Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-12-23...ekoobe

macos-10.15-amd64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    23/12/2024, 21:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe

  • Size

    3.5MB

  • MD5

    84a4f4f8c8591cf1024b41a8ac11fed9

  • SHA1

    0b64f3d007f3301d102dd3d9dcd95b68d96e5f2d

  • SHA256

    2ad461e3de346b8eec04d2e5926b3105f6aaa7165070ec91938dbef09a29e120

  • SHA512

    5508f2449c664a056f8594bc2c41a98b10b5ec89c16e6241c24cd1f91396da20b4965186d3a590f32f9ce06381830479b10fa5fd3ff089f59641163b0bdba6d0

  • SSDEEP

    49152:U33dQ333dQk33dQ33G33dQ333dQk33dQ33f33dQ333X:4

Score
10/10
evilquestbackdoorexecutionpersistence

Malware Config

Signatures

  • EvilQuest

    EvilQuest family.

    backdoorevilquest
  • EvilQuest payload 1 IoCs
  • Evilquest family
    evilquest
  • Compromise Client Software Binary 1 TTPs 7 IoCs

    Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server.

    persistence
  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

    persistence
  • AppleScript 1 TTPs 26 IoCs

    AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

    execution
  • Launchctl 1 TTPs 60 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe\""
    1⤵
      PID:448
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe\""
      1⤵
        PID:448
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe
        1⤵
          PID:448
          • /bin/zsh
            /bin/zsh -c /Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe
            2⤵
              PID:450
            • /Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe
              /Users/run/2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe
              2⤵
                PID:450
              • /Users/run/.2024-12-23_84a4f4f8c8591cf1024b41a8ac11fed9_adload_evilquest_rekoobe1
                2⤵
                  PID:450
              • /bin/sh
                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                1⤵
                  PID:474
                • /bin/bash
                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                  1⤵
                    PID:474
                  • /usr/bin/osascript
                    osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                    1⤵
                      PID:474
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.security.authtrampoline
                      1⤵
                        PID:475
                      • /System/Library/Frameworks/Security.framework/authtrampoline
                        /System/Library/Frameworks/Security.framework/authtrampoline
                        1⤵
                          PID:475
                        • /bin/sh
                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                          1⤵
                            PID:476
                          • /bin/bash
                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                            1⤵
                              PID:476
                              • /bin/launchctl
                                launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                2⤵
                                  PID:477
                                • /bin/launchctl
                                  launchctl start questd
                                  2⤵
                                    PID:479
                                • /usr/libexec/xpcproxy
                                  xpcproxy questd
                                  1⤵
                                    PID:478
                                  • /usr/bin/sudo
                                    sudo /Library/AppQuest/com.apple.questd --silent
                                    1⤵
                                      PID:478
                                      • /Library/AppQuest/com.apple.questd
                                        /Library/AppQuest/com.apple.questd --silent
                                        2⤵
                                          PID:484
                                      • /bin/sh
                                        sh -c "osascript -e \"do shell script \\\"sudo /Library/AppQuest/com.apple.questd\\\" with administrator privileges\""
                                        1⤵
                                          PID:481
                                        • /bin/bash
                                          sh -c "osascript -e \"do shell script \\\"sudo /Library/AppQuest/com.apple.questd\\\" with administrator privileges\""
                                          1⤵
                                            PID:481
                                          • /usr/bin/osascript
                                            osascript -e "do shell script \"sudo /Library/AppQuest/com.apple.questd\" with administrator privileges"
                                            1⤵
                                              PID:481
                                            • /bin/sh
                                              /bin/sh -c "sudo /Library/AppQuest/com.apple.questd"
                                              1⤵
                                                PID:482
                                              • /bin/bash
                                                /bin/sh -c "sudo /Library/AppQuest/com.apple.questd"
                                                1⤵
                                                  PID:482
                                                • /usr/bin/sudo
                                                  sudo /Library/AppQuest/com.apple.questd
                                                  1⤵
                                                    PID:482
                                                    • /Library/AppQuest/com.apple.questd
                                                      /Library/AppQuest/com.apple.questd
                                                      2⤵
                                                        PID:483
                                                    • /bin/sh
                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                      1⤵
                                                        PID:487
                                                      • /bin/bash
                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                        1⤵
                                                          PID:487
                                                        • /usr/bin/osascript
                                                          osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                          1⤵
                                                            PID:487
                                                          • /bin/sh
                                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                            1⤵
                                                              PID:488
                                                            • /bin/bash
                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                              1⤵
                                                                PID:488
                                                                • /bin/launchctl
                                                                  launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                  2⤵
                                                                    PID:489
                                                                  • /bin/launchctl
                                                                    launchctl start questd
                                                                    2⤵
                                                                      PID:490
                                                                  • /bin/sh
                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                    1⤵
                                                                      PID:491
                                                                    • /bin/bash
                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                      1⤵
                                                                        PID:491
                                                                      • /usr/bin/osascript
                                                                        osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                        1⤵
                                                                          PID:491
                                                                        • /bin/sh
                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                          1⤵
                                                                            PID:492
                                                                          • /bin/bash
                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                            1⤵
                                                                              PID:492
                                                                            • /usr/bin/osascript
                                                                              osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                              1⤵
                                                                                PID:492
                                                                              • /bin/sh
                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                1⤵
                                                                                  PID:493
                                                                                • /bin/bash
                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                  1⤵
                                                                                    PID:493
                                                                                  • /usr/bin/osascript
                                                                                    osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                    1⤵
                                                                                      PID:493
                                                                                    • /bin/sh
                                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                      1⤵
                                                                                        PID:494
                                                                                      • /bin/bash
                                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                        1⤵
                                                                                          PID:494
                                                                                          • /bin/launchctl
                                                                                            launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                            2⤵
                                                                                              PID:495
                                                                                            • /bin/launchctl
                                                                                              launchctl start questd
                                                                                              2⤵
                                                                                                PID:496
                                                                                            • /bin/sh
                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                              1⤵
                                                                                                PID:497
                                                                                              • /bin/bash
                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                1⤵
                                                                                                  PID:497
                                                                                                  • /bin/launchctl
                                                                                                    launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                    2⤵
                                                                                                      PID:498
                                                                                                    • /bin/launchctl
                                                                                                      launchctl start questd
                                                                                                      2⤵
                                                                                                        PID:499
                                                                                                    • /bin/sh
                                                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                      1⤵
                                                                                                        PID:500
                                                                                                      • /bin/bash
                                                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                        1⤵
                                                                                                          PID:500
                                                                                                          • /bin/launchctl
                                                                                                            launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                            2⤵
                                                                                                              PID:501
                                                                                                            • /bin/launchctl
                                                                                                              launchctl start questd
                                                                                                              2⤵
                                                                                                                PID:502
                                                                                                            • /bin/sh
                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                              1⤵
                                                                                                                PID:505
                                                                                                              • /bin/bash
                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                1⤵
                                                                                                                  PID:505
                                                                                                                • /usr/bin/osascript
                                                                                                                  osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                  1⤵
                                                                                                                    PID:505
                                                                                                                  • /bin/sh
                                                                                                                    /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                    1⤵
                                                                                                                      PID:506
                                                                                                                    • /bin/bash
                                                                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                      1⤵
                                                                                                                        PID:506
                                                                                                                        • /bin/launchctl
                                                                                                                          launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                          2⤵
                                                                                                                            PID:507
                                                                                                                          • /bin/launchctl
                                                                                                                            launchctl start questd
                                                                                                                            2⤵
                                                                                                                              PID:508
                                                                                                                          • /bin/sh
                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                            1⤵
                                                                                                                              PID:509
                                                                                                                            • /bin/bash
                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                              1⤵
                                                                                                                                PID:509
                                                                                                                              • /usr/bin/osascript
                                                                                                                                osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                                1⤵
                                                                                                                                  PID:509
                                                                                                                                • /bin/sh
                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                  1⤵
                                                                                                                                    PID:510
                                                                                                                                  • /bin/bash
                                                                                                                                    /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                    1⤵
                                                                                                                                      PID:510
                                                                                                                                      • /bin/launchctl
                                                                                                                                        launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                        2⤵
                                                                                                                                          PID:511
                                                                                                                                        • /bin/launchctl
                                                                                                                                          launchctl start questd
                                                                                                                                          2⤵
                                                                                                                                            PID:512
                                                                                                                                        • /bin/sh
                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                          1⤵
                                                                                                                                            PID:513
                                                                                                                                          • /bin/bash
                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                            1⤵
                                                                                                                                              PID:513
                                                                                                                                            • /usr/bin/osascript
                                                                                                                                              osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                                              1⤵
                                                                                                                                                PID:513
                                                                                                                                              • /bin/sh
                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                1⤵
                                                                                                                                                  PID:514
                                                                                                                                                • /bin/bash
                                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:514
                                                                                                                                                    • /bin/launchctl
                                                                                                                                                      launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                                      2⤵
                                                                                                                                                        PID:515
                                                                                                                                                      • /bin/launchctl
                                                                                                                                                        launchctl start questd
                                                                                                                                                        2⤵
                                                                                                                                                          PID:516
                                                                                                                                                      • /bin/sh
                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                        1⤵
                                                                                                                                                          PID:517
                                                                                                                                                        • /bin/bash
                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                          1⤵
                                                                                                                                                            PID:517
                                                                                                                                                          • /usr/bin/osascript
                                                                                                                                                            osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:517
                                                                                                                                                            • /bin/sh
                                                                                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:518
                                                                                                                                                              • /bin/bash
                                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:518
                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                    launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:519
                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                      launchctl start questd
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:520
                                                                                                                                                                    • /bin/sh
                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:523
                                                                                                                                                                      • /bin/bash
                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:523
                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                          osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:523
                                                                                                                                                                          • /bin/sh
                                                                                                                                                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:524
                                                                                                                                                                            • /bin/bash
                                                                                                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:524
                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                  launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:525
                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                    launchctl start questd
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:526
                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:527
                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:527
                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:527
                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:528
                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:528
                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:529
                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                  launchctl start questd
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:530
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:531
                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:531
                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:531
                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:532
                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                              launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:533
                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                launchctl start questd
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:534

                                                                                                                                                                                                              Network

                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                              • /Library/LaunchDaemons/com.apple.questd.plist
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                435B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                a3d34532a7dd2cd1d73cea75deb0677f

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                3019d1c50907fb2597121c03619990c5670ff6f4

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                779a31e4de99f9de28de8bf064c504382e050c114e2e865cc1f694c7e6339735

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                52618a5f14247c909a3857b122a124d0ddd00890c128cf041976182423b3d728cab11daf5b6a1adb6845d062b54083e72380184b6f76369482305c2782bedd91

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • /Users/run/Library/AppQuest/com.apple.questd
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                2.9MB

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                4e1b7b5deb351fa51e6ace857eb43e25

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                c21855f3b4627cf8cf76d2ff55f8d3608dd68f74

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                49e4fb3445bded5946724f0e187bf28f4ebc88bb386678b66752f33f35d03640

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                26e995633cd5b4be505eff30f6d8ad8526b1f60cbf577902745f838b0159b8a9a4163de7d0b57c1456f7459b8f8324f9d77caab6693ae3878d042a7cec4d9a45

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • /Users/run/Library/LaunchAgents/com.apple.questd.plist
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                423B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                eb73619f4e724257ff0fd951883a30ae

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                5032251e50b32e340d8171631a598596bad8991e

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                6e56467f3f5502588094c91e2d58bbb1e43c4e8171093db14931dd41788e17d4

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                ec95c395414181bc77c7a2980fbd3fe69b718aa98c878e514c3f28b738e1669488126cbdfa96e3a182afd8536b54bc1791a044fa3535d1fd3fad54dfda337b7c

                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                              • /var/root/Library/LaunchAgents/com.apple.questd.plist
                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                422B

                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                70c1e05ff6b32db6e1ef873321abd1f9

                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                16878e40cd5a569bc8f441988cc07b66ffc8534a

                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                ba60feb2a639cd847674e6599cabf986ede7876231a292785b0365d58b7b9378

                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                1e82629b3b1fa7bb88e7efe0393aee7114631555fbfe614d33b9b1efb4d299c35dac5e393f834dcc26a5e192e46e317124c0b841f65ab371819c34802424712e

                                                                                                                                                                                                                Download Submit