Analysis
-
max time kernel
149s -
max time network
104s -
platform
macos-10.15_amd64 -
resource
macos-20241106-en -
resource tags
arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
03/02/2025, 10:55
Behavioral task
behavioral1
Sample
1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b
Resource
macos-20241106-en
General
-
Target
1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b
-
Size
305KB
-
MD5
286644900a93734366c1e74db154940c
-
SHA1
4201b08c38f1fdb65bd004b254d7a389aaeae47a
-
SHA256
1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b
-
SHA512
a03e0293f1a19fea5c0a0f205795404e1fe9421f8c76bc4ce238e1ea70d3ac2153c2c7d22844e68e6d483c072682e8f7df9a33a4b5388e03d3344918e19a9333
-
SSDEEP
6144:5SeOQdaZNxtk8cqhSxvHY9U755Sx8GpdlXmVkO:5LOQdaDxq8cqavHYe75kxkj
Malware Config
Signatures
-
EvilQuest payload 3 IoCs
resource yara_rule behavioral1/files/0x000000030008bf41-0.dat family_evilquest behavioral1/files/0x000000030008bf41-7.dat family_evilquest behavioral1/files/0x000000030008bf54-14.dat family_evilquest -
Evilquest family
-
Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
-
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
-
AppleScript 1 TTPs 58 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
ioc Process osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator priv" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found -
Launchctl 1 TTPs 64 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
ioc Process sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" Process not Found /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" Process not Found sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" Process not Found /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b\""1⤵PID:458
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b\""1⤵PID:458
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b1⤵PID:458
-
/bin/zsh/bin/zsh -c /Users/run/1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b2⤵PID:459
-
-
/Users/run/1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b/Users/run/1858a95fb0b28fa302e4f1c14f6c4e4e83e774336c5fbe978ae61d992766713b2⤵PID:459
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:460
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:460
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:460
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵PID:484
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵PID:484
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:485
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:485
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:485
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.authtrampoline1⤵PID:486
-
/System/Library/Frameworks/Security.framework/authtrampoline/System/Library/Frameworks/Security.framework/authtrampoline1⤵PID:486
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:487
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:487
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:487
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:488
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:488
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:489
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:490
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:490
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:490
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:496
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:496
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:498
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:499
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:499
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:499
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:500
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:500
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:500
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:501
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:501
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:501
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:502
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:502
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:502
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:504
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:504
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:504
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:505
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:505
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:505
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:506
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:506
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:506
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:507
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:507
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:507
-
/bin/sh/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:508
-
/bin/bash/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:508
-
/bin/launchctllaunchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:508
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:509
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:510
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:510
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:511
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:512
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:512
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:513
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:513
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:513
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:516
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:518
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:518
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:519
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:520
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:520
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:520
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:521
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:521
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:521
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:522
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:522
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:522
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:523
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:523
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:523
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:524
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:524
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:524
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:525
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:525
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:526
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:527
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:527
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:527
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:528
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:528
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:529
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:530
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:530
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:530
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:531
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:534
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:534
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:535
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:536
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:536
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:536
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:537
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:537
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:537
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:538
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:538
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:538
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:539
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:539
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:539
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:540
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:540
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:540
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:541
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:541
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:541
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:542
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:542
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:542
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:543
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:544
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:544
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:545
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:546
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:546
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:546
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:547
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:548
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:548
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:549
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:550
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:550
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:550
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:551
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:551
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:551
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:552
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:552
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:552
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator priv"1⤵PID:553
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator priv"1⤵PID:553
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:554
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:554
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:554
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:555
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:555
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:555
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:556
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:556
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:556
-
/bin/sh/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:557
-
/bin/bash/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:557
-
/bin/launchctllaunchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:557
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:558
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:559
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:559
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:560
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:561
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:561
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:561
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:562
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:563
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:563
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:564
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:565
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:565
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:565
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:566
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:566
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:566
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:567
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:567
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:567
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:568
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:568
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:568
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:569
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:569
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:569
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:570
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:570
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:571
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:572
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:572
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:572
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:573
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:573
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:573
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:574
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:574
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:574
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:575
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:575
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:575
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:576
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:576
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:576
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:577
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:577
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:577
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:578
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:578
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:578
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:579
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:579
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:579
-
/bin/sh/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:580
-
/bin/bash/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:580
-
/bin/launchctllaunchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:580
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:581
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:581
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:582
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:583
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:583
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:583
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:584
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:584
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:584
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:585
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:585
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:585
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:586
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:586
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:586
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:587
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:587
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:587
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:588
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:588
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:589
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:590
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:590
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:590
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:591
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:591
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:591
-
/bin/sh/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:592
-
/bin/bash/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:592
-
/bin/launchctllaunchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:592
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:593
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:593
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:593
-
/bin/sh/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:594
-
/bin/bash/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"1⤵PID:594
-
/bin/launchctllaunchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist1⤵PID:594
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:595
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:595
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:595
-
/bin/sh/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:596
-
/bin/bash/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:596
-
/bin/launchctllaunchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:596
-
/bin/shsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:597
-
/bin/bashsh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""1⤵PID:597
-
/usr/bin/osascriptosascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"1⤵PID:597
-
/bin/sh/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:598
-
/bin/bash/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"1⤵PID:598
-
/bin/launchctllaunchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist1⤵PID:598
-
/bin/shsh -c "ileges\""1⤵PID:599
-
/usr/libexec/xpcproxyxpcproxy afsvcpd1⤵PID:600
-
/usr/bin/sudosudo /Library/osxmobiledata/com.apple.afsvcpd --silent1⤵PID:600
-
/Library/osxmobiledata/com.apple.afsvcpd/Library/osxmobiledata/com.apple.afsvcpd --silent2⤵PID:601
-
-
/bin/shsh -c "sysctl -n hw.ncpu"1⤵PID:602
-
/bin/bashsh -c "sysctl -n hw.ncpu"1⤵PID:602
-
/usr/sbin/sysctlsysctl -n hw.ncpu1⤵PID:602
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5a5d07f2dd24bddf004d4b4dbd8eecd4f
SHA1d63156b5f3edd8bddbc26a216cdfa46228250eb1
SHA256de198c58d198ec6d2ccf8f01b0a3e43c27adfca43174800f41fd7446419eed94
SHA51278e3124ba4f03f13af56ed54c5a33e17edc15b2dbce67843c6e3dfd39ba8747d7b979d35ce0e7e53795124264546a9cd80b055873c1c9c4daf29c37aec20db83
-
Filesize
168KB
MD5d5f4d221f79356145d7d0e287acc7c5f
SHA1c8df4addf0cabefec02794d539cb6f54724d34fe
SHA25656233720da23ba866daf406123a7172d0d7022670ef8beeeab2e1838eb4ef495
SHA5121eb4d24670c858ea72eb75187515c5b656fee77379c56b3cecf5bf909576b8cd4aba9bf206d7fe0f139a8cd7b37692725fe02cf3bc5b006dff9501c5f2920801
-
Filesize
54KB
MD564f469698e53d0c828b7f90acd306082
SHA1bcc041b3849e1b0b4104ffeb46002207eeac54f3
SHA256d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd
SHA512a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f
-
Filesize
429B
MD5b29145cf94cd1ef0d81552c333c3603a
SHA14095a7b7b982b8875a6256919b7d80c50b0a2799
SHA2562cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc
SHA512fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0
-
Filesize
168KB
MD5baa284fd9662c220d4fe02d583da8fed
SHA1bf319593ddc20a861a946062fe678d3b4509bb8d
SHA256713b2d49283751e6ec493e1fd1e3a5fc290ced058f39d44ba02004b2203bd25d
SHA512f9ef49bcd1235c5548d8290a4e044e15b344825dc4d80e30fbd66f9f64825e43653d12dfa8c2973459c7b488eeed96db28965c3abb6f0b643a39e1450c875f21