Overview

overview

10

Static

static

10

2024-12-27...ekoobe

macos-10.15-amd64

5

Analysis

  • max time kernel
    149s
  • max time network
    104s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    27-12-2024 14:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe

  • Size

    177KB

  • MD5

    bdb7e88e1366055c4ebc04266151c735

  • SHA1

    75808e3846b55597f12f53c08bb851e00e746d16

  • SHA256

    9e4150dc9c69c6cbe1eea313d320f060a794e0829f09ca5e0b9977ce7ce00f3a

  • SHA512

    977bc57676e173a1da51b86cf22ef0c2177585e28be8f190e2dec6526d9acf582ee4ea328e935c9fa9a2e9868efac84fa381deaa09354dc709c8df86122cbdb8

  • SSDEEP

    3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9xW07:5SeOQdaZNxtk8cqhSxvHY9b

Score
5/10
executionpersistence

Malware Config

Signatures

  • Launch Agent 1 TTPs

    Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

    persistence
  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

    persistence
  • AppleScript 1 TTPs 50 IoCs

    AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

    execution
  • Launchctl 1 TTPs 64 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe\""
    1⤵
      PID:469
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe\""
      1⤵
        PID:469
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe
        1⤵
          PID:469
          • /bin/zsh
            /bin/zsh -c /Users/run/2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe
            2⤵
              PID:470
            • /Users/run/2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe
              /Users/run/2024-12-27_bdb7e88e1366055c4ebc04266151c735_adload_evilquest_rekoobe
              2⤵
                PID:470
            • /bin/sh
              sh -c "sysctl -n hw.ncpu"
              1⤵
                PID:471
              • /bin/bash
                sh -c "sysctl -n hw.ncpu"
                1⤵
                  PID:471
                • /usr/sbin/sysctl
                  sysctl -n hw.ncpu
                  1⤵
                    PID:471
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.nsurlstoraged
                    1⤵
                      PID:476
                    • /usr/libexec/nsurlstoraged
                      /usr/libexec/nsurlstoraged --privileged
                      1⤵
                        PID:476
                      • /bin/sh
                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        1⤵
                          PID:495
                        • /bin/bash
                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                          1⤵
                            PID:495
                          • /usr/bin/osascript
                            osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                            1⤵
                              PID:495
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.security.authtrampoline
                              1⤵
                                PID:496
                              • /System/Library/Frameworks/Security.framework/authtrampoline
                                /System/Library/Frameworks/Security.framework/authtrampoline
                                1⤵
                                  PID:496
                                • /bin/sh
                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                  1⤵
                                    PID:497
                                  • /bin/bash
                                    /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                    1⤵
                                      PID:497
                                    • /bin/launchctl
                                      launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                      1⤵
                                        PID:497
                                      • /usr/libexec/xpcproxy
                                        xpcproxy afsvcpd
                                        1⤵
                                          PID:498
                                        • /usr/bin/sudo
                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                          1⤵
                                            PID:498
                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                              2⤵
                                                PID:501
                                            • /bin/sh
                                              sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                              1⤵
                                                PID:499
                                              • /bin/bash
                                                sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                1⤵
                                                  PID:499
                                                • /usr/bin/osascript
                                                  osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                  1⤵
                                                    PID:499
                                                  • /bin/sh
                                                    /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                    1⤵
                                                      PID:500
                                                    • /bin/bash
                                                      /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                      1⤵
                                                        PID:500
                                                      • /bin/launchctl
                                                        launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                        1⤵
                                                          PID:500
                                                        • /bin/sh
                                                          sh -c "sysctl -n hw.ncpu"
                                                          1⤵
                                                            PID:502
                                                          • /bin/bash
                                                            sh -c "sysctl -n hw.ncpu"
                                                            1⤵
                                                              PID:502
                                                            • /usr/sbin/sysctl
                                                              sysctl -n hw.ncpu
                                                              1⤵
                                                                PID:502
                                                              • /bin/sh
                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                1⤵
                                                                  PID:504
                                                                • /bin/bash
                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                  1⤵
                                                                    PID:504
                                                                  • /usr/bin/osascript
                                                                    osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                    1⤵
                                                                      PID:504
                                                                    • /bin/sh
                                                                      /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                      1⤵
                                                                        PID:505
                                                                      • /bin/bash
                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                        1⤵
                                                                          PID:505
                                                                        • /bin/launchctl
                                                                          launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                          1⤵
                                                                            PID:505
                                                                          • /bin/sh
                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                            1⤵
                                                                              PID:506
                                                                            • /bin/bash
                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                              1⤵
                                                                                PID:506
                                                                              • /usr/bin/osascript
                                                                                osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                1⤵
                                                                                  PID:506
                                                                                • /bin/sh
                                                                                  /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                  1⤵
                                                                                    PID:507
                                                                                  • /bin/bash
                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                    1⤵
                                                                                      PID:507
                                                                                    • /bin/launchctl
                                                                                      launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                      1⤵
                                                                                        PID:507
                                                                                      • /bin/sh
                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                        1⤵
                                                                                          PID:508
                                                                                        • /bin/bash
                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                          1⤵
                                                                                            PID:508
                                                                                          • /usr/bin/osascript
                                                                                            osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                            1⤵
                                                                                              PID:508
                                                                                            • /bin/sh
                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                              1⤵
                                                                                                PID:509
                                                                                              • /bin/bash
                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                1⤵
                                                                                                  PID:509
                                                                                                • /bin/launchctl
                                                                                                  launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                  1⤵
                                                                                                    PID:509
                                                                                                  • /bin/sh
                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                    1⤵
                                                                                                      PID:510
                                                                                                    • /usr/libexec/xpcproxy
                                                                                                      xpcproxy afsvcpd
                                                                                                      1⤵
                                                                                                        PID:511
                                                                                                      • /usr/bin/sudo
                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                        1⤵
                                                                                                          PID:511
                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                            2⤵
                                                                                                              PID:512
                                                                                                          • /bin/sh
                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                            1⤵
                                                                                                              PID:513
                                                                                                            • /bin/bash
                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                              1⤵
                                                                                                                PID:513
                                                                                                              • /usr/sbin/sysctl
                                                                                                                sysctl -n hw.ncpu
                                                                                                                1⤵
                                                                                                                  PID:513
                                                                                                                • /bin/sh
                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                  1⤵
                                                                                                                    PID:514
                                                                                                                  • /bin/bash
                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                    1⤵
                                                                                                                      PID:514
                                                                                                                    • /usr/bin/osascript
                                                                                                                      osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                      1⤵
                                                                                                                        PID:514
                                                                                                                      • /bin/sh
                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                        1⤵
                                                                                                                          PID:515
                                                                                                                        • /bin/bash
                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                          1⤵
                                                                                                                            PID:515
                                                                                                                          • /bin/launchctl
                                                                                                                            launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                            1⤵
                                                                                                                              PID:515
                                                                                                                            • /bin/sh
                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                              1⤵
                                                                                                                                PID:516
                                                                                                                              • /bin/bash
                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                1⤵
                                                                                                                                  PID:516
                                                                                                                                • /usr/bin/osascript
                                                                                                                                  osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                  1⤵
                                                                                                                                    PID:516
                                                                                                                                  • /bin/sh
                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                    1⤵
                                                                                                                                      PID:517
                                                                                                                                    • /bin/bash
                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                      1⤵
                                                                                                                                        PID:517
                                                                                                                                      • /bin/launchctl
                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                        1⤵
                                                                                                                                          PID:517
                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                          1⤵
                                                                                                                                            PID:518
                                                                                                                                          • /usr/bin/sudo
                                                                                                                                            sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                            1⤵
                                                                                                                                              PID:518
                                                                                                                                              • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                2⤵
                                                                                                                                                  PID:519
                                                                                                                                              • /bin/sh
                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                1⤵
                                                                                                                                                  PID:520
                                                                                                                                                • /bin/bash
                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:520
                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                    1⤵
                                                                                                                                                      PID:520
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                      1⤵
                                                                                                                                                        PID:521
                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                        1⤵
                                                                                                                                                          PID:524
                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                          1⤵
                                                                                                                                                            PID:524
                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                              2⤵
                                                                                                                                                                PID:525
                                                                                                                                                            • /bin/sh
                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:526
                                                                                                                                                              • /bin/bash
                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:526
                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:526
                                                                                                                                                                  • /bin/sh
                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:527
                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:528
                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:528
                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:529
                                                                                                                                                                          • /bin/sh
                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:530
                                                                                                                                                                            • /bin/bash
                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:530
                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:530
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:531
                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                    xpcproxy afsvcpd
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:532
                                                                                                                                                                                    • /usr/bin/sudo
                                                                                                                                                                                      sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:532
                                                                                                                                                                                        • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                          /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:533
                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:534
                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:534
                                                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:534
                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:535
                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:535
                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                    osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:535
                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:536
                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:536
                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                          launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:536
                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:537
                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:537
                                                                                                                                                                                                              • /usr/bin/osascript
                                                                                                                                                                                                                osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:537
                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                  /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:538
                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:538
                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                      launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:538
                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:539
                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:539
                                                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:540
                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:541
                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:541
                                                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:541
                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:542
                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:543
                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:543
                                                                                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:544
                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:545
                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:545
                                                                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:545
                                                                                                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:546
                                                                                                                                                                                                                                                  • /usr/bin/sudo
                                                                                                                                                                                                                                                    sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:546
                                                                                                                                                                                                                                                      • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                        /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:547
                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:548
                                                                                                                                                                                                                                                          • /usr/sbin/sysctl
                                                                                                                                                                                                                                                            sysctl -n hw.ncpu
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:549
                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:549
                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:549
                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:550
                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:550
                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                        launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:550
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:551
                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:551
                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:551
                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                    launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:552
                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:553
                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:553
                                                                                                                                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                                                                                                                                          osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:553
                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:554
                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:554
                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:554
                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:555
                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:555
                                                                                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:556
                                                                                                                                                                                                                                                                                                      • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                        sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:556
                                                                                                                                                                                                                                                                                                          • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                            /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:557
                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:558
                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:558
                                                                                                                                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:558
                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:559
                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:559
                                                                                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                      osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:559
                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:560
                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                            launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:560
                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:561
                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:561
                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:561
                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:562
                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:562
                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                        launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:562
                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:563
                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:563
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                              osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:563
                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:564
                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                  /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:564
                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                    launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:564
                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:565
                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:565
                                                                                                                                                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:566
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                            sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:566
                                                                                                                                                                                                                                                                                                                                                              • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:567
                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:568
                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:569
                                                                                                                                                                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:570
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                          sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:570
                                                                                                                                                                                                                                                                                                                                                                            • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                              /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:571
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:572
                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:572
                                                                                                                                                                                                                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:572
                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:573
                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:573
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                        osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:573
                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:574
                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:574
                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                              launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:574
                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:575
                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:575
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                    osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:575
                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:576
                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:576
                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                          launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:576
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:577
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                              sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:577
                                                                                                                                                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                  /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:578
                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:579
                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:579
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                      sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:579
                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:580
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:581
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                            sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:581
                                                                                                                                                                                                                                                                                                                                                                                                                              • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:582
                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:583
                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:583
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                                                                                                                                                                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:583
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:584
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:584
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                          osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:584
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                            /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:585
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                              /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:585
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:585
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:586
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:586
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                      osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:586
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                        /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:587
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                          /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:587
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                            launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:587
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:589
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:589
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:589
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:590
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:591
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/sudo
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:591
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:592

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /var/db/nsurlstoraged/dafsaData.bin
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  54KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64f469698e53d0c828b7f90acd306082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bcc041b3849e1b0b4104ffeb46002207eeac54f3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download Submit