Edit tour

macOS Analysis Report
https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php

Overview

General Information

Sample URL:	https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php
Analysis ID:	1569596
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569596
Start date and time:	2024-12-05 22:23:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Detection:	MAL
Classification:	mal48.mac@0/10@1/0

Warnings

Excluded IPs from analysis (whitelisted): 23.212.232.26, 52.15.215.21, 34.195.111.96, 74.125.134.95, 17.253.13.145, 17.253.13.142, 17.253.13.136, 17.36.200.79, 17.253.13.131, 17.253.13.138, 23.209.220.35
Excluded domains from analysis (whitelisted): smoot-searchv2.v.aaplimg.com, mesu-cdn.apple.com.akadns.net, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, e673.dsce9.akamaiedge.net, crl.apple.com, api.smoot.apple.com, bag-smoot.v.aaplimg.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, configuration.apple.com, mesu-cdn.origin-apple.com.akadns.net, lcdn-locator.apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, configuration.apple.com.akadns.net, itunes.apple.com.edgekey.net, configuration.apple.com.edgekey.net, safebrowsing.googleapis.com, mesu.apple.com, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net, api2.smoot.apple.com
VT rate limit hit for: https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 614, Parent: 537)

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: /usr/bin/open -a Safari https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php

xpcproxy New Fork (PID: 615, Parent: 1)

Safari (MD5: 2dde28c2f8a38ed2701ba17a0893cbc1) Arguments: /Applications/Safari.app/Contents/MacOS/Safari

xpcproxy New Fork (PID: 627, Parent: 1)

silhouette (MD5: 485ec1bd3cd09293e26d05f6fe464bfd) Arguments: /usr/libexec/silhouette

xpcproxy New Fork (PID: 633, Parent: 1)

nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged

xpcproxy New Fork (PID: 645, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php

Avira URL Cloud: detection malicious, Label: phishing

Source: unknown	HTTPS traffic detected: 144.208.67.33:443 -> 192.168.11.12:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.208.67.33:443 -> 192.168.11.12:49371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49414 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49415 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49417 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6

Source: global traffic	HTTP traffic detected: GET /language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php HTTP/1.1Host: fastbposolutions.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: fastbposolutions.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.phpAccept-Encoding: br, gzip, deflate

Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: .https://www.facebook.com/settings?tab=security_ equals www.facebook.com (Facebook)
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: 2https://www.linkedin.com/psettings/change-password_ equals www.linkedin.com (Linkedin)

Source: global traffic

DNS traffic detected: DNS query: fastbposolutions.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Thu, 05 Dec 2024 21:25:12 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Thu, 05 Dec 2024 21:25:13 GMTContent-Type: text/htmlContent-Length: 153Connection: closeVary: Accept-Encoding

Source: CloudHistoryRemoteConfiguration.plist.242.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://247sports.com/my/settings/password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.booking.com/account-recovery_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.churchofjesuschrist.org/changePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.deere.com/actmgmt/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.docusign.com/me/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.forbes.com/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.gmx.net/ciss/security/edit/passwordChange_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.id.hp.com/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.id.me/signin/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.idm.telekom.com/account-manager/password/index.xhtml_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.live.com/password/Change_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.magento.com/customer/account/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.proton.me/u/0/vpn/account-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.samsung.com/membership/contents/security/password/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://account.shodan.io/change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.adafruit.com/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.autodesk.com/Profile/Security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.craigslist.org/pass_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.crowdin.com/password/change_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.dmm.co.jp/settings/change/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.ebay.com/acctsec/security-center/chngpwd_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.intuit.com/app/account-manager/security/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.nintendo.com/password/edit_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.panic.com/password_set_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.pch.com/forgotpass_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.secondlife.com/change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://accounts.shopify.com/accounts/186490458/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://acesso.gov.br/area-cidadao/#/alterarSenha_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://adultfriendfinder.com/p/update.cgi?p=my_account_update_account_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://allegro.pl/moje-allegro/moje-konto/logowanie-i-haslo_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.acorns.com/settings/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.carta.com/profiles/update/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.constantcontact.com/pages/myaccount/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.getflywheel.com/profile/security/change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.parkmobile.io/account/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.plex.tv/desktop#
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.prolific.co/account/general_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.sipgatebasic.de/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.stonly.com/app/general/userSettings/Account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://app.zeplin.io/profile/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://appleid.apple.com/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://apps.jw.org/E_PASSCHG1_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://archive.org/account/index.php?settings=1_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://arxiv.org/user/change_own_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.astonmartinf1.com/Dashboard/ChangePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.danawa.com/modifyMember_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.fandom.com/auth/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.opera.com/account/edit-profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.readymag.com/password/forgot_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.redgifs.com/lo/reset?ticket=_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://auth.usnews.com/changePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://bandcamp.com/settings#password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://benefitslogin.discoverybenefits.com/Profile/UpdatePassword.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://blackwells.co.uk/bookshop/account/personal-details_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://blend.io/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://bugzilla.kernel.org/userprefs.cgi?tab=account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://campus.tum.de_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://card.discover.com/cardmembersvcs/personalprofile/pp/UpdateDetails?ICMPGN=MYPROFILE_USERID_PA
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://censys.io/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://cfspart.impots.gouv.fr/monprofil-webapp/GererMonProfil_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://chaturbate.com/auth/password_change/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://classroom.udacity.com/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://cloud.digitalocean.com/settings/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://cloud.linode.com/profile/auth_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://codepen.io/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://consumercenter.mysynchrony.com/consumercenter/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://customer.safeco.com/accountmanager/profile/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://customer.xfinity.com/users/me/update-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://customercenter.marketwatch.com/account#password?mod=ql_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://customercenter.wsj.com/account#password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dan.com/users/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dash.cloudflare.com/profile/authentication_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dash.e.jimdo.com/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dashboard.branch.io/account-settings/user_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dashboard.dittomusic.com/account/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dashboard.heroku.com/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://dashboard.messagebird.com/account/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://discord.com/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://duolingo.com/settings/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://elpais.com/subscriptions/#/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://employeewe.bamboohr.com/dashboard/password.php_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://experience.gm.com/myaccount/security/passwordChange_
Source: LastSession.plist.242.dr	String found in binary or memory: https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://fetlife.com/settings/account/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://flightaware.com/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://forum.wii-homebrew.com/index.php/AccountManagement/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://foursquare.com/change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://genius.com/password_resets/new_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://github.com/settings/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://go.com/profile/account-settings/edit_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpChangePassword?redir=store/account/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpWithLoginInfoReset/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://hibrain.net/mybrain/users/password/edit_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://home.thesun.co.uk/edit/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://honeywell.csod.com/resetPasswrd.aspx?_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://hotels.com/profile/settings.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://hq1.appsflyer.com/account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://id.atlassian.com/manage-profile/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://id.nfl.com/account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://id.sonyentertainmentnetwork.com/id/management/#/p/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://identity.surveymonkey.com/us/manage?locale=en_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://identity.xero.com/account/?AccountUrl=/
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://imgur.com/account/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://key.harvard.edu/manage-account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://kundenportal.edeka-smart.de/edeka-csc/forgot-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://l.doctoralia.com.br/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://leetcode.com/accounts/password/set/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://legacy.memoriams.com/Network/Account/ChangePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://linktr.ee/admin/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.aliexpress.com/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.aol.com/account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.blockchain.com/en/#/security-center/advanced_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.coupang.com/login/userModify.pang_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.teamviewer.com/nav/profile/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.thesun.co.uk/user/changePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.ti.com/ext/pwdchange/Identify_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.tmon.co.kr/user/info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.usatoday.com/USAT-GUP/password-forgot/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.yahoo.com/account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/?src=finance_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://logonservices.iam.target.com/change-password/?target=#
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://logowanie.pl.canalplus.com/zmien-haslo_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://mastercard.syf.com/login/reset_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://mathworks.com/mwaccount/profiles/password/change_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://member.daum.net/change/password.daum_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://member.webmd.com/password-reset_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://membership.latimes.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://memberssl.auction.co.kr/membership/MyInfo/MyInfo.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://minhanet.net.com.br/webcenter/portal/MinhaNet/pages_alterarsenha_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://moncompte.lemonde.fr/gcustomer/account/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.foxbusiness.com/?p=account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.foxnews.com/?pieces=reset_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.goabode.com/#/app/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.nextdns.io/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.norton.com/extspa/account/personalinfo_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.okta.com/signin/password-reset_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://my.state.nj.us/edituser/EditUserProfile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myaccount.ea.com/cp-ui/security/index_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password?continue=https://myaccount.google.com/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myaccount.uscis.gov/users/registration/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myaccounts.capitalone.com/Security/changePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://mychart.clevelandclinic.org/inside.asp?mode=passwd_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://mypassword.uml.edu/#Change_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://mypay.dfas.mil/#/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myspace.com/settings/profile/email_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://myvpostpay.verizon.com/ui/bill/secure/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://na224.lightning.force.com/lightning/settings/personal/ChangePassword/home_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://nbcuniversal.nbc.com/request-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://news.ycombinator.com/changepw_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://nhentai.net/reset/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://nid.naver.com/user2/help/myInfo.nhn?m=viewChangePasswd_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://njal.la/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://nypost.com/account/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://online.citi.com/US/ag/profile-update/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://onlyfans.com/my/settings/account/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://orcid.org/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://password.umsystem.edu/reset/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://play.hbomax.com/setting/account/edit/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://portal.edd.ca.gov/WebApp/Profile/UpdatePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://portal.pilotflyingj.com/myrewards/forgot-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://portalpersonas.bancochile.cl/mibancochile-web/front/persona/index.html#/mi-perfil/datos-segu
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://portlandgeneral.com/secure/profile/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://poshmark.com/user/account-info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://pro.housecallpro.com/service_pro/account/reset_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://profile.callofduty.com/cod/info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://profile.nvgs.nvidia.com/security/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://profile.theguardian.com/reset_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://pwrecovery.ruc.dk_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://quizlet.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://redirect.pizza/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://reelgood.com/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://rule34.xxx/index.php?page=account&s=change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://rumble.com/account/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://saude.sulamericaseguros.com.br/segurado/gerenciar-cadastro/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure-www.gap.com/my-account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.aarp.org/account/editaccount?request_locale=en&nu=t_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.bankofamerica.com/auth/security-center/main/?activity=changePasscode_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.cecredentialtrust.com/account/editpassword/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.fnac.com/account/update-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.hulu.com/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.indeed.com/account/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.login.gov/manage/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.maxpreps.com/utility/member/forgotpassword.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.npr.org/oauth2/login_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.orclinic.com/portal/editprofile.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.ssa.gov/RIM/UpwdView.action_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure.tagged.com/account_info.html?dataSource=Settings&ll=nav_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://selvbetjening.rejsekort.dk/CWS/CustomerManagement/ChangePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://shein.com/user/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://shop.tmz.com/user?show=account-tab_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://slickdeals.net/forums/login.php?do=lostpw_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://soap2day.to/home/user/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://solitaired.com/user/reset-password?_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://soundcloud.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://spankbang.com/users/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://sslmember2.gmarket.co.kr/MYInfo/MemberInfo_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://stackoverflow.com/users/account-recovery_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://stacksocial.com/user?show=account-tab_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://store.cpanel.net/my/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://stripchat.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://subscribe.washingtonpost.com/profile/#
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://support.opentable.com/s/login/ForgotPassword?language=en_US_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://thejigsawpuzzles.com/profile/?changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://thenounproject.com/accounts/password/change/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://time.com/manage-account/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://tinyurl.com/app/settings/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://todoist.com/prefs/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://trakt.tv/settings#password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://tripit.com/account/edit/section/change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://twitter.com/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://udapps.nss.udel.edu/myUDsettings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://ui.attentivemobile.com/forgot-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://usa.experian.com/member/ngx-profile/account-info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://user.manganelo.com/user_changes_pass_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://web.500px.com/settings/account/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://wordpress.com/me/security/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://worldstarhiphop.com/videos/reset.php_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.11st.co.kr/register/popupModifyPWD.tmall_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.1800contacts.com/account/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.aa.com/loyalty/profile/information_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.account.publishing.service.gov.uk/account/edit/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.acehardware.com/myaccount#settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ae.com/myaccount_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.aeon.co.jp/app/settings/profile/password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.aerlingus.com/html/user-profile.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.aesop.com/my-account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.airnewzealand.com/membership/profile/security/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.alaskaair.com/www2/ssl/myalaskaair/myalaskaair.aspx?view=myinformation&tab=email_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.alliantcreditunion.com/OnlineBanking/Settings/AccessAndSecurity/ChangePassword.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.allianz.com.br/alteracao-de-password-ecliente_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.allrecipes.com/account/profile#/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.alternate.de/html/myAccount/account/basicData.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.ae/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.ca/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.co.uk/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.com.au/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.com.br/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.com.mx/ax/account/manage
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.com.tr/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.com/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.de/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.es/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.fr/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.in/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.it/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.nl/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.pl/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.sa/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.se/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amazon.sg/ax/account/manage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.amctheatres.com/amcstubs/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.americanexpress.com/en-us/account/password/reset_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ancestry.com/account/security/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.apartments.com/my-account/#_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.apply.vccs.edu/Profile/_default.aspx_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.arlt.com/mein-passwort/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.att.com/acctmgmt/profile/overview_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.auctionzip.com/cgi-bin/userpanel.cgi?mode=3_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.bathandbodyworks.com/my-account/edit-profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.bbq-grill-world.de/customer/account/edit/changepass/1/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.bedbathandbeyond.com/store/account/personalinfo_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.belk.com/account-edit-profile/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.berlet.de/mein-konto.htm#my-account--edit-pass_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.bestbuy.com/identity/accountSettings/page/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.biblegateway.com/user/account/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.birkenstock.com/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.bloomberg.com/portal/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.blutdruck-shop.de/mein-passwort/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.boredpanda.com/settings/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.browserstack.com/accounts/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.businessinsider.com/#_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.buzzfeed.com/settings/password/change_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cakeresume.com/settings/account?ref=navs_settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.canva.com/login?redirect=%2Fsettings%2Flogin-and-security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cargurus.com/Cars/myAccount#/accountSettings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.carnival.com/profilemanagement/profiles/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cars.com/reset_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cbsnews.com/user/change-password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cbssports.com/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.change.org/account_settings/change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.chegg.com/my/account-next_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.chess.com/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.chewy.com/app/resetpassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.clien.net/service/mypage/myInfoComfrim_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cnbc.com/account/#profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cnn.com/account/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.columbia.com/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.consumidor.gov.br/pages/usuario/editar_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.costco.com/AccountInformationView?identifier=manage-membership_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.coursehero.com/my-account/#/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.crackle.com/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.creditkarma.com/myprofile/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.credly.com/earner/settings/privacy_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.crunchyroll.com/resetpw_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.cvs.com/my-account/profile/sign-in-and-security/edit-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dailymail.co.uk/registration/profile/change-password.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.darty.com/espace_client/donnees-personnelles/mot-de-passe/edition_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dell.com/identity/global/editaccount?_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.delta.com/myprofile/security-settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.deviantart.com/settings/general_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dickssportinggoods.com/MyAccount/AccountSettings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.discogs.com/settings/user_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.disneyplus.com/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dominos.com/en/pages/customer/#
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.doordash.com/accounts/password/reset/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dotloop.com/my/account/#/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dropbox.com/account/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dsw.com/en/us/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.dwr.com/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.epicgames.com/account/password?lang=en&productName=epicgames_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.eporner.com/profile/mturk_eporn/my/edit-pass/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.espn.com/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.eventbrite.com/account-settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.evite.com/reset_password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.expedia.com/user/forgotpassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.familysearch.org/identity/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.fanfiction.net/account/password.php_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.fedex.com/en-us/create-account/how-to-reset-forgot-password.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.findagrave.com/user/account/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.fitbit.com/settings/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.foodnetwork.com/user-profile-page_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.foxsports.com/#_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.gamespot.com/change-details/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.geocaching.com/account/settings/changepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.glassdoor.com/member/profile/settings.htm_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.gocomics.com/profiles/create-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.gog.com/account/settings/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.goodreads.com/ap/cnep_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.grainger.com/myaccount/loginoptions_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.grubhub.com/account/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.happycow.net/members/profile/update/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.hilton.com/en/hilton-honors/guest/profile/password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.homedepot.com/myaccount/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.hsn.com/myaccount/update_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.huffpost.com/member/edit-profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ign.com/account/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ihg.com/rewardsclub/gb/en/account-mgmt/personalInformation_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ikea.com/in/en/profile/dashboard/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.independent.co.uk/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.insider.com/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.instacart.com/store/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.instagram.com/accounts/password/change/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.istockphoto.com/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.jcpenney.com/account/dashboard/personal/info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.kohls.com/myaccount/accountsettings.jsp_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.kroger.com/account/update_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.linkedin.com/psettings/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.livejasmin.com/en/girls/#
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.lowes.com/mylowes/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.marktplaats.nl/account/password-reset/confirm.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.marriott.com/loyalty/myAccount/changePassword.mi_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.mediafire.com/myaccount/accountbilling.php#change-pwd-block_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.meliuz.com.br/minha-conta/meus-dados/senha_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.menards.com/main/accountoverview.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.mercari.com/mypage/email_password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.michaels.com/on/demandware.store/Sites-MichaelsUS-Site/default/Account-EditProfile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.mlb.com/account/general_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.myfreecams.com/php/account.php?request=status&vcc=1674246522#change_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.mylo.id/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.nba.com/account/nbaprofile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.netflix.com/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.netvibes.com/account/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.newsweek.com/contact_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.nike.com/member/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.nordstrom.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.nordstromrack.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.nytimes.com/account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.officedepot.com/account/editLoginDisplay.do_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.overleaf.com/user/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.overstock.com/myaccount/account/email-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.paramountplus.com/account/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.patreon.com/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.paypal.com/myaccount/security/password/change_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.peacocktv.com/forgot_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.pinterest.com/settings/account-settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.politico.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.pornhub.com/user/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ppomppu.co.kr/myinfo/profile.php_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.prowlapp.com/settings.php_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.quora.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.rakuten.com/account-settings.htm_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.realtor.com/myaccount/profile/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.reddit.com/prefs/update/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.redfin.com/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.redtube.com/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.rei.com/YourAccountCredentials_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.reuters.com/account/forgot-password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.roblox.com/my/account#
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.rottentomatoes.com/user/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.safeway.com/customer-account/account-settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.samsclub.com/account/personal-info?xid=hdr_account_change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.santahelenasaude.com.br/beneficiario/#/alterar-senha_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.saturn.de/webapp/wcs/stores/servlet/MultiChannelMAChangePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.scribd.com/account-settings#change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.sephora.com/profile/MyAccount_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.serasa.com.br/meus-dados/alterar-senha_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.shoop.de/einstellungen/benutzerdaten_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.shopback.co.kr/account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.shutterfly.com/account-settings/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.sonos.com/myaccount/user/profile/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.southwest.com/loyalty/myaccount/profile-security.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.spectrum.net/user-preferences/your-info/manage/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.speedway.com/my-account/security/passcode_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.splunk.com/my-account/#/profile-details_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.spotify.com/in-en/account/change-password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.swagbucks.com/account/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.swinglifestyle.com/profile/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.tasteofhome.com/login/updatepassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.teacherspayteachers.com/My-Account/Basics/edit_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.temu.com/bgp_account_security.html_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.thesimsresource.com/account#/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.thetrainline.com/my-account/change-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.thetvdb.com/dashboard/account/changepass_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.tiktok.com/login/email/forget-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.tripadvisor.com/Settings-cp_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.trulia.com/account/user_profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.tumblr.com/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.turkishairlines.com/tr-int/miles-and-smiles/forgot-password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.twilio.com/console/user/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.twitch.tv/settings/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.uline.com/MyAccount/ContactPref_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ulta.com/myaccount/index.jsp_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.united.com/ual/en/US/account/security/setpassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ups.com/lasso/updatePass?loc=en_US_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ventrachicago.com/account/manage-account/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.victoriassecret.com/us/account/profile#changePassword_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.vrbo.com/traveler/profile/edit_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.walgreens.com/account/user_and_password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.walmart.com/account/profile_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.wayfair.com/v/account/personal_info/edit_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.wikihow.com/Special:ChangeCredentials/MediaWiki%5CAuth%5CPasswordAuthenticationRequest_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.wired.com/account/reset-password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.worldwinner.com/cgi/finance/account.pl_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.wunderground.com/member/settings_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.xvideos.com/account/security_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.yellowpages.com/settings/password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.youporn.com/settings/change/password/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.zhihu.com/settings/account_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.zillow.com/myzillow/profile/_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.ziprecruiter.com/login/forgot-password?realm=candidates_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.zocdoc.com/patient/editprofile?section=Password_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://www.zulily.com/account/edit?rel=top_flyout_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://xhamster.com/password-recovery_
Source: AutoFillQuirks.plist.242.dr	String found in binary or memory: https://yelp.com/profile_password_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49369
Source: unknown	Network traffic detected: HTTP traffic on port 49414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49380
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49417
Source: unknown	Network traffic detected: HTTP traffic on port 49380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49416
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49379
Source: unknown	Network traffic detected: HTTP traffic on port 49413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 49407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49371
Source: unknown	Network traffic detected: HTTP traffic on port 49371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49407
Source: unknown	Network traffic detected: HTTP traffic on port 49385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49404

Source: unknown	HTTPS traffic detected: 144.208.67.33:443 -> 192.168.11.12:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.208.67.33:443 -> 192.168.11.12:49371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49414 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49415 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49417 version: TLS 1.2

Source: classification engine

Classification label: mal48.mac@0/10@1/0

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	Random device file read: /dev/urandom			Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 645)	Random device file read: /dev/random			Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist	Jump to dropped file

Source: /usr/bin/open (PID: 614)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 615)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php	100%	Avira URL Cloud	phishing

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fastbposolutions.com	144.208.67.33	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.sephora.com/profile/MyAccount_	AutoFillQuirks.plist.242.dr	false	high
https://myaccount.uscis.gov/users/registration/password_	AutoFillQuirks.plist.242.dr	false	high
https://www.dotloop.com/my/account/#/settings_	AutoFillQuirks.plist.242.dr	false	high
https://xhamster.com/password-recovery_	AutoFillQuirks.plist.242.dr	false	high
https://hotels.com/profile/settings.html_	AutoFillQuirks.plist.242.dr	false	high
https://myspace.com/settings/profile/email_	AutoFillQuirks.plist.242.dr	false	high
https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_	AutoFillQuirks.plist.242.dr	false	high
https://allegro.pl/moje-allegro/moje-konto/logowanie-i-haslo_	AutoFillQuirks.plist.242.dr	false	high
https://customer.xfinity.com/users/me/update-password_	AutoFillQuirks.plist.242.dr	false	high
https://moncompte.lemonde.fr/gcustomer/account/password_	AutoFillQuirks.plist.242.dr	false	unknown
https://shein.com/user/security_	AutoFillQuirks.plist.242.dr	false	high
https://www.discogs.com/settings/user_	AutoFillQuirks.plist.242.dr	false	high
https://support.opentable.com/s/login/ForgotPassword?language=en_US_	AutoFillQuirks.plist.242.dr	false	unknown
https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_	AutoFillQuirks.plist.242.dr	false	high
https://www.amazon.com/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://www.newsweek.com/contact_	AutoFillQuirks.plist.242.dr	false	high
https://www.birkenstock.com/profile_	AutoFillQuirks.plist.242.dr	false	high
https://id.sonyentertainmentnetwork.com/id/management/#/p/security_	AutoFillQuirks.plist.242.dr	false	high
https://www.nba.com/account/nbaprofile_	AutoFillQuirks.plist.242.dr	false	high
https://cloud.linode.com/profile/auth_	AutoFillQuirks.plist.242.dr	false	high
https://codepen.io/settings/account_	AutoFillQuirks.plist.242.dr	false	high
https://www.serasa.com.br/meus-dados/alterar-senha_	AutoFillQuirks.plist.242.dr	false	high
https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_	AutoFillQuirks.plist.242.dr	false	high
https://www.allrecipes.com/account/profile#/change-password_	AutoFillQuirks.plist.242.dr	false	high
https://pro.housecallpro.com/service_pro/account/reset_password_	AutoFillQuirks.plist.242.dr	false	high
https://user.manganelo.com/user_changes_pass_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.dailymail.co.uk/registration/profile/change-password.html_	AutoFillQuirks.plist.242.dr	false	high
https://www.11st.co.kr/register/popupModifyPWD.tmall_	AutoFillQuirks.plist.242.dr	false	high
https://www.zulily.com/account/edit?rel=top_flyout_	AutoFillQuirks.plist.242.dr	false	high
https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_	AutoFillQuirks.plist.242.dr	false	high
https://www.creditkarma.com/myprofile/security_	AutoFillQuirks.plist.242.dr	false	high
https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res	AutoFillQuirks.plist.242.dr	false	unknown
https://account.magento.com/customer/account/changepassword_	AutoFillQuirks.plist.242.dr	false	unknown
https://profile.theguardian.com/reset_	AutoFillQuirks.plist.242.dr	false	high
https://reelgood.com/account_	AutoFillQuirks.plist.242.dr	false	high
https://dash.e.jimdo.com/profile_	AutoFillQuirks.plist.242.dr	false	unknown
https://go.com/profile/account-settings/edit_	AutoFillQuirks.plist.242.dr	false	high
https://genius.com/password_resets/new_	AutoFillQuirks.plist.242.dr	false	high
https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef	AutoFillQuirks.plist.242.dr	false	high
https://logowanie.pl.canalplus.com/zmien-haslo_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.alternate.de/html/myAccount/account/basicData.html_	AutoFillQuirks.plist.242.dr	false	high
https://blend.io/settings_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.aesop.com/my-account_	AutoFillQuirks.plist.242.dr	false	high
https://member.daum.net/change/password.daum_	AutoFillQuirks.plist.242.dr	false	unknown
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	AutoFillQuirks.plist.242.dr	false	unknown
https://mastercard.syf.com/login/reset_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.jcpenney.com/account/dashboard/personal/info_	AutoFillQuirks.plist.242.dr	false	high
https://worldstarhiphop.com/videos/reset.php_	AutoFillQuirks.plist.242.dr	false	high
https://www.shoop.de/einstellungen/benutzerdaten_	AutoFillQuirks.plist.242.dr	false	high
https://accounts.shopify.com/accounts/186490458/security_	AutoFillQuirks.plist.242.dr	false	high
https://app.carta.com/profiles/update/_	AutoFillQuirks.plist.242.dr	false	high
https://legacy.memoriams.com/Network/Account/ChangePassword_	AutoFillQuirks.plist.242.dr	false	unknown
https://profile.callofduty.com/cod/info_	AutoFillQuirks.plist.242.dr	false	high
https://blackwells.co.uk/bookshop/account/personal-details_	AutoFillQuirks.plist.242.dr	false	high
https://secure.hulu.com/account_	AutoFillQuirks.plist.242.dr	false	high
https://www.splunk.com/my-account/#/profile-details_	AutoFillQuirks.plist.242.dr	false	high
https://news.ycombinator.com/changepw_	AutoFillQuirks.plist.242.dr	false	high
https://classroom.udacity.com/settings/password_	AutoFillQuirks.plist.242.dr	false	unknown
https://pwrecovery.ruc.dk_	AutoFillQuirks.plist.242.dr	false	unknown
https://secure.ssa.gov/RIM/UpwdView.action_	AutoFillQuirks.plist.242.dr	false	high
https://www.ancestry.com/account/security/password_	AutoFillQuirks.plist.242.dr	false	high
https://key.harvard.edu/manage-account/change-password_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.amazon.ca/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://account.id.me/signin/password_	AutoFillQuirks.plist.242.dr	false	high
https://www.carnival.com/profilemanagement/profiles/changepassword_	AutoFillQuirks.plist.242.dr	false	high
https://thejigsawpuzzles.com/profile/?changepassword_	AutoFillQuirks.plist.242.dr	false	high
https://www.patreon.com/settings/account_	AutoFillQuirks.plist.242.dr	false	high
https://account.deere.com/actmgmt/change-password_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.ikea.com/in/en/profile/dashboard/_	AutoFillQuirks.plist.242.dr	false	high
https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.safeway.com/customer-account/account-settings_	AutoFillQuirks.plist.242.dr	false	high
https://www.amazon.de/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://www.cars.com/reset_password_	AutoFillQuirks.plist.242.dr	false	high
https://www.amazon.es/ax/account/manage_	AutoFillQuirks.plist.242.dr	false	high
https://www.zocdoc.com/patient/editprofile?section=Password_	AutoFillQuirks.plist.242.dr	false	high
https://www.apartments.com/my-account/#_	AutoFillQuirks.plist.242.dr	false	high
https://logonservices.iam.target.com/change-password/?target=#	AutoFillQuirks.plist.242.dr	false	high
https://www.aerlingus.com/html/user-profile.html_	AutoFillQuirks.plist.242.dr	false	high
https://www.dickssportinggoods.com/MyAccount/AccountSettings_	AutoFillQuirks.plist.242.dr	false	high
https://login.tmon.co.kr/user/info_	AutoFillQuirks.plist.242.dr	false	unknown
https://my.nextdns.io/account_	AutoFillQuirks.plist.242.dr	false	unknown
https://secure.indeed.com/account/changepassword_	AutoFillQuirks.plist.242.dr	false	high
https://www.temu.com/bgp_account_security.html_	AutoFillQuirks.plist.242.dr	false	high
https://imgur.com/account/settings/password_	AutoFillQuirks.plist.242.dr	false	high
https://my.norton.com/extspa/account/personalinfo_	AutoFillQuirks.plist.242.dr	false	high
https://account.proton.me/u/0/vpn/account-password_	AutoFillQuirks.plist.242.dr	false	high
https://www.espn.com/_	AutoFillQuirks.plist.242.dr	false	high
https://www.consumidor.gov.br/pages/usuario/editar_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.nike.com/member/settings_	AutoFillQuirks.plist.242.dr	false	high
https://www.bathandbodyworks.com/my-account/edit-profile_	AutoFillQuirks.plist.242.dr	false	high
https://myvpostpay.verizon.com/ui/bill/secure/_	AutoFillQuirks.plist.242.dr	false	high
https://www.glassdoor.com/member/profile/settings.htm_	AutoFillQuirks.plist.242.dr	false	high
https://employeewe.bamboohr.com/dashboard/password.php_	AutoFillQuirks.plist.242.dr	false	unknown
https://login.yahoo.com/account/change-password_	AutoFillQuirks.plist.242.dr	false	high
https://www.pornhub.com/user/security_	AutoFillQuirks.plist.242.dr	false	high
https://www.cargurus.com/Cars/myAccount#/accountSettings_	AutoFillQuirks.plist.242.dr	false	high
https://www.prowlapp.com/settings.php_	AutoFillQuirks.plist.242.dr	false	unknown
https://www.aeon.co.jp/app/settings/profile/password/_	AutoFillQuirks.plist.242.dr	false	unknown
https://accounts.intuit.com/app/account-manager/security/password_	AutoFillQuirks.plist.242.dr	false	high
https://shop.tmz.com/user?show=account-tab_	AutoFillQuirks.plist.242.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.201.89.151	unknown	United States	16625	AKAMAI-ASUS	false
144.208.67.33	fastbposolutions.com	United States	22611	IMH-WESTUS	false
23.209.221.54	unknown	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/dev/null

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.766905887404018
Encrypted:	false
SSDEEP:	3:tR5X4QpAXbRRdR4KV3WOv:lX4CUtRrVmA
MD5:	4F095D62D8299B86082E0430F4C1D3AD
SHA1:	C0ABB5F3CB1C158FCFD78495B336FECA200FDAD1
SHA-256:	57B3735F717ABEAF706DC505FEAA7798872EEF40D4FF66D42572C6F9AD67CDA3
SHA-512:	A2EA032E55251853BB90B06A1DA8FD54EC86BC4C0A176B26ED20389A81E02A66DEA983F06707EC945FDCC9CC4733ED130BB9698DA0580BA1027AD4F4DD29B530
Malicious:	false
Reputation:	low
Preview:	2024-12-05 15:25:05.824 Safari[615:4833] ApplePersistence=NO.

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	data
Category:	dropped
Size (bytes):	19328
Entropy (8bit):	2.9753497322131066
Encrypted:	false
SSDEEP:	192:XVlGq37NZFFFF/QQQQgdFSGXFFFFnQQQQ:uq37HFFFF/QQQQg3SGXFFFFnQQQQ
MD5:	1D8E1388683DC96ED97907EFCCE83FDA
SHA1:	561FDF03A98032BAAEB7BC214FD6FC2712BA42B0
SHA-256:	A6BE2B32F120066646A50B537477F2D359D7013851F123146CB9B6A7A1371E8C
SHA-512:	70A1E99DAD32B200EB26AD78E6433B3E9E052355ADA3A3AD1CB6C644C1A0513E593CCD89EF8B9B305013B37F3F850F049D787677878F412D23FB517147C18C98
Malicious:	false
Reputation:	low
Preview:	.............J..dJ......clti....0.......mlti........0...blti....2.......blti....2...H...blti....2...\|...blti....2.......blti....2.......blti....2.......blti....2...L...blti~...2.......5lti.@..,.......5lti.B..,....$..5lti.p..,.......5lti.D..,...87..................(....................................... .....................~...f... ...!............... ...4...3.......>.......U.......F...E...G...C...J...K...I...H...L...M...N.......O...?...9...P.......!............. .......t............."...........................................................#...............................^.......X...Y...Z...[...\...].......Q...........S.......R...............$.......(...%.......................&...'........... ...*...+...,...-.......5......./...0...1...6...7...8...:...4...3...........2...<...........T...;...=...>.......)...U...V...W.......@...A...B...F...E...G...C...D...J...K...I...H...L...M...N.......O...?.......9...P.......!...............j...X.....R...........%...7...........\.........".........

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533814637805397
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5:	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3
SHA1:	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C
SHA-256:	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
SHA-512:	1DC5282D27C49A4B6F921BA5DFC88B8C1D32289DF00DD866F9AC6669A5A8D99AFEDA614BFFC7CF61A44375AE73E09CD52606B443B63636977C9CD2EF4FA68A20
Malicious:	false
Reputation:	low
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5:	D3A1859E6EC593505CC882E6DEF48FC8
SHA1:	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32
SHA-256:	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
SHA-512:	EA2A749B105759EA33408186B417359DEFFB4A3A5ED0533CB26B459C16BB3524D67EDE5C9CF0D5098921C0C0A9313FB9C2672F1E5BA48810EDA548FA3209E818
Malicious:	false
Reputation:	low
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	70789
Entropy (8bit):	6.3739716471518975
Encrypted:	false
SSDEEP:	1536:RiEN19fJaM9tCm1vtMyMWzQPOhGnqtvjBfxW:Ri21ZJaMnCmxtPbbsqtvLW
MD5:	69D08C7EED04EB7C731052F1B8F4DBEC
SHA1:	AC1C3C50BCC4460B922DAFF04A7297E2ED9AC5BD
SHA-256:	D8860B7D73E6AD4484C666B4A8A117A1758CC70471DF4C54100716CAB08BF35B
SHA-512:	3D94529F171C4D44FB13C029FD8D11D11ED829BD5096947600562834148A095A20443CB502497E2BFB4BC58B390C445934DC11A1E65A15C7A9700512CC2A1456
Malicious:	false
Reputation:	low
Preview:	bplist00............................e...................._..PasswordGenerationRequirements_..AppIDsToDomainsAssociations_.;DomainsKnownToDoSameDocumentNavigationInTextEditingCallback_..ChangePasswordURLs_. DomainsWithAssociatedCredentials_..DomainsForPasskeyFallbackUI_.$DomainsIneligibleForStreamlinedLogin]SharedDomains_."DomainsIneligibleForAutomaticLogin_.BDomainsThatWhenEmbeddedAsThirdPartyAskForPasswordsForOtherServices_..DomainsIneligibleForPasskeys_..DomainsToConsiderIdentical...;..................................... .!.".#.$.%.&.'.(.).*.+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.\|.}.~...........................................................................................................................................................................................................................................................................................

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.37469842251369
Encrypted:	false
SSDEEP:	3:Nsm4nJNsGRbDJNsGM1aN7btoltm:NxeJ+gINaN3t4s
MD5:	7EBC7BAF0AB51EAF60EC8BC288C6B2FD
SHA1:	73E13AC19207D31E7B408C116B282EDACF66B2AD
SHA-256:	A2948EEBBF7982A18CF824CE6929D8003E93C52EBDF7EF6AEAF18E0F6B7F8CFF
SHA-512:	95F712B1A8B131EF083E8B479702A40130643E4784EB3F842732E4F40417B199D414675E607EE1B3D14D3B88E6A4BA4E0D5A130F0C78A6C2089D5F4179B10084
Malicious:	false
Reputation:	low
Preview:	bplist00....._..TemplateIconCacheVersion]TemplateIcons.....(68...............................9

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.286991847916908
Encrypted:	false
SSDEEP:	24:2dfyiwHuG5Ku3hu65juqVrTrmuGoTxR1F1xW:cfyP5Z/5PrUon1F1xW
MD5:	0C29425555C7FF0CA114B1FD0DC39C50
SHA1:	D7D808E8BE92462F4C3CEBA66734F0E9BB26ACDD
SHA-256:	52826AFEEC974BB7BACB85BDC01DC4F23BF917D65E04773D7CAD393F7866F3FD
SHA-512:	D9C8364A85F4B4A96CAAC1409F32F9D6B2F8AE19201E0ABD2D449A3EEDADD471E99E44BC92DEB5D8FB60287DA64A88E61B45F759E7B9A383A9BBE5F5FD242F95
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>SingleDeviceSaveChangesThrottlingPolicy</key>..<string>1:1440</string>..<key>MultipleDeviceSaveChangesThrottlingPolicy</key>..<string>50:1 \| 10:2 \| 10:5 \| 10:30 \| 9:40 \| 1:510</string>..<key>SingleDeviceFetchChangesThrottlingPolicy</key>..<string>11:15 \| 1:1275</string>..<key>MultipleDeviceFetchChangesThrottlingPolicy</key>..<string>50:1 \| 50:3 \| 20:4 \| 20:5 \| 20:15 \| 20:18 \| 20:20</string>..<key>SyncCircleSizeRetrievalThrottlingPolicy</key>..<string>1:1440</string>..<key>MaximumRequestLimitCharacterCount</key>..<integer>100000</integer>..<key>SyncWindow</key>..<real>1209600</real>..<key>HistoryModificationIdleDelayBeforeSyncAttemptKey</key>..<integer>90</integer>..<key>HistoryRemovalIdleDelayBeforeSyncAttempt</key>..<integer>6</integer>..<key>SaveChangesBeforeTerminationTimeout</key>..<integer>1</integer>.</dic

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	2890
Entropy (8bit):	6.383267531551876
Encrypted:	false
SSDEEP:	48:FMO+0F/o0CCPb/bCCoumzC6kiaR/wN4Gfhb0NegHI5mP0waijwg+tiEe:FMO+EoOfjovzCuv5I12msjtHe
MD5:	99707B6E8B1DAA434DE2A176A458F85C
SHA1:	96324F62483DD7AC8683D1850D694BB900EB3419
SHA-256:	F282D8A52BFDCD208792A47C074E59A1E16D627D53094E11FC73E595AEC7DDAD
SHA-512:	E8018018F91A5CE5C418F5C6445DC11A44B40AA6F619958D496B18507B3FE309415BF9AB293E9C7C0B3E4BA109213D0216D39C0304A7BC3CCE301DB0A729430C
Malicious:	false
Reputation:	low
Preview:	bplist00..=..........!$'*-0369<?BEHKNPRTWZ]`cfilnqtwz}......................._..Bundle Identifier_..Developer Identifier_..com.ci.LetyShopsZ8SY8U2YJ38....._..com.stopallads.stopalladssafariZW5672G9B78....._..com.ci.MyPointsScoreZPV79DKGW8E....._..com.shopicks.safariZ52637H29AM....._..com.mallforafrica.mfaZW67LVM7587....._..com.ci.FatWalletExpressZMUA2CU723E....._..com.ci.CashrewardsZWPDLU326V5....._..com.ci.ObybSecurityZ284W368NRK.....^com.ci.AmikashZP77C556755.... _..com.ci.ShopBackCashbackButtonZ63768R85VC..."#_..com.skaggivara.UniblockZ9ZWDNJ5X28...%&_..com.pcvark.adblockerZRQA86TX865...()_..com.ci.PrescritZDPQ487PKR3...+,^com.ci.CashBagZWPHQAS3C45..../_..com.betteradvertising.ghosteryZHPY23A294X...12_..com.ci.RotaryGumdropZ24MGUH34FU...45_..com.ci.DeippiesnlSpaarhulpZH8MVFTTJJ3...78_..com.ci.Rewards4RacingZL6C8C726SQ...:;_..com.findx.privacycontrolZ5QE6FTCMP9...=>_..com.ci.ShopandGivereminderZ5KWKJVWBTS...@A_..com.el1t.uBlockZ3NU33NW2M3...CD_..com.ci.DealDoktorZN64U5Y52L6...FG_.(co

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	1830
Entropy (8bit):	7.294007333039166
Encrypted:	false
SSDEEP:	48:E3NmrxTZTlg9IasJbxmQwwQ4uukgkukXkgv:zxtAAJbxBwH4u8kukXkgv
MD5:	20997F0623D2C8C476935D192206BA81
SHA1:	9CCA40CDC23FF5E04F5081CCA103A1726E01AE66
SHA-256:	4AEE17165944D003FAB880A24F7E785AC70BF6BEA331A9A7DA0A0C75F972CABC
SHA-512:	D9405C972281BAA2458CBF30BE18F0F62FC02D868FAC3BB6E2524F7005017178B0BFFC00E56C2710423A15A9AB5792DE7D795E52A15BF0185035C6BDD0AE3988
Malicious:	false
Reputation:	low
Preview:	bplist00.....^SessionVersion^SessionWindowsS1.0............................9_..SelectedTabIndex\TabBarHiddenZDateClosed_..FavoritesBarHidden]IsPopupWindow_. PrefersReadingListSidebarVisible\Miniaturized_..WindowStateVersionZWindowUUID_..WindowContentRectYTabStates_..IsPrivateWindow_..SelectedPinnedTabIndex...3A.(..I....S2.0_.$476D1CCD-5187-41AA-81E5-C75FE3DE0FF3_..{{0, 49}, {1024, 696}}.... !."#.$%&'().,-...0123456.\IsDisposable\SessionState_..AncestorTabIdentifers_..SessionStateIsEncryptedXTabIndex]LastVisitTimeWTabUUIDVTabURL]TabIdentifierXTabTitle_..ProcessIdentifierWIsMuted.O...m.V..r...........:;.....u...2.$.......P.x8.4&E.B=S.YQ.0..U...e..w..XE..9..)..FZl.3ug.`....coY.b:.:.B`.8.(.~..eE@X......0.g...u......x.A_w...zabG..!...p5..cZ.`...5...~q..6..]........tS...3[8..WX.....2&N..s....V...]..I....E~../.h._....G..A..;...@.R.....z.K...W...2.D.O..1.#d...\..R.m._......*.(../...P..M.k....p....x/.Q-...\K..s.K.K..1R.f....s...\|.....;A.D-..%...H.6.(o......l.M

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.9370658315190226
Encrypted:	false
SSDEEP:	3:N1n6qMvRGNMTAnd/t1tH:N1nleRaMTAltH
MD5:	CDC65B5F112547EAFAE0F16F9C149426
SHA1:	AEAF9908A5B6FF3E2F7B738ABF5FE9E79108BA01
SHA-256:	1C6D085D871A855CE4A3902BAB4B9B92631B8EE8F0B7F6536768A2AAF427B45C
SHA-512:	E8B0E4CE6A760A718A19976D3CFE9063F04FB4BF179947AECA84E94C83F21459FB9DC0FFABEA8F633BD2D0BA94FE1E15D8C97E9604FDE8BD0DEA961EB83BDDB7
Malicious:	false
Reputation:	low
Preview:	bplist00..._..ExtensionArchivesExtracted...(...............................)

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 22:25:11.087814093 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.087925911 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:11.088659048 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.092489004 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.092571974 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:11.707016945 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:11.708082914 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.708168983 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.708261013 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.735789061 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.735862970 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:11.736900091 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:11.737796068 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.739118099 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:11.782377005 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:12.147619009 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:12.147788048 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:12.148149014 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:12.148483038 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:12.155364037 CET	49369	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:12.155447960 CET	443	49369	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:12.571342945 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:12.571436882 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:12.572123051 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:12.573348999 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:12.573409081 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.163538933 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.164660931 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.164719105 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.164994001 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.192527056 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.192579031 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.193501949 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.194210052 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.196474075 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.238285065 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.536274910 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.536433935 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:13.536899090 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.537098885 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.543133020 CET	49371	443	192.168.11.12	144.208.67.33
Dec 5, 2024 22:25:13.543186903 CET	443	49371	144.208.67.33	192.168.11.12
Dec 5, 2024 22:25:31.881143093 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:31.881185055 CET	443	49379	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:31.881831884 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:31.885442019 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:31.885479927 CET	443	49379	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.175767899 CET	443	49379	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.176671982 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.176671982 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.194971085 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.195188046 CET	443	49379	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.195625067 CET	443	49379	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.195775032 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.196124077 CET	49379	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.209485054 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.209594011 CET	443	49380	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.210401058 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.211153984 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.211237907 CET	443	49380	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.490088940 CET	443	49380	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.490937948 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.491082907 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.495959044 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.496203899 CET	443	49380	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.496646881 CET	443	49380	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.496732950 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.497191906 CET	49380	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.613167048 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.613277912 CET	443	49382	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.614274979 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.615181923 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.615259886 CET	443	49382	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.899772882 CET	443	49382	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.901637077 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.901884079 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.908866882 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.908967972 CET	443	49382	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.909090996 CET	443	49382	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.909718990 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.909950972 CET	49382	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.920789957 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.920831919 CET	443	49385	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:32.921591997 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.922219992 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:32.922238111 CET	443	49385	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:33.233179092 CET	443	49385	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:33.235240936 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:33.235240936 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:33.241322041 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:33.241522074 CET	443	49385	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:33.241945982 CET	443	49385	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:33.242151976 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:33.242434025 CET	49385	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.173501968 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.173587084 CET	443	49404	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.174345970 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.175481081 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.175534010 CET	443	49404	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.450881958 CET	443	49404	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.451663971 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.451728106 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.487196922 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.487442017 CET	443	49404	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.487869024 CET	443	49404	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.487972975 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.488409042 CET	49404	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.579046011 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.579154015 CET	443	49407	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.579981089 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.581233978 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.581326962 CET	443	49407	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.860160112 CET	443	49407	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.860941887 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.861053944 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.873924017 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.874005079 CET	443	49407	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.874160051 CET	443	49407	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:37.874886036 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:37.874886990 CET	49407	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.096522093 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.096596003 CET	443	49413	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:39.097167969 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.097928047 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.097940922 CET	443	49413	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:39.381920099 CET	443	49413	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:39.382641077 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.382700920 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.392673016 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.392867088 CET	443	49413	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:39.393287897 CET	443	49413	151.101.131.6	192.168.11.12
Dec 5, 2024 22:25:39.393522978 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:39.393949032 CET	49413	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:25:56.048887968 CET	49345	80	192.168.11.12	23.209.221.54
Dec 5, 2024 22:25:56.176280022 CET	80	49345	23.209.221.54	192.168.11.12
Dec 5, 2024 22:25:56.176981926 CET	49345	80	192.168.11.12	23.209.221.54
Dec 5, 2024 22:26:02.577330112 CET	49353	443	192.168.11.12	23.201.89.151
Dec 5, 2024 22:26:02.578514099 CET	49353	443	192.168.11.12	23.201.89.151
Dec 5, 2024 22:26:02.701447010 CET	443	49353	23.201.89.151	192.168.11.12
Dec 5, 2024 22:26:02.701489925 CET	443	49353	23.201.89.151	192.168.11.12
Dec 5, 2024 22:26:02.702094078 CET	49353	443	192.168.11.12	23.201.89.151
Dec 5, 2024 22:26:02.702156067 CET	49353	443	192.168.11.12	23.201.89.151
Dec 5, 2024 22:26:02.702416897 CET	443	49353	23.201.89.151	192.168.11.12
Dec 5, 2024 22:26:02.703170061 CET	49353	443	192.168.11.12	23.201.89.151
Dec 5, 2024 22:26:03.452125072 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.452173948 CET	443	49414	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:03.452826023 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.453671932 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.453691959 CET	443	49414	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:03.733602047 CET	443	49414	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:03.734535933 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.734535933 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.744843006 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.744951010 CET	443	49414	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:03.745115995 CET	443	49414	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:03.745490074 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.745615959 CET	49414	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.757282972 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.757322073 CET	443	49415	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:03.757941008 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.758645058 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:03.758658886 CET	443	49415	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.045265913 CET	443	49415	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.046094894 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.046116114 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.058394909 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.058526993 CET	443	49415	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.058757067 CET	443	49415	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.059499979 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.059499979 CET	49415	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.083333969 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.083390951 CET	443	49416	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.084160089 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.084865093 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.084909916 CET	443	49416	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.363518000 CET	443	49416	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.365521908 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.365521908 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.371778965 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.371920109 CET	443	49416	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.372164965 CET	443	49416	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.372668982 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.372704029 CET	49416	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.383152962 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.383264065 CET	443	49417	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.383836985 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.384624004 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.384710073 CET	443	49417	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.674892902 CET	443	49417	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.675721884 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.675723076 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.681757927 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.682007074 CET	443	49417	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.682554960 CET	49417	443	192.168.11.12	151.101.131.6
Dec 5, 2024 22:26:04.682571888 CET	443	49417	151.101.131.6	192.168.11.12
Dec 5, 2024 22:26:04.683212996 CET	49417	443	192.168.11.12	151.101.131.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 5, 2024 22:25:10.896841049 CET	56716	53	192.168.11.12	1.1.1.1
Dec 5, 2024 22:25:11.082344055 CET	53	56716	1.1.1.1	192.168.11.12
Dec 5, 2024 22:25:20.893752098 CET	53	59261	1.1.1.1	192.168.11.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 5, 2024 22:25:10.896841049 CET	192.168.11.12	1.1.1.1	0x3e4f	Standard query (0)	fastbposolutions.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 5, 2024 22:25:11.082344055 CET	1.1.1.1	192.168.11.12	0x3e4f	No error (0)	fastbposolutions.com		144.208.67.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fastbposolutions.com

https:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.12	49369	144.208.67.33	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 21:25:11 UTC	421	OUT	GET /language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php HTTP/1.1 Host: fastbposolutions.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-gb Connection: keep-alive Accept-Encoding: br, gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
2024-12-05 21:25:12 UTC	195	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Thu, 05 Dec 2024 21:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2024-12-05 21:25:12 UTC	27	IN	Data Raw: 31 30 0d 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 10File not found.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.12	49371	144.208.67.33	443

Timestamp	Bytes transferred	Direction	Data
2024-12-05 21:25:13 UTC	412	OUT	GET /favicon.ico HTTP/1.1 Host: fastbposolutions.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php Accept-Encoding: br, gzip, deflate
2024-12-05 21:25:13 UTC	173	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Thu, 05 Dec 2024 21:25:13 GMT Content-Type: text/html Content-Length: 153 Connection: close Vary: Accept-Encoding
2024-12-05 21:25:13 UTC	153	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 37 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.27.2</center></body></html>

System Behavior

Analysis Process: mono-sgen32 PID: 614, Parent PID: 537

General

Start time (UTC):	21:25:04
Start date (UTC):	05/12/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Chronological Activities

Analysis Process: open PID: 614, Parent PID: 537

General

Start time (UTC):	21:25:04
Start date (UTC):	05/12/2024
Path:	/usr/bin/open
Arguments:	/usr/bin/open -a Safari https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php
File size:	105952 bytes
MD5 hash:	34bd93241fa5d2aee225941b1ca14fa4

Chronological Activities

Analysis Process: xpcproxy PID: 615, Parent PID: 1

General

Start time (UTC):	21:25:04
Start date (UTC):	05/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: Safari PID: 615, Parent PID: 1

General

Start time (UTC):	21:25:04
Start date (UTC):	05/12/2024
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Arguments:	/Applications/Safari.app/Contents/MacOS/Safari
File size:	27120 bytes
MD5 hash:	2dde28c2f8a38ed2701ba17a0893cbc1

Chronological Activities

Analysis Process: xpcproxy PID: 627, Parent PID: 1

General

Start time (UTC):	21:25:16
Start date (UTC):	05/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: silhouette PID: 627, Parent PID: 1

General

Start time (UTC):	21:25:16
Start date (UTC):	05/12/2024
Path:	/usr/libexec/silhouette
Arguments:	/usr/libexec/silhouette
File size:	65920 bytes
MD5 hash:	485ec1bd3cd09293e26d05f6fe464bfd

Chronological Activities

Analysis Process: xpcproxy PID: 633, Parent PID: 1

General

Start time (UTC):	21:25:30
Start date (UTC):	05/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: nsurlstoraged PID: 633, Parent PID: 1

General

Start time (UTC):	21:25:30
Start date (UTC):	05/12/2024
Path:	/usr/libexec/nsurlstoraged
Arguments:	/usr/libexec/nsurlstoraged --privileged
File size:	246624 bytes
MD5 hash:	321b0a40e24b45f0af49ba42742b3f64

Chronological Activities

Analysis Process: xpcproxy PID: 645, Parent PID: 1

General

Start time (UTC):	21:25:51
Start date (UTC):	05/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: eficheck PID: 645, Parent PID: 1

General

Start time (UTC):	21:25:51
Start date (UTC):	05/12/2024
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/dev/null

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

System Behavior

Analysis Process: mono-sgen32 PID: 614, Parent PID: 537

General

Chronological Activities

Analysis Process: open PID: 614, Parent PID: 537

General

Chronological Activities

Analysis Process: xpcproxy PID: 615, Parent PID: 1

General

Chronological Activities

Analysis Process: Safari PID: 615, Parent PID: 1

General

Chronological Activities

Analysis Process: xpcproxy PID: 627, Parent PID: 1

General

macOS Analysis Report
https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php