Analysis

  • max time kernel
    146s
  • max time network
    126s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241106-en
  • resource tags

    arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    27/12/2024, 20:32

General

  • Target

    2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe

  • Size

    337KB

  • MD5

    ec725928287c0e42749b6da0c6bc5a10

  • SHA1

    a5ff3a6bdbb6e1b60c3330bf84cea74fabc83338

  • SHA256

    3e01fe2a4b62f0e51e5bb354b2ce7891eb674a442d3bac76425affc48eb97c7c

  • SHA512

    5591c1c04eb3a8d0fb0bb2b812cf96ed8fcfcc5ab76ca3403c2681329fe8c851234495b1ea2247eed789133ec5b12da7519026463de053700dfe80e3a04b3772

  • SSDEEP

    6144:5SeOQdaZNxtk8cqhSxvHY9PSeOQdaZNxtk8cqhSxvHY9:5LOQdaDxq8cqavHYBLOQdaDxq8cqavHY

Malware Config

Signatures

  • Launch Agent 1 TTPs

    Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

  • AppleScript 1 TTPs 8 IoCs

    AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

  • Launchctl 1 TTPs 16 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe\""
    1⤵
      PID:456
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe\""
      1⤵
        PID:456
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe
        1⤵
          PID:456
          • /bin/zsh
            /bin/zsh -c /Users/run/2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe
            2⤵
              PID:458
            • /Users/run/2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe
              /Users/run/2024-12-27_ec725928287c0e42749b6da0c6bc5a10_adload_evilquest_rekoobe
              2⤵
                PID:458
            • /usr/libexec/pkreporter
              /usr/libexec/pkreporter
              1⤵
                PID:446
              • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                1⤵
                  PID:450
                • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
                  "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
                  1⤵
                    PID:444
                  • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                    /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                    1⤵
                      PID:453
                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                      1⤵
                        PID:454
                      • /bin/sh
                        sh -c "sysctl -n hw.ncpu"
                        1⤵
                          PID:459
                        • /bin/bash
                          sh -c "sysctl -n hw.ncpu"
                          1⤵
                            PID:459
                          • /usr/sbin/sysctl
                            sysctl -n hw.ncpu
                            1⤵
                              PID:459
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.audio.AudioComponentRegistrar
                              1⤵
                                PID:484
                              • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                                1⤵
                                  PID:484
                                • /bin/sh
                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                  1⤵
                                    PID:485
                                  • /bin/bash
                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                    1⤵
                                      PID:485
                                    • /usr/bin/osascript
                                      osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                      1⤵
                                        PID:485
                                      • /usr/libexec/xpcproxy
                                        xpcproxy com.apple.security.authtrampoline
                                        1⤵
                                          PID:486
                                        • /System/Library/Frameworks/Security.framework/authtrampoline
                                          /System/Library/Frameworks/Security.framework/authtrampoline
                                          1⤵
                                            PID:486
                                          • /bin/sh
                                            /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                            1⤵
                                              PID:487
                                            • /bin/bash
                                              /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                              1⤵
                                                PID:487
                                              • /bin/launchctl
                                                launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                1⤵
                                                  PID:487
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy afsvcpd
                                                  1⤵
                                                    PID:488
                                                  • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                    /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                    1⤵
                                                      PID:488
                                                    • /bin/sh
                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                      1⤵
                                                        PID:489
                                                      • /bin/bash
                                                        sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                        1⤵
                                                          PID:489
                                                        • /usr/bin/osascript
                                                          osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                                                          1⤵
                                                            PID:489
                                                          • /bin/sh
                                                            sh -c "sysctl -n hw.ncpu"
                                                            1⤵
                                                              PID:490
                                                            • /bin/bash
                                                              sh -c "sysctl -n hw.ncpu"
                                                              1⤵
                                                                PID:490
                                                              • /usr/sbin/sysctl
                                                                sysctl -n hw.ncpu
                                                                1⤵
                                                                  PID:490
                                                                • /bin/sh
                                                                  /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                  1⤵
                                                                    PID:491
                                                                  • /bin/bash
                                                                    /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                                                                    1⤵
                                                                      PID:491
                                                                    • /bin/launchctl
                                                                      launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                                                                      1⤵
                                                                        PID:491
                                                                      • /bin/sh
                                                                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                        1⤵
                                                                          PID:492
                                                                        • /bin/bash
                                                                          sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                          1⤵
                                                                            PID:492
                                                                          • /usr/bin/osascript
                                                                            osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                            1⤵
                                                                              PID:492
                                                                            • /bin/sh
                                                                              /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                              1⤵
                                                                                PID:493
                                                                              • /bin/bash
                                                                                /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                1⤵
                                                                                  PID:493
                                                                                • /bin/launchctl
                                                                                  launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                  1⤵
                                                                                    PID:493
                                                                                  • /bin/sh
                                                                                    sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                    1⤵
                                                                                      PID:494
                                                                                    • /bin/bash
                                                                                      sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                                                                                      1⤵
                                                                                        PID:494
                                                                                      • /usr/bin/osascript
                                                                                        osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                                                                                        1⤵
                                                                                          PID:494
                                                                                        • /bin/sh
                                                                                          /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                          1⤵
                                                                                            PID:495
                                                                                          • /bin/bash
                                                                                            /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                                                                                            1⤵
                                                                                              PID:495
                                                                                            • /bin/launchctl
                                                                                              launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                                                                                              1⤵
                                                                                                PID:495
                                                                                              • /usr/libexec/xpcproxy
                                                                                                xpcproxy afsvcpd
                                                                                                1⤵
                                                                                                  PID:500
                                                                                                • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                  /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                  1⤵
                                                                                                    PID:500
                                                                                                  • /bin/sh
                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                    1⤵
                                                                                                      PID:502
                                                                                                    • /bin/bash
                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                      1⤵
                                                                                                        PID:502
                                                                                                      • /usr/sbin/sysctl
                                                                                                        sysctl -n hw.ncpu
                                                                                                        1⤵
                                                                                                          PID:502
                                                                                                        • /usr/libexec/xpcproxy
                                                                                                          xpcproxy afsvcpd
                                                                                                          1⤵
                                                                                                            PID:506
                                                                                                          • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                            /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                            1⤵
                                                                                                              PID:506
                                                                                                            • /bin/sh
                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                              1⤵
                                                                                                                PID:507
                                                                                                              • /bin/bash
                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                1⤵
                                                                                                                  PID:507
                                                                                                                • /usr/sbin/sysctl
                                                                                                                  sysctl -n hw.ncpu
                                                                                                                  1⤵
                                                                                                                    PID:507
                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                    xpcproxy com.apple.nsurlstoraged
                                                                                                                    1⤵
                                                                                                                      PID:508
                                                                                                                    • /usr/libexec/nsurlstoraged
                                                                                                                      /usr/libexec/nsurlstoraged --privileged
                                                                                                                      1⤵
                                                                                                                        PID:508
                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                        xpcproxy afsvcpd
                                                                                                                        1⤵
                                                                                                                          PID:511
                                                                                                                        • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                          /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                          1⤵
                                                                                                                            PID:511
                                                                                                                          • /bin/sh
                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                            1⤵
                                                                                                                              PID:512
                                                                                                                            • /bin/bash
                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                              1⤵
                                                                                                                                PID:512
                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                1⤵
                                                                                                                                  PID:512
                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                  1⤵
                                                                                                                                    PID:513
                                                                                                                                  • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                    /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                    1⤵
                                                                                                                                      PID:513
                                                                                                                                    • /bin/sh
                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                      1⤵
                                                                                                                                        PID:514
                                                                                                                                      • /bin/bash
                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                        1⤵
                                                                                                                                          PID:514
                                                                                                                                        • /usr/sbin/sysctl
                                                                                                                                          sysctl -n hw.ncpu
                                                                                                                                          1⤵
                                                                                                                                            PID:514
                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                            1⤵
                                                                                                                                              PID:515
                                                                                                                                            • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                              /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                              1⤵
                                                                                                                                                PID:515
                                                                                                                                              • /bin/sh
                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                1⤵
                                                                                                                                                  PID:516
                                                                                                                                                • /bin/bash
                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:516
                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                    1⤵
                                                                                                                                                      PID:516
                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                      1⤵
                                                                                                                                                        PID:519
                                                                                                                                                      • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                        /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                        1⤵
                                                                                                                                                          PID:519
                                                                                                                                                        • /bin/sh
                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:520
                                                                                                                                                          • /bin/bash
                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:520
                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                              1⤵
                                                                                                                                                                PID:520
                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                xpcproxy afsvcpd
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:521
                                                                                                                                                                • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                  /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:521
                                                                                                                                                                  • /bin/sh
                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:522
                                                                                                                                                                    • /bin/bash
                                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:522
                                                                                                                                                                      • /usr/sbin/sysctl
                                                                                                                                                                        sysctl -n hw.ncpu
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:522
                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:523
                                                                                                                                                                          • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                            /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:523
                                                                                                                                                                            • /bin/sh
                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:524
                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:524
                                                                                                                                                                                • /usr/sbin/sysctl
                                                                                                                                                                                  sysctl -n hw.ncpu
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:524
                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                    xpcproxy afsvcpd
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:525
                                                                                                                                                                                    • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                      /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:525
                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:526
                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:526
                                                                                                                                                                                          • /usr/sbin/sysctl
                                                                                                                                                                                            sysctl -n hw.ncpu
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:526
                                                                                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                                                                                              xpcproxy afsvcpd
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:527
                                                                                                                                                                                              • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:527
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:528
                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:528
                                                                                                                                                                                                    • /usr/sbin/sysctl
                                                                                                                                                                                                      sysctl -n hw.ncpu
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:528
                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                        xpcproxy afsvcpd
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:529
                                                                                                                                                                                                        • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                          /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:529
                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:530
                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:530
                                                                                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:530
                                                                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                                                                  xpcproxy afsvcpd
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:531
                                                                                                                                                                                                                  • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                    /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:531
                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:532
                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:532
                                                                                                                                                                                                                        • /usr/sbin/sysctl
                                                                                                                                                                                                                          sysctl -n hw.ncpu
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                                                            xpcproxy afsvcpd
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:533
                                                                                                                                                                                                                            • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                              /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:533
                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:534
                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:534
                                                                                                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:534
                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:535
                                                                                                                                                                                                                                      • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                                                                                        /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:535
                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:536
                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:536
                                                                                                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:536

                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                              • /var/db/nsurlstoraged/dafsaData.bin

                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                54KB

                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                64f469698e53d0c828b7f90acd306082

                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                bcc041b3849e1b0b4104ffeb46002207eeac54f3

                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f