evilquest | ed9f3791900be8065162d5555d5831e5496883b8afeff9428d448d8b413b41ee

Analysis

max time kernel
149s
max time network
123s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
05/10/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe
Size

177KB
MD5

327c2e364d7d39c6d11fa58c8abaffb1
SHA1

12981b1f1cb97aa6a533aa95bf1d78298ea3c64e
SHA256

ed9f3791900be8065162d5555d5831e5496883b8afeff9428d448d8b413b41ee
SHA512

2b46a8db718ae9c81a42c709a6b290dd2e572d55c950757f4ba4fc3ec9d114d718033afec44b41dbf20506a294aec375e75e8c0567c1a6bc8d9a5625bb8d75a6
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq96w0k:5SeOQdaZNxtk8cqhSxvHY968

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 13 IoCs

resource	yara_rule
behavioral1/files/0x000000030008c2d5-0.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-3.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-15.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-24.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-31.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-38.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-45.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-52.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-59.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-66.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-73.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-80.dat	family_evilquest
behavioral1/files/0x000000030008c2d5-87.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 51 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.gkreport
1⤵
PID:483

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe\""
1⤵
PID:484

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:483

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe\""
1⤵
PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.systemstats.daily
1⤵
PID:486

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe
1⤵
PID:484
- /bin/zsh
  /bin/zsh -c /Users/run/2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe
  2⤵
  PID:490
- /Users/run/2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe
  /Users/run/2024-10-05_327c2e364d7d39c6d11fa58c8abaffb1_adload_evilquest_rekoobe
  2⤵
  PID:490

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:487

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:488

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:479

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:482

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:485

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:476

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:487

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:488

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:491

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:491

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:491

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:508

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:508

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:511

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:511

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:512

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:512

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:513

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:513
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:515

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:516

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:516

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:516

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:517

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:517

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:517

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:520

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:520

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:528

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:529

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:530

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:534

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:534
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:535

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:536

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:541

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:541

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:541

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:542

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:542

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:542

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:543

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:543

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:543

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:544

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:544

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:544

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:545

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:545

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:545

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:546

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:546

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:546

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:549

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:549
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:550

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:551

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:551

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:551

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:552

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:553

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:560

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:560
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:561

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:562

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:562

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:563

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:563

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:563

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:565

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:565

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:565

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:566

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:566

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:567

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:567

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:569

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:569

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:569

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:570

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:571

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:571

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:571

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:572

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:572

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:572

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:577

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:578

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:579

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:580

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:581

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:581

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:581

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:582

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:582

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:582

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:583

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:583

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:583

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:586

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:588

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:588
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:589

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:590

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:593

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:593

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:594

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:595

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:595

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:596

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:597

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:597
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:598

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:599

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:603

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:603
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:604

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:605

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:605

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:606

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:606

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:606

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:607

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:607

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:607

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:608

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:609

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:610

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:610

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:610

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:611

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:611

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:611

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:612

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:613

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:613
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:614

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:616

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:616

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:616

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:617

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:617

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:617

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:618

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:618

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:618

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:619

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:619

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:620

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:620
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:621

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:622

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:623

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:624

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:624
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:625

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:626

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:626

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:627

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:631

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:631
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:632

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:633

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:633

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:633

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:634

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:635

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:636

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:638

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:638
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:640

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:643

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7877fd03ae9abcaa8de79c55da43da69

SHA1
b041be7dfae894f9f1d54fb49f55f5d151b6098b

SHA256
4c9475561e900ba23017a11656b7eb2ce15e6b61adcce1b382a40e74c4b57ade

SHA512
f53c7d927021b7bd81d8bf8e9b2a596e83dcad372c7984c5b36f8a3325b5b7bf5787b66ae304b70e643b4965024d2fc47391ffc55e3f1d06a770979dd473376c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
240944abee4a60800e0b58c4aba97a3e

SHA1
84e5b1425f5ed0e19e82cda668f7a5679e29ec30

SHA256
f8fe777df8cce9f2f9ae5f8e9f0b52d9fd09e0abb99881547b5d55860af8b3e3

SHA512
9c3398f71dcf63fe0067c5185784a3277dc10742319af84dee93a00c375f2f3007477b19f52fecfd8a09e5b9756ace8accdc3fa02275e83ba890b9f2326f82f3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
98efd64badc7eada67e4c70cebca5833

SHA1
3db21ddeaf1cc8ed490cfffadd0e78091d0d1332

SHA256
e2124bf92c1124e9602ee91ea92a856a1793bad68d648f052f2792f7e9d906c8

SHA512
6681aa6fa0fb5a365a926c688e02dde65f987d6da901b648bf40f29e1068fc0d72b9b09f5bc021a4fbc22a1be27038f4789fda8f99f293d634755c8e3b1b028c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9ff35904092dd7edd6fcd5985a439783

SHA1
e962af131005aa5288f2a80c0912a70371d7ab4d

SHA256
755874b1f01e54df9f036bdace624dd584c09f7110c478bef505b24c11b26055

SHA512
63b23b94b2d0bbda927960f8f4d09b648edf800891139aad82c1511b171d88c43491fdadb7195b3638e1d5c7be12476333f34b0954d40be1ad6c09a7bb3bd9dd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
520b0d44acc8bfcd03665aaba2580e4d

SHA1
a77c434a073c115d108845ab99c29dd144333677

SHA256
1a60f5e4c50da55822bd2fe6ec1d56cf588505e517ec73512b597a7fcdc0a8ad

SHA512
8254ab637cc0212b111784cb1d353605ceb01591897f75b14a4efac471df1d29109d2b7137dc960f6aae771d45e4ac234ea16f3bcec14df21dab4df02d4650e3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a18bcaeb9e62e2a4132f049bc9aded26

SHA1
2919447cc3b43f69f87dac9a35f420a15702846d

SHA256
93aceb9693977c5e1a547fa9722d93b92bba62653e06ecaec55fe7841880e46d

SHA512
77d69bbd5d1766c5dd10e905b33866043d7b4f8c2db5225cc61065bdb537da1e27da683ac937b11a19ab775a9d91a592b67714f518417a8f2cdc507bbed0e686

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
56d1142305e23fb099a561c5bde9e99a

SHA1
2a0a49b49df122598646854bf2d2a3a694613e96

SHA256
d7e4f5166084b24d1c7b33726bc36c90577d856aefcb9c651730510ed9ecef20

SHA512
68bbae889f668027278307f26122d0b463ec5a03b90bc127a75298dda6511880efe55769b78abf11ec36eb0c165451dda99164f16c54fa1c51f877829fde89ff

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cf6857754ea09d054726acd710fe3cee

SHA1
631b1fa4384af2f5363e027573d38dce937b1bb5

SHA256
7af2b514354df2ac7fdbc70b5c0c701fde1d851ef21363c09241a3d3cc38cc98

SHA512
04923019efb65967ccf8fa64158dffcd0e559803f3713b9337737a50973c8c31c15df351335c23b45a28902c8e6d7cb6a65144b350e867cc8627b0140a407d75

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
cf356f9b339555773b24d13b31a0a0bb

SHA1
d446e20bb0ca4cd8b369168e3f7143848c11ec21

SHA256
e32ee4ebb468fbb62e0246787553fd8f1f27d2c263e8dad70c521c36c3ea9770

SHA512
75a871829deca15f9d4d624cf5f550e61ff40796c12af818362a3bf56b028861e138cf561b95046087eaea7acc2ae59f2427a5b55e2bd534bade70350de3af95

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4e267e4921d07fa7f90b79a538551d9c

SHA1
89904a369fde6211d8f2e3c726de043343b89873

SHA256
9c666117aef194c5419b5b1a1c03f1619d4902a0de9d1f9c93f3ec40b7bc11f3

SHA512
02a8cca3bc7050f8d0812bf34a25396b445edc9084630bf05a82677710ad344bc9732a0cc72461bb26460f3a532dd4dc5090830ad6dc5a0776ba83e7c2f57666

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0fbb65ce83c39c21fdd4e6f2162ed986

SHA1
d4a6a5c1a0f5cd19385230d3db4a1c40a26807da

SHA256
bf54fcae9bb509951477bc27ba1e733f0bc6399ee3b83dfc16b9e3d82f921330

SHA512
43d0bcfdc69e225fc903f4c00c39eda050ebc99bf45f3865799be4ea23d580787f001b5582c093e90768ac7ef4dd46fd00f54e9ea46520df37d0a703a62a011d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
11214622228605e3f3c950242106f847

SHA1
237a4c6c47c756e1c78dddadb7e8de6bbdacdc6a

SHA256
8acc19ba882fe67fec147996f6481e696d23f2fdf85075f27329984ef7b7c2ed

SHA512
eda1ec5ed0cc32db098cb981e02bccf16634188e57b953bddc3a9e05412a0e229a80c761315ec4cb4246622560691796eb96ff893b2d928946725db13cb87f23

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
bb58679eb36f76a07e951dc4312d77d3

SHA1
03720bac39b62e78920786449ed1c224334ec122

SHA256
86bb06ffdb0c4cec23ef8a690f7401622921ea7542ab8edde6fbf1e8f074834a

SHA512
ed8f4823e0d90221628b7504c95cc10c0b7bfd2067c524dc2f54bb6d5d6565d1534f5259487bd06d319f5d269fea7025c1da13d4d2944c257c63a14f1b781b93

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
7ade58de7ce3d6082026988a60bf439e

SHA1
11ea36cbcfbfeb3f11ce42dc0ae356c43d29d5ac

SHA256
0baaa40b7ec312750380838ac2313f992be9d6be80c35a860ba48d803d660748

SHA512
c180ad4842ec3146c312e78b0250680296333a83fc1b77d42b46a9b415d079998a592aba317747fa9aa00288b0d98bd727297ec094359901a4fd054138dcf94d

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
b62af2651f3090253b8319575574b7f1

SHA1
f8de68dc494487637781511441d05ca3c3d24c71

SHA256
7b83726a98f6b4810cd912e98cbdfd30caf9815f41747a67c5432f9bf53d3df2

SHA512
98c8a309781a792207379f4d894df8dd008bae702ddd686327792a97d75a983c4cb381387474ae04e2684d3772b1f5e9c6ad6ab544bb663ab19a1d3be0678640

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
4ea1319c25f3262eb56bce20677b3e17

SHA1
7c890ea943b3b254512088d5549d23e901d5e614

SHA256
9763d86915499cf27f8969a4fc346fef72349f9ae36ae360819e2bf0bccc49b3

SHA512
6ccc41ba569dcaab500bb3a87a673e46baaf47c3cc7d436e2807e33084d2564a7cff9deec80761abe0b3587f8543937c6e78531abcf913f0fe397cb9e8ac9312

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
03f3d0e6fb9f9c4af8b7735bf8ec2ff0

SHA1
b946a018853402a046813613cc0b2e9f74791560

SHA256
5065f28035f2d290f6026cc846df455f6d349df35052914a472b3a192d8a0c5a

SHA512
5e3d9957469fc858b4fbe91ea4285b71a6a1f08564f1b1781df1028929f88ecdf2a4881413248cf006a8d0d23e384d8e89620164c0d1bcb67162f4859495c683

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
9720af68ccf5a7f86b444d247ab5f79c

SHA1
91d74366720ebb9195009902a38fca7aa37b8403

SHA256
e29306cf63728d80e96770f7df727b8cbd34b0976f024743a670d56530504638

SHA512
960d8f45b083de6003fb9ec1f54e66fdd7c9b5b33aa096493e0c1cc005b950a72a5e70143658996c59bcd4e0ff6569c228ffb001433d1708636398f5b52877c6

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
bef962790a7443de3007b7fa38758e14

SHA1
937b347c8d1c647ed251275f8c527fd79921f3ca

SHA256
85519129b5230a9b21bdb0d0f4ffa8a1c69ba1157591e2a22690f0282556de20

SHA512
d561b94aac364f632dbaeb62f758acaa4cafd354cf80d93621d1f17094dc42d069775bf1a80a0b920f0f9c7f363e0c9cafb705a5a6bccf3ab4415913a44f0373

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
a473569d2727be51888fae1589dc0d0b

SHA1
c5015621599c4eb8037a71eba5efca442bb67b86

SHA256
5d691ea1a2380d6dc11df44411fc30d8555d49845f0d0fc5762feff863a56840

SHA512
b295ef1783d10289d82a6f09812f7e8256909b0ec973a3134059e0f9cc59858c6f4e6a514bee345ba6506f7b2e44fdfb115a9211050771a70dabaf06256fac0b

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
423b59bc17910c54e6b3dbf837365999

SHA1
ecdd4783daa43e1f9e99985a10d9751101989f02

SHA256
c9b462fa89b46193a05c5525bbac9aed2d3d37230ed428598ba5c06f66017922

SHA512
77a323f440d3a6c93664e6787c59f5b7750c7a9ef57c0676c397d9ce7434bb13ff91ae2d1c7601ca6422f255c8fbb48546803753066b11dfde41c4ed40587dce

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
7a0f94eeb1e564627b94986c48bf3fc6

SHA1
f59160a6b1100c44bf1c2e63f35f79a091eeb6b3

SHA256
fed279c4179e8468302da2d9188389f0755f12a880812bb5af712b6bd5c4011b

SHA512
b78473ae7106fa9d354b7dd4d955deed7ab7fc1a8798ea6fe3b36dd64c135446139a7a606124708004990e3403f6fd82b1076f7853dbf9a60f74d5eea20076c3

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
79a5a0168280c4b051c12e92c37825ba

SHA1
bc2d2ae7b84f2eb7f74758048f58d9fbb15778f7

SHA256
d2f770dddf4e8ab1d7baeb678d7442de8d20a69327b285eccbeeffb675623790

SHA512
4969a04687a0b3d888c6160431886a516af835835d9d54fe8d80fb51eaa406b7c9366c096b2f2dddd717e909c7a58a1308e591dfc93a2667227b34d237184a55

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
f5602e2355155236f187d4a925922d85

SHA1
83b91ada3ea0af89ce5dd94334b1f7a0a50a5c6f

SHA256
4d319c842a20928b77d94ee79fa0a51420637fdfab23b4ba203d2488978b1075

SHA512
0b8b1304e044c631e9b7119053a3531f10bb69e0eafb4c61001ca2d79e96cb4bed7ab6a48b1cf0132137e126180458793d310b64e02e00c7d3126ff4ba9b9d7d

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
586891b35e98ee803f61f8a03a0afbf3

SHA1
3ec4a9286a892407422d4023a09e1934effe8633

SHA256
a93f5b2449fb473cfd90417365416f0cbaca99d7c30b8267486a09ef04b1b15a

SHA512
3b069e5f623c057044d69a50750b5f12b37f9e518f60ce9fb760a008d1ac86c086137adea5d116c38476c1ce67be815ea579b5a0f5b7a3bab085edabe93aa1b0

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
b228f6d02cea3a3f5783f839638eb1a9

SHA1
f576898ea0ef3c5af5c6ecefc2ec26066ddcad65

SHA256
9855be7d332612121f50e1723a448387f78acb57edd3f956d12b544a7a0e85f5

SHA512
cda9fcc5630b6ef641ef363711e74ed97cc306f36b2e8ef1042907bc9c294ce2a459d9781c16c774d88672ddde58a1444f8d2029d009d6868f9c2d73204e2263

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
dc44ab2e6f69c73f3e24a9d5ff6fc9d5

SHA1
cc9c3cdacc1427cb15ed9ea208d29a38dc36f8f8

SHA256
4a19bfc39a64ec6c37c296420d34bfbb3eec49b3d3c9120b19b720aab0629a1d

SHA512
47a69dc7a3269d80bf24fe3718d756bc58d57f7bd1280d2fd624e2218389b08124ce4db4aac577ad85ac24d102436b43696926222213d50c01b87b6096d298e0

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
416d4af7539622f8fee84f58d2d490aa

SHA1
2627b1eddc7a112242989c5445a1dee4edfd5ff7

SHA256
87cbb90a663bb55cde7ab528f7f986ffa06f1ab31ddb8b844ad0f93a4fb77472

SHA512
e93de2a61bb7d91bb737038e484c9bac9084bf61ac642007dacaaa8211e8201fd597f58c83190286cd46c53f344b03140cee0005f4b6ac6d9c00d930d08b9aaa

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4467718ab4d78889b02e2b69b86b65fa

SHA1
5f9fd765d165bb4f5c103d1f023733ac4b00ea59

SHA256
7984403900f66ba73f56760519b6bc2a0fba1e3a7337c201f0728ec0ea8aacc9

SHA512
a1f7b475f7f4577c8002dfae8d4589d5ec1ba65b3e943e1414085d196f6eb333bbbdfa14efb31166419dfeeb2480fe55eabd1de05373e7f0fc414b09c72ba8a1

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
20c82cdc838964e0443f2bfc615c8558

SHA1
d9480d16203c5fca38d4f866a8406e6acddafef3

SHA256
759119e968e4a8dd5b35aaab475802d80c3f2148cd31e88e751c98df59d17cf8

SHA512
45696ffbfdc7397d29fd98e74f007188b8433dd9745b0ab6e1ce20b82262a734013204b5869beb488a35f58bfccc13fe597c717acaaf0bcb0247c7791422bc05

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1909323edcfa11af26fc4f6e9a64911e

SHA1
e3801554b976f56303ec69313c7c702018c7cb98

SHA256
fec37f3bcc505a16235f4ffc01d49a0860796c3418b546930bbe917ab1d4db4f

SHA512
a8217e84ae7d7c8df107181dde17e03973ee16bbaad03950fe4d88e4b1b690399b5c06fb2ebf197edfacd8fdc76c6f6107deae0bc19cec265597a519326a28c1

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6563efd850b5a7c7e17851a33ec2b899

SHA1
61ebb89fcb05ae4c78c1dae45ef7f9278bbbba20

SHA256
bcac9312c3cbf73e9c7f94d6509306122fae68340750ba2ac97dfbd72c923c5c

SHA512
1f2e949433ae0e1e396808bc669a5eb479b8e9e01e459fd50fad494065752d8fe1439d08b6794265f696610e977da95865b38112ca2770129322b9f01745fb25

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bb09c90ce9ee2ac204b5b901c0757982

SHA1
657db89e71797ef04b3818733e2d420eeb353a5d

SHA256
d38920bc47bc70581c042a03e5053bdca2ac4507e65f6fced38b88c0968e9b8f

SHA512
08e6a03bc52c328a58d78920c811a02d9b774233dc43a7751c274b4ca17031b62c1cbfbf1df6e9856307c6b7167dd4393dd3b31efb83620e5dc3a7f4c7e5883b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d3659cbee4f5cf8cab90c1616ce3bc50

SHA1
86a71256c7b0924e03626e9b89bb0dfa5161b7fb

SHA256
e248ec2990a2025ac5eecb4005ae1553816b4dc94cce6a069f5b43fc03f70c51

SHA512
e7e8973605334bf73b7154b9de7d43ed23f1ddbb96c3a015abbb98914f7329a5a8fa3f7021c1a55552c603cc7b184a0fab2384c0f37cd0023995b202f53dccf2

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a97e510d274f197d1eca8ac1155a9e18

SHA1
418c150537f3dfdf16b078028b19ba8281a4f9cd

SHA256
a685bbb3e6dc42eeba37c37b992fce77802994e2ebb93f33e178882e1ac2c5c3

SHA512
f46133032a4af26cef139a7e41ae599aa60a63d96404db4b8f1435832dab65cf38716c8126491deffdd014656a6a7e975f56eec80e318228fd1e1e4b44f22eba

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
851faba150ec7f269124149d8e3025d2

SHA1
7d3e63d2ee2bdb31a15e19dc00402fb56e261913

SHA256
afa7314e0bae206e6eaaf306f42ef98c5affa516405ab40c703ecbe432170940

SHA512
6392cd27ca600e4f88efdd7f1c4dce69b4787731480c7bbab5e26908ff6f0b35d51a087909301b1367c76aded0d14f840d68635f18388959c0cfdee8cf99e3d6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9a70323e8e973db7444e27704cf84eb3

SHA1
f34a14db6bbcafb3deb31c7c9ebf63ea98675a8a

SHA256
8703a62b3dd2f80353489414c2570beb97091ba71910ef35f69bbcaf10594739

SHA512
a5ee990f36da0854471744f9e1bf42a17599bdc72085bf2415fb38ad6daa2c5b4f825b6531f068f495f1e34de3aa9cd91394b9ba68db736adcd3e1397c75718d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9304dd08e1082d294cbae0477d333443

SHA1
3e4eb8820ca45e0abc37a0eae27d7f41fe52ee4d

SHA256
ded12d5a3939084c2b8946cd5c007bcf9c74b4c71b1eb6a3467f304f06b94fdf

SHA512
4c83bf81172bd19772030462da7fa076140c4d0f44d4e0efa8705183534f7edec79caa499c0832bc08ca2c052342f45d0fa007ae85b4a603632fcda9a661936f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
14c0e02edfa799b5dbc435251eec2d0a

SHA1
957428510edbe31d1db3c0a171ebf3eb45f50077

SHA256
9e53cf7bae93a9c9994e6aa1b683b3ab9eac9171da69a0c5f9acba2c16ff2200

SHA512
36893d224674eb26887a4e6489dcb5e5e2c6734179d981fd567b16143ff74d3517cebc7feeeb253c272bf60c0059c43488bf45bc7271592d9fe29c9a6e62eab6

Download Submit