                                                                                                                                          PID:538
                                                                                                                                      • /bin/sh
                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                        1⤵
                                                                                                                                          PID:539
                                                                                                                                        • /bin/bash
                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                          1⤵
                                                                                                                                            PID:539
                                                                                                                                          • /usr/sbin/sysctl
                                                                                                                                            sysctl -n hw.ncpu
                                                                                                                                            1⤵
                                                                                                                                              PID:539
                                                                                                                                            • /bin/sh
                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                              1⤵
                                                                                                                                                PID:540
                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                xpcproxy afsvcpd
                                                                                                                                                1⤵
                                                                                                                                                  PID:541
                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                  sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                  1⤵
                                                                                                                                                    PID:541
                                                                                                                                                    • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                      /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                      2⤵
                                                                                                                                                        PID:542
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:545
                                                                                                                                                      • /bin/bash
                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:545
                                                                                                                                                        • /usr/sbin/sysctl
                                                                                                                                                          sysctl -n hw.ncpu
                                                                                                                                                          1⤵
                                                                                                                                                            PID:545
                                                                                                                                                          • /bin/sh
                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                            1⤵
                                                                                                                                                              PID:546
                                                                                                                                                            • /bin/bash
                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                              1⤵
                                                                                                                                                                PID:546
                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:546
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:548
                                                                                                                                                                  • /bin/bash
                                                                                                                                                                    /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:548
                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                      launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:548
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:549
                                                                                                                                                                        • /bin/bash
                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:549
                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                            osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:549
                                                                                                                                                                            • /bin/sh
                                                                                                                                                                              /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:550
                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:550
                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                  launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:550
                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:551
                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:552
                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:556
                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:556
                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:557
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:558
                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:558
                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:558
                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:559
                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:559
                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:559
                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:560
                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                              launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:560
                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:561
                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:561
                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:561
                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:564
                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                          launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                            xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:565
                                                                                                                                                                                                                            • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                                                              /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:565
                                                                                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                xpcproxy afsvcpd
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:567
                                                                                                                                                                                                                                • /usr/bin/sudo
                                                                                                                                                                                                                                  sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:567
                                                                                                                                                                                                                                    • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                      /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:568
                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:569
                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:569
                                                                                                                                                                                                                                        • /usr/sbin/sysctl
                                                                                                                                                                                                                                          sysctl -n hw.ncpu
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:569
                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:570
                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:570
                                                                                                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                                                                                                osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:570
                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:571
                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:571
                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                      launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:571
                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:572
                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:572
                                                                                                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                                                                                                            osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:572
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:573
                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:573
                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                  launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:573
                                                                                                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                    xpcproxy afsvcpd
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:574
                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                      sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:574
                                                                                                                                                                                                                                                                        • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                          /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:575
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:576
                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:576
                                                                                                                                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:576
                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:577
                                                                                                                                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:579
                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                    sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:579
                                                                                                                                                                                                                                                                                      • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                        /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:580
                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:581
                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:581
                                                                                                                                                                                                                                                                                          • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                            sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:581
                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:584
                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:584
                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:584
                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:585
                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:585
                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                        launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:585
                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:586
                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:586
                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:586
                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:587
                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:587
                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                    launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:587
                                                                                                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:588
                                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:588
                                                                                                                                                                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:591
                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:592
                                                                                                                                                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:592
                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:593
                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:593
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:593
                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:594
                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:594
                                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                            launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:594
                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:595
                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:595
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:595
                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:596
                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:596
                                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:596
                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:597
                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:597
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:597
                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:598
                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:598
                                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                    launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:598
                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:599
                                                                                                                                                                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:600
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:600
                                                                                                                                                                                                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:601
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:602
                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:602
                                                                                                                                                                                                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:602
                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:603
                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:603
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:603
                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:604
                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:604
                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                              launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:604
                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:605
                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:605
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:605
                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:606
                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:606
                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                          launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:606
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:607
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                              sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:607
                                                                                                                                                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                  /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                      sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:617
                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:617
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                            osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:617
                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:618
                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:618
                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                  launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:618
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:619
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:619
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:619
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                              launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:621
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:621
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:621
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:622
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:622
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                          launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:622
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:623
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:623
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:623
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:625
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:626
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:626
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:627
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:629
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:630
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:630
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:631
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:633
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:634
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:635
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:637
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:638
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:639
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:639
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:639
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:641
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:641
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:642
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:645
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:645
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:646

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        429B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        b29145cf94cd1ef0d81552c333c3603a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4095a7b7b982b8875a6256919b7d80c50b0a2799

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /var/root/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        168KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        851faba150ec7f269124149d8e3025d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7d3e63d2ee2bdb31a15e19dc00402fb56e261913

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        afa7314e0bae206e6eaaf306f42ef98c5affa516405ab40c703ecbe432170940

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6392cd27ca600e4f88efdd7f1c4dce69b4787731480c7bbab5e26908ff6f0b35d51a087909301b1367c76aded0d14f840d68635f18388959c0cfdee8cf99e3d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download Submit