evilquest | cac515badb605cef28052c10ebc19a3cf6a3eeabc240b4c4e1108237071be1c5

Analysis

max time kernel
149s
max time network
125s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
19-12-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe
Size

190KB
MD5

2d15c816826bf21e01fecde56f00ee13
SHA1

460b6a50d745ce20431c6e0e0346ee284cbb9173
SHA256

cac515badb605cef28052c10ebc19a3cf6a3eeabc240b4c4e1108237071be1c5
SHA512

e290f212bff5f5701e9c9ed4ef1d88f4e3bc3b261401d3352c89c37fca0cdf65ac150568852b9ff124584223298e2eb2cc2b755881b627e736086523b85b4e8a
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9jYzFt0p2Dn5km:5SeOQdaZNxtk8cqhSxvHY9cpM2Dn5km

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008e5db-0.dat	family_evilquest
behavioral1/files/0x000000030008e5db-3.dat	family_evilquest
behavioral1/files/0x000000030008e5db-10.dat	family_evilquest
behavioral1/files/0x000000030008e5db-18.dat	family_evilquest
behavioral1/files/0x000000030008e5db-24.dat	family_evilquest
behavioral1/files/0x000000030008e5db-31.dat	family_evilquest
behavioral1/files/0x000000030008e5db-38.dat	family_evilquest
behavioral1/files/0x000000030008e5db-45.dat	family_evilquest
behavioral1/files/0x000000030008e5db-52.dat	family_evilquest
behavioral1/files/0x000000030008e5db-59.dat	family_evilquest
behavioral1/files/0x000000030008e5db-66.dat	family_evilquest
behavioral1/files/0x000000030008e5db-73.dat	family_evilquest
behavioral1/files/0x000000030008e5db-80.dat	family_evilquest
behavioral1/files/0x000000030008e5db-87.dat	family_evilquest

Evilquest family
evilquest
Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 64 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:469

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:469

/usr/libexec/xpcproxy
xpcproxy com.apple.appleseed.seedusaged
1⤵
PID:471

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:471

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe\""
1⤵
PID:473

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe\""
1⤵
PID:473

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe
1⤵
PID:473
- /bin/zsh
  /bin/zsh -c /Users/run/2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe
  2⤵
  PID:474
- /Users/run/2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe
  /Users/run/2024-12-19_2d15c816826bf21e01fecde56f00ee13_adload_evilquest_rekoobe
  2⤵
  PID:474

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:475

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:475

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:475

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:491

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:491

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:493

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:494

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:494

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:498

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:498

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:499

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:499
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:502

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:500

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:500

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:500

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:501

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:501

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:501

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:503

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:503

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:503

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:513

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:513

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:513

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:514

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:514

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:514

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:515

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:515

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:515

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:516

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:516

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:516

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:517

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:517

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:517

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:518

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:518

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:518

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:519

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:519

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:519

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:520

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:520

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:521

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:523

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:523
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:524

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:525

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:525

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:525

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:526

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:526

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:526

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:527

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:527

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:527

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:528

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:528

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:529

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:529

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:529

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:530

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:530

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:530

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:531

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:531

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:531

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:533

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:533
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:534

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:535

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:536

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:536

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:536

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:537

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:537

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:537

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:538

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:538

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:538

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:539

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:539

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:539

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:540

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:540

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:540

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:541

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:541

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:541

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:542

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:542

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:542

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:543

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:543

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:544

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:544
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:545

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:546

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:546

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:546

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:548

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:549

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:549

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:549

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:550

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:550

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:550

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:551

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:551

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:551

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:552

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:552

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:552

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:553

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:553

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:553

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:554

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:554

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:557

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:557
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:558

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:559

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:559

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:559

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:563

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:563
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:567

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:567
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:568

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:569

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:569

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:569

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:570

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:571

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:571

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:571

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:572

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:572

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:572

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:575

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:577

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:578

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:579

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:581

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:581
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:582

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:583

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:583

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:583

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:584

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:586

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:587

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:588

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:589

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:590

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:590

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:591

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:591

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:592

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:594

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:594

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:595

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:596

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:596
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:597

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:598

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:598

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:603

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:604

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:604

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:604

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:605

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:605

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:605

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:606

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:606

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:607

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:607
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:608

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:609

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:609

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:609

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:610

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:610

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:610

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:611

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:611

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:611

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:612

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:612

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:612

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:613

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:613

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:614

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:614
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:615

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:616

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:616

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:617

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:618

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:618

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:618

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:619

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:620

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:620

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:621

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:621
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:622

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
c5d04aa8365f59e657876753b70bf1d2

SHA1
b228bc445e2f8aa3b012d13769790e0b24e26eed

SHA256
4186c6fd60344062f587cfb8c26313254a1966562ee2f9a6522d24732821570d

SHA512
c7062836f5b5779945bbba7ef1c30ae2b9ab7d72a56d1fd0bd819e1bf9d6aac6f4bd6c70051d44cde11f70c66bbd9ee95f9286718b7d76e90e4da52b3f58886f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
3d1fc15a9cd8e0f1f7e1f1ce477bc3cb

SHA1
396e7580091a8ed10980a2eba4acd8a30dceaa24

SHA256
a9a60685cea2d255ab81204507bcb8d9e5845fc7173b98c41434fd9e5d2493f8

SHA512
d48a5c6e38b9ffc4aaa16c1218085b3e7bcc31efcc18dc795666f3df7515484ba38e5878b3f12ffdc37c2ae2d511b9811f8fc88fb2a65f7616704b0b419c0b60

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f5176d490b944dc2fb1e6e7fc288f817

SHA1
ddf7a4bd0a0ab681d06af4686638b6ab36236989

SHA256
a5e090f518b6ea201695c515104ea504d4442876d424fc1a55b8204c7895a88a

SHA512
ee814e49c048f9c5fee206cdccff60af9977c1995534b5d61daadc6bff473a4110c0b91a389fe6905928f53960ec1dea478162af4368049846a557d8058361ca

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9ce69a554d5e00ee3f9db24c753c3c7d

SHA1
2766273014241812a62b01dda6f708c5e005287f

SHA256
a56257d1314ec4634f44010af693e05255859bc8d3239f8d3ea8ad2688d3a8b7

SHA512
d03c5e589080e63967ea16acbc3aed47877567edef0fc01ea2b939c1529156295b7547b2cb6f42aee5e6b28daec19d10dfb7f93d97ea7f954a697b3bb4ec583b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
05c31703ce461551ce9e58f2dcbe7ea8

SHA1
69a5ec363de1a8535b26a77acf2771ad8903f634

SHA256
ec867cb5596a952d43857ece7ecac317291fa9ffec1213281fa56c179d055bf7

SHA512
deea57e2dc36f88981a3ea69617cbeada22875b4bd563e229361e67024fa2bf70bef88157b6e6bfa66cbac55bd4cad312ae056b5bd8b3c28f3976b89fe575f46

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
60fb6f2423b7b2f4b91177f74a203bd3

SHA1
8e636006e8a1d07ecb0e0f8a3c0d2f6de12031dc

SHA256
54a03df0d0eb792ab46a3893ab5beef08e18fb18e5cc6648a155ead0dcf90375

SHA512
66db43fe462a8931a7d7327e4df903b04a4a6be3fd65d4ff8592972fdb9ee75803d8e70551c8241da79922bd6b5f138612987594887d5247d3f7351f22d4c55f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
706e8070174db1311b9abc22ade6c1de

SHA1
ae70fed5a407f62458195b8e1adef6b6d653d503

SHA256
6d2b036a7d542bf01524feffa6fc494b127f3816138d917e260d01603128f288

SHA512
f8ec2c3fc16488dbe9defd255e4b9028a862dc0a36888a8386796f4a5f1b5c9bfebecf720bf36c8379d7c7f1acc19c3431d4e9f2c7bb089d6221f07593ff2574

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7ebe20276264d1445b5d91fd4d807ddd

SHA1
e04dcb062a08aac00efbf29425ef5a143216044e

SHA256
195594c0e5842c0f7025dfb0ec2a1a963c6be2f4f8520c9f82c6e20a84a09da4

SHA512
967c6625f8aaa59818a7b133c293c9568f4a152207166131c34de013a4eb20a68f829ebeece6c5f1ea8fba7e4bb150d125f4b210ec6fcfc0d190cb9090606400

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
7d17645d489a7303e863a31bb655c3ab

SHA1
a4fe58c14e5ca1fdad688bea2c55a3044eb8aca1

SHA256
7ecd3ecddc326cdaa4b49e6d45793797f71355556d1db1c633374d18f17c3925

SHA512
c53218757e7ad6f06c0e8825e5ed1cd0fefe090e2f23a604f1b3854fa09af4b065d7e46c419f2fc09e469591a51ce5daf37823fcf65f4425a3e258ec38d6520f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
779f652bc5793e288f8fd57e12ea821d

SHA1
3ab0aa4a510e0dbac17d8ef16f372d865aba09db

SHA256
a22c0470ffa2f40fe6ad15eb579cdcfdad6af39563a904b20bfc9f8a1dc00eae

SHA512
25a85fab44a90a686fa6e8ccb9da748d9d6dbf75d273e02f77ed6d134c1923647694906b02e106a9fc47184f40c35829ab4be8709d9c47552ccf3534f28817fd

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
32893cd75514c6153c605af9208d4f64

SHA1
0ca7fe15a27549be36badb8af9e7b9eb3adb3ded

SHA256
8c35106dcacaf76a443490ac198f8c3de5b90e668341c7883746fc0c4a3ac7f0

SHA512
6e119cb170180ee0ca81c8c6cdabc94b3f043e63249a17f7ac5719d4f2de6a5c1279baa881a4bb2d9289576131562e580df75641206bf4f9a5fa559dd764719d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
faf8818792a386f16afd7ae37afed76f

SHA1
856af465261cfdbc697f678700038048a73bec81

SHA256
3d15cd5bf0b372f0e981e37e88c3234ea24bd89e33e63a75e05ad32ce6cdcaef

SHA512
93fe828a1e02f6ecab57ead65de40d455e3dfb8edb8ea1df9315175740539bf7a525dfff2aaa77613af83e3df2f74470defe937268ab4c0e0827b0f795f20323

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9481b89dc0a9fd8f1ade38c62e6596d8

SHA1
f7183d355abec90601e9620b71f747b46abc7d21

SHA256
676c8edadf45a9a4c30b6f5bc781304bd84414946d5db9bf663efc35fe4e9611

SHA512
4ade08b8b7520e1b892fc9ba8b38feb92c49b0533847de194e1365e80e56d41c1ae3bcc56be8c0593dc86d596cc39c7df429d8e9964b340ca0c2b001c5bc00a7

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
99d283b3418811aaf77da6d0892da279

SHA1
c098df977af937d9c82f969e2d7b78411191f92e

SHA256
06c8fd962158cd01a603abe63ef43130dcc43d3c7d48600e4bc642fc5172095e

SHA512
ccede0518f7809186e037c2456d72470716651e4b8f9afdc6e29e77043121673b62968f74fee51eeac83a7fd3f7b9bea3dc9038f0e85efbf2beaf105473b1e5f

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
5cca0f622c32f2747278123131270230

SHA1
8c266b5f945d59748ac93b0b29b0030f2b8eaf51

SHA256
78ec9504f55b5c4efad969cd768572b397a64618d78cc158fe08fb4597953b81

SHA512
078ae574656602ea2a844ae1b700de9aa9b2531c4d4338387c873c9c54227f500cd080589610ea5defc662f854aca683c34348881f1579a06322f54f51169b29

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
f892f820409c616905719ccdb71d7a7e

SHA1
6fcaa2088255d64872a73bf415a7ebdf2d2b1022

SHA256
be5805a047b5ea7ed65ed3e48f9f5df723780f4f6ac61c3f88dc4ac97cf1947c

SHA512
ee26f7300b94a43b577008c7489736dde0cdee2f9bfaf26f171ebd477e849792480b83f4b50155937648ce8b5d014130b23a69db7f01702c8aafe81ecb925c1f

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
a5ebadb0acbba99b35e2dd46f0e275cf

SHA1
c13969d9afbe6b9c10bed3cba033c66bd44c5f24

SHA256
57d69033ba88b48b30e7fbf50a35df41318abab43a3cf0ae3a9a37ba3556cdb5

SHA512
9c5e6a38d17554ac0f2fe352823135dabda371422ed403967d7bd95e28e588e329154309cd3a031957fc8b4d0cc0b161f4e3b2e1599d981ef67e71c4b0b1f5ca

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
02c0ce8b62c753870ef09e613b489fdb

SHA1
b38b1ca7e7c87fc1e68617ce4833fad91793f6af

SHA256
ee6682041e343e06fc6edb72deee9d11236d6e7438f093b01983cebcfc36a62c

SHA512
e0581910bdb10fa7c464c3e13d51a65f2f4c65ad2fce506395c515a04e04bcf10eaf418d526dcf72a41b129d146f5c1d35b26ada27501dcbed328b30a104b6ab

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
b42353a33dd7d1966b10a419b187013a

SHA1
8f0ce8eca3e763dfeeaf6205e1bac509413c759c

SHA256
3cc5b54112274b83a112358c84185cc90b4690b47e559ab6e60299ae0b12c3bc

SHA512
74f86eb13afa225141f741eab50c4323a7d49f576d5d652849b18fb3173ea9b3e1b10b0556d459001bd0452f11c3bab476c68e8a5b92ecdc82320239e5aa7146

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
6855483a59b8ebf50a49cef8e03663b3

SHA1
3ca40060027d7d326129cb09d691ed55e2065917

SHA256
745271c15b5cd0ac31d3cb31c911e7def3dbcb6937f82bf438dc1857b9f94130

SHA512
701d60a753b12743333639f9a3f7fb90b1734ba6d1f6b7bf8c9e2df6e46918d5c5967669f25381a8785af13ca8ffe23cd790f3abfbcd3beec4b352507e669d7c

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
324b354c925f543763dfdc9c558cbadf

SHA1
26ac4d1a5f3d0e59c2f7db06567ae33fe4ea5f08

SHA256
a06e616c8e960e90aa5a43a1e071f9b936307af3f8d7e79fe9e6dac64e9df89e

SHA512
318f53b78b0866f2846dca50e702a3f9b2e1109971143eb85630bd2a3368920b83daa673facee95a72221fe3b14846f8cece7b124122c681074e94e32aa035a5

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
f3955a27bee08966237f40f1ea9acd86

SHA1
89ff46f26b06b7ccc0970851ca1d6714914616e1

SHA256
643d6a176efc35069026c9e4e481baff89231388051a84d5d0ec4a340d143b3e

SHA512
a8b98ac4dfef0587d9982987714c26e3f9edbb52793e46723050ff32078be834104423c7ebd402c20af3c51fca2cdcac6df3c013421643bc024d1f76c52087e9

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
d365fd29377e15c0ec23924ad08ca369

SHA1
39a880452824a463309a5e3844ff91635b079c8c

SHA256
1ba2d969901347013ab27832daaf72f2722763f9aec2c78890f3cf441cfc9d04

SHA512
b7eb73ac8618fa59fbf09a98ec5d3d04ab2355729d95e70838019ea75de017daa3959481cc0f937220a45540d4e0c4754936a1028ecfdaf9b15e27ac90e55559

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
e90352a04d07b22dbc48f1277e0c1704

SHA1
96ba188624e3a23f15ddf26feb54b5ad9a41290b

SHA256
6c66691c59f88a21d2df72fc34fe1885b9b1b0f2d5a1567c3c338b10ce00623d

SHA512
6fe4777690349358fbe9333af161f99963dee6ba29c194f5a563b093022dbc868fb1ede6dde27d85e8a025dc81682219f023b6861115dbe572522f10621599db

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
ad1843175a50e0d4041ebf97d4582c5f

SHA1
a807bff3f4257ea9b53cb4b1a0c2e290187cc0b0

SHA256
de01514e2d6b587022b0fa9791075d16d6a5003d62722b1cd2c4e82a73a39917

SHA512
13e27a684024fb885a468c4b4adc2d67634e8ff0f71272f7f96696e525f36201745d168bb1a6cea3abb4fa8fa797687a0aa0ba6f4d4894b09685e6b9b9bec183

Download Submit
/Library/Application Support/CrashReporter/sudo_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
143B

MD5
583a737fda41483e3e65067a763c200f

SHA1
8d52958500abd11c9e65982a28802c5c541b5b0b

SHA256
74667f99aa59fa0f0eddfabf4fb3e9bb296a48592a40684261f645c525abb498

SHA512
1e79c4c61e7ce08fa53900a84481b997767d21695d8f3e1be8c44f0d3b3ea6f0fd3d333f888763255e29664fae936fd0451c7663c62304ad7a618ddca89c2845

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
14cefa4cd3c73bef1721143ad2cdfdfb

SHA1
2577e700471f2fac5b66f9369a945e6c18f026c1

SHA256
60d94327a4987e64d81114985d430f61070ab35f94b74b6a1d9f99afbb36f841

SHA512
1a501902d3894d8d3a7f093a48bbb0076b598c280d6bcfaa55f6d04347d89b57c9a9f224f4cd2902b280718f5533f366d4729abed784edc877b76b01c2c05d18

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6a676f92624d05cd3baf12ca4331a9e7

SHA1
1eb7b1203237e0ad23a144c5ddd0fdb07fcc33cd

SHA256
6792268270bda3e9eb6d022c9244d821c122f658f16efe0ad3ba2d07aeae9b70

SHA512
dad0e385bdf3608c3e62fae88682b67e0e3080ea88e34184b75575091e824f1339a00280943dcf9415eefb4093c20f76c68247bae29ca6c9ca8d40bf0bd76f6e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fb37ab8c90ea69260b447f3929a89427

SHA1
2270d634b840931d0e208ee8fcd26092ddc8c3b9

SHA256
421b20d8b08e12c5041c65138270984f08610bf08be2971bec9f5f9e1648038c

SHA512
1c2c07645f3ac3aaa039aec9dd2df18e645ae90f8adebb2b3093095452412a8b0036a5bb0c257c8227fedbd50c1e5dc37c85c116f9b420d7f9bc98b4d86b2874

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b12dc1d81869c025b331b01c8285b383

SHA1
bf4b302b41f6e66b15c1624ea3e3eb4748486182

SHA256
555b7aa75a12001eccc55db22a56079a45b60d1143714f0c8904fc55b7087d67

SHA512
793e18875a50b2929f128ce305550e6c7a0a10d21072d6d88329d5d47d9acfb011a35872d3c91bc8a80e249d2036e0aaa15291bfb4f370304f708bcb79194bc4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
21e58b3722d5af358e2bb3d4acb5b5c3

SHA1
056b6c572f90a08a288a088f74aea658980e5eb3

SHA256
6a2d370bd7051ce5e39f5bf74ce208509b2ee62df578f3c9414f910f1cb46cc0

SHA512
70de07806d4192ea5c98695bd8bf121ec91bc5d3555fc1c8e762682d5ce9d073043cb305c4ab30a21177cafb577e9a27c0516d020402c13f04ff0e0484686168

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3e993ed8ac77ec8bb431eeb30645801b

SHA1
26f2ef030d9c34c64c2798f5feb256df54f8e012

SHA256
b221238d302af8e1eff3e1677e225d5517ce77bc43f79f5e0180926b02fb8b01

SHA512
017dbcb2bf5562d71ecbf3976e6654fbcea5fee7f6c3eba99a01d49c736f367c83d98e7ecb40d40a069a0f204797d791797fbfd67d3a773e22936821689f5e18

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cd4dd1d51e0d925e3e2c8af1406537e0

SHA1
0a5f96508d78fc76ccf38f845c0f2b99d05084e1

SHA256
321be5c17b635b463544bcaa02af1846f83ee6596d87ef934f39a8f821035942

SHA512
ef5e54d76304d2f4e1406adb7095a48666bca1fa74e310805a9ea7c934d4aa6e94059fcd086e2fbc60a39737cb04380441dfb62b68727dfe9db51662551387a4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
20f2be209e4ab9ba7bc0589af0b76238

SHA1
ce9ac32b06cb1c9aa4c07c37652b54362a118111

SHA256
f680d5da6e5f0d8244ee1779d5add8f60c9012c55d08139f683c84ae3d53ef16

SHA512
885dbfc32874e48f03fb6af977241286a733a6ae7ec8ff16c9cc394b522976fd19953b3b241253dd47d74ef7dc8f3dae9bf856679b14340dc55d634f647afb1d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6c5f3e638f6d3a6f549c46cc1d22053a

SHA1
e52b82098d562f4d3cfeeb03c3b21d3e589f13bd

SHA256
ec44e07f94cda011e493315aee7aad2dd417ba5e6b1a0afa6fd1fa3c89fd1491

SHA512
7020adc9e97f55c3f78d7f3d7d072ad92888c5ebbdab805827b86a1e959edf33aae2973cf7c78a154dae795d4ea1ae7c453889b6e280871cf5224d47ee3a1655

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3dd12c901cc7b20931211cff7421f247

SHA1
607c99d5645a5a74d43ba4f261b471412ddf6907

SHA256
a4537a1114edaf1f7d788a70c11a9054b625009a4b3a7cccd652a88062294b52

SHA512
362029ce044f556ae50ca56e3b940b1a5e27f163eb954a37a8c8a378a169de61da9bab63e80936b5bdf0c8b8841cb85368b9e36f56f5df7d2fd78c1cd890972b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c779f42c498f200cfe476ee627b1c563

SHA1
5e7f0990db4dc3eb52ab0b559aeba8bb88c276f7

SHA256
774b06ae9d4c8920b2249d0ce4c55ed2a123fa97a23ef44dedbbcbe651ca6465

SHA512
d40dce38fe7573d3fb87772ffd3b90b06709ed6a0e287a896a4365167a4d2ef5939e5c2e3a23089afb7e35a4555a71553d76a85db0f3f0ec8473ec2ab6d6f8bb

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f4c39e0a252c2e1eb7a7bc85082af088

SHA1
87768a32edf0961480b832561c8b66f0e4d86002

SHA256
602a8e960f111c7b23096d9db880b1e0508b131a9d5667b1445500fedeaee925

SHA512
efe661c589e0a3641badee264eea7f0536b9d85820581f4bdaf1bc8a8a9cbb1cf12c06a85423bda9da29d32f8bd76f337a48ca39264749c7bd9820c8be76d2c8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4e788588a9aeba989636f0d7e5ba78ea

SHA1
4133ba888632ffb04c402fad89860fef5e7f2653

SHA256
ea89d753e55e1b9c4c1ceb0e8de0aa1d1cc9775789f0b697679c6dced7410dbf

SHA512
765c7f7f8d8447996f06fdd297d0850005a1067d1dbc5488d31c73a4a5e870c3a5d83b158e7d9378694a126eefd82ca05cf70cf415a92111924acb0b7128c95b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f19c26cc42ee43ca6eb7a5dab4e44a0d

SHA1
c2f2d6d2bdeedd7aa16b68869cf9f1ffd44e801d

SHA256
3baf91b9e632b2b57147f1b9a3120174e26ff999153344eb918004369cba78ed

SHA512
d6649ada8699ce690358f77d5c3e4c89d0d89d43c02b2c7b9b150dfb5025ff4324fd556fda2508ea4954c08764a7ee578413d123af12d727e936123c61d2cff3

Download Submit