Play interactive tourEdit tour

macOS Analysis Report
https://Newscorp.wtranovations.com/edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$

Overview

General Information

Sample URL:	https://Newscorp.wtranovations.com/edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$
Analysis ID:	1645253
Infos:

Detection

Score:	48
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Classification

×

Joe Sandbox Signatures

• • AV Detection
• • Compliance
• • Networking
• • System Summary
• • Persistence and Installation Behavior
• • Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://Newscorp.wtranovations.com/edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$

Avira URL Cloud: detection malicious, Label: malware

Compliance

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.250:443 -> 192.168.11.12:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.229:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.11.12:49387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.11.12:49388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.42.211:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.250:443 -> 192.168.11.12:49422 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.250:443 -> 192.168.11.12:49424 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49474 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49479 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49483 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49484 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49485 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49486 version: TLS 1.2

Networking

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.195.6
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.3.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.3.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.3.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.3.6

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /npm/ua-parser-js@1.0.38/src/ua-parser.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.0.0-beta3/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /data/icons/ionicons/512/icon-close-round-512.png HTTP/1.1Host: cdn4.iconfinder.comConnection: keep-aliveAccept: image/png,image/svg+xml,image/*;q=0.8,video/*;q=0.8,*/*;q=0.5User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ad083999f1/start?for=/edzxesfee/d205afd3/ HTTP/1.1Host: newscorp.wtranovations.comOrigin: https://newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /statsic/css/main.output.css HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: text/css,*/*;q=0.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: */*Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: com.apple.Safari.SearchHelper/14606.3.4 CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.0.0-beta3/webfonts/fa-regular-400.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: */*Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: com.apple.Safari.SearchHelper/14606.3.4 CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;!!F0Stn7g!E0yRpQQMM0NAZFe0WZgVZoU9UW-O8fAzEbpBRs9Nx6gsHTBN5bkxYcJeSQF_jMoSh7a26p6PazhhZgHyEsclklDH$ HTTP/1.1Host: newscorp.wtranovations.comAccept: */*Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: com.apple.Safari.SearchHelper/14606.3.4 CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: newscorp.wtranovations.comConnection: keep-aliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://newscorp.wtranovations.com/Accept-Encoding: br, gzip, deflate

Found strings which match to known social media urls

Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: .https://www.facebook.com/settings?tab=security_ equals www.facebook.com (Facebook)
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: 2https://www.linkedin.com/psettings/change-password_ equals www.linkedin.com (Linkedin)
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.facebook.com/XFacebook equals www.facebook.com (Facebook)
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.linkedin.com/XLinkedIn equals www.linkedin.com (Linkedin)
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.yahoo.com/UYahoo equals www.yahoo.com (Yahoo)

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: newscorp.wtranovations.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn4.iconfinder.com

URLs found in memory or binary data

Source: CloudHistoryRemoteConfiguration.plist.244.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: TopSites.plist.244.dr	String found in binary or memory: http://www.apple.com/uk/startpage/
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://247sports.com/my/settings/password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.booking.com/account-recovery_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.churchofjesuschrist.org/changePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.deere.com/actmgmt/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.docusign.com/me/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.forbes.com/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.gmx.net/ciss/security/edit/passwordChange_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.id.hp.com/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.id.me/signin/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.idm.telekom.com/account-manager/password/index.xhtml_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.live.com/password/Change_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.magento.com/customer/account/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.proton.me/u/0/vpn/account-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.samsung.com/membership/contents/security/password/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://account.shodan.io/change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.adafruit.com/settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.autodesk.com/Profile/Security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.craigslist.org/pass_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.crowdin.com/password/change_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.dmm.co.jp/settings/change/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.ebay.com/acctsec/security-center/chngpwd_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.intuit.com/app/account-manager/security/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.nintendo.com/password/edit_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.panic.com/password_set_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.pch.com/forgotpass_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.secondlife.com/change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://accounts.shopify.com/accounts/186490458/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://acesso.gov.br/area-cidadao/#/alterarSenha_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://adultfriendfinder.com/p/update.cgi?p=my_account_update_account_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://allegro.pl/moje-allegro/moje-konto/logowanie-i-haslo_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.acorns.com/settings/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.carta.com/profiles/update/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.constantcontact.com/pages/myaccount/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.getflywheel.com/profile/security/change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.parkmobile.io/account/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.plex.tv/desktop#
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.prolific.co/account/general_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.sipgatebasic.de/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.stonly.com/app/general/userSettings/Account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://app.zeplin.io/profile/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://appleid.apple.com/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://apps.jw.org/E_PASSCHG1_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://archive.org/account/index.php?settings=1_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://arxiv.org/user/change_own_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.astonmartinf1.com/Dashboard/ChangePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.danawa.com/modifyMember_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.fandom.com/auth/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.opera.com/account/edit-profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.readymag.com/password/forgot_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.redgifs.com/lo/reset?ticket=_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://auth.usnews.com/changePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://b2c.voegol.com.br/minhas-viagens/meu-perfil_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://bandcamp.com/settings#password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://benefitslogin.discoverybenefits.com/Profile/UpdatePassword.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://blackwells.co.uk/bookshop/account/personal-details_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://blend.io/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://bugzilla.kernel.org/userprefs.cgi?tab=account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://campus.tum.de_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://card.discover.com/cardmembersvcs/personalprofile/pp/UpdateDetails?ICMPGN=MYPROFILE_USERID_PA
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://censys.io/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://cfspart.impots.gouv.fr/monprofil-webapp/GererMonProfil_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://chaturbate.com/auth/password_change/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://classroom.udacity.com/settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://cloud.digitalocean.com/settings/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://cloud.linode.com/profile/auth_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://codepen.io/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://consumercenter.mysynchrony.com/consumercenter/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://customer.safeco.com/accountmanager/profile/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://customer.xfinity.com/users/me/update-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://customercenter.marketwatch.com/account#password?mod=ql_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://customercenter.wsj.com/account#password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dan.com/users/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dash.cloudflare.com/profile/authentication_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dash.e.jimdo.com/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dashboard.branch.io/account-settings/user_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dashboard.dittomusic.com/account/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dashboard.heroku.com/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://dashboard.messagebird.com/account/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://discord.com/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://duolingo.com/settings/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://elpais.com/subscriptions/#/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://employeewe.bamboohr.com/dashboard/password.php_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://experience.gm.com/myaccount/security/passwordChange_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://fetlife.com/settings/account/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://flightaware.com/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://forum.wii-homebrew.com/index.php/AccountManagement/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://foursquare.com/change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://genius.com/password_resets/new_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://github.com/settings/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://go.com/profile/account-settings/edit_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpChangePassword?redir=store/account/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpWithLoginInfoReset/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://hibrain.net/mybrain/users/password/edit_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://home.thesun.co.uk/edit/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://honeywell.csod.com/resetPasswrd.aspx?_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://hotels.com/profile/settings.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://hq1.appsflyer.com/account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://id.atlassian.com/manage-profile/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://id.nfl.com/account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://id.sonyentertainmentnetwork.com/id/management/#/p/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://identity.surveymonkey.com/us/manage?locale=en_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://identity.xero.com/account/?AccountUrl=/
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://imgur.com/account/settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://key.harvard.edu/manage-account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://kundenportal.edeka-smart.de/edeka-csc/forgot-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://l.doctoralia.com.br/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://leetcode.com/accounts/password/set/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://legacy.memoriams.com/Network/Account/ChangePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://letterboxd.com/settings/auth/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://linktr.ee/admin/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.aliexpress.com/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.aol.com/account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.blockchain.com/en/#/security-center/advanced_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.coupang.com/login/userModify.pang_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.teamviewer.com/nav/profile/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.thesun.co.uk/user/changePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.ti.com/ext/pwdchange/Identify_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.tmon.co.kr/user/info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.usatoday.com/USAT-GUP/password-forgot/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.yahoo.com/account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/?src=finance_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://logonservices.iam.target.com/change-password/?target=#
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://logowanie.pl.canalplus.com/zmien-haslo_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://mastercard.syf.com/login/reset_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://mathworks.com/mwaccount/profiles/password/change_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://member.daum.net/change/password.daum_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://member.webmd.com/password-reset_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://membership.latimes.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://memberssl.auction.co.kr/membership/MyInfo/MyInfo.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://minhanet.net.com.br/webcenter/portal/MinhaNet/pages_alterarsenha_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://moncompte.lemonde.fr/gcustomer/account/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.foxbusiness.com/?p=account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.foxnews.com/?pieces=reset_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.goabode.com/#/app/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.nextdns.io/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.norton.com/extspa/account/personalinfo_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.okta.com/signin/password-reset_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://my.state.nj.us/edituser/EditUserProfile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myaccount.ea.com/cp-ui/security/index_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password?continue=https://myaccount.google.com/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myaccount.uscis.gov/users/registration/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myaccounts.capitalone.com/Security/changePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://mychart.clevelandclinic.org/inside.asp?mode=passwd_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://mypassword.uml.edu/#Change_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://mypay.dfas.mil/#/settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myspace.com/settings/profile/email_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://myvpostpay.verizon.com/ui/bill/secure/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://na224.lightning.force.com/lightning/settings/personal/ChangePassword/home_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://nbcuniversal.nbc.com/request-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://news.ycombinator.com/changepw_
Source: LastSession.plist0.244.dr, LastSession.plist.244.dr	String found in binary or memory: https://newscorp.wtranovations.com/edzxesfee/d205afd3/?0pcb7=dHRob3JwZUBuZXdzY29ycC5jb20=__;
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://nhentai.net/reset/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://nid.naver.com/user2/help/myInfo.nhn?m=viewChangePasswd_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://njal.la/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://nypost.com/account/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://online.citi.com/US/ag/profile-update/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://onlyfans.com/my/settings/account/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://orcid.org/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://password.umsystem.edu/reset/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://play.hbomax.com/setting/account/edit/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://portal.edd.ca.gov/WebApp/Profile/UpdatePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://portal.pilotflyingj.com/myrewards/forgot-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://portalpersonas.bancochile.cl/mibancochile-web/front/persona/index.html#/mi-perfil/datos-segu
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://portlandgeneral.com/secure/profile/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://poshmark.com/user/account-info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://pro.housecallpro.com/service_pro/account/reset_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://profile.callofduty.com/cod/info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://profile.nvgs.nvidia.com/security/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://profile.theguardian.com/reset_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://pwrecovery.ruc.dk_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://quizlet.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://redirect.pizza/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://reelgood.com/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://rule34.xxx/index.php?page=account&s=change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://rumble.com/account/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://saude.sulamericaseguros.com.br/segurado/gerenciar-cadastro/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure-www.gap.com/my-account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.aarp.org/account/editaccount?request_locale=en&nu=t_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.bankofamerica.com/auth/security-center/main/?activity=changePasscode_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.cecredentialtrust.com/account/editpassword/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.fnac.com/account/update-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.hulu.com/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.indeed.com/account/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.login.gov/manage/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.maxpreps.com/utility/member/forgotpassword.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.npr.org/oauth2/login_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.orclinic.com/portal/editprofile.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.ssa.gov/RIM/UpwdView.action_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure.tagged.com/account_info.html?dataSource=Settings&ll=nav_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://selvbetjening.rejsekort.dk/CWS/CustomerManagement/ChangePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://shein.com/user/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://shop.tmz.com/user?show=account-tab_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://slickdeals.net/forums/login.php?do=lostpw_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://soap2day.to/home/user/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://solitaired.com/user/reset-password?_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://soundcloud.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://spankbang.com/users/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://sslmember2.gmarket.co.kr/MYInfo/MemberInfo_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://stackoverflow.com/users/account-recovery_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://stacksocial.com/user?show=account-tab_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://store.cpanel.net/my/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://stripchat.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://subscribe.washingtonpost.com/profile/#
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://support.opentable.com/s/login/ForgotPassword?language=en_US_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://thejigsawpuzzles.com/profile/?changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://thenounproject.com/accounts/password/change/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://time.com/manage-account/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://tinyurl.com/app/settings/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://todoist.com/prefs/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://trakt.tv/settings#password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://tripit.com/account/edit/section/change_password_
Source: TopSites.plist.244.dr	String found in binary or memory: https://twitter.com/WTwitter
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://twitter.com/settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://udapps.nss.udel.edu/myUDsettings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://ui.attentivemobile.com/forgot-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://usa.experian.com/member/ngx-profile/account-info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://user.manganelo.com/user_changes_pass_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://web.500px.com/settings/account/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://wordpress.com/me/security/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://worldstarhiphop.com/videos/reset.php_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.11st.co.kr/register/popupModifyPWD.tmall_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.1800contacts.com/account/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.aa.com/loyalty/profile/information_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.account.publishing.service.gov.uk/account/edit/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.acehardware.com/myaccount#settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ae.com/myaccount_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.aeon.co.jp/app/settings/profile/password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.aerlingus.com/html/user-profile.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.aesop.com/my-account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.airnewzealand.com/membership/profile/security/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.alaskaair.com/www2/ssl/myalaskaair/myalaskaair.aspx?view=myinformation&tab=email_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.alliantcreditunion.com/OnlineBanking/Settings/AccessAndSecurity/ChangePassword.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.allianz.com.br/alteracao-de-password-ecliente_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.allrecipes.com/account/profile#/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.alternate.de/html/myAccount/account/basicData.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.ae/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.ca/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.co.uk/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.com.au/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.com.br/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.com.mx/ax/account/manage
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.com.tr/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.com/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.de/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.es/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.fr/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.in/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.it/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.nl/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.pl/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.sa/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.se/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amazon.sg/ax/account/manage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.amctheatres.com/amcstubs/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.americanexpress.com/en-us/account/password/reset_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ancestry.com/account/security/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.apartments.com/my-account/#_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.apply.vccs.edu/Profile/_default.aspx_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.arlt.com/mein-passwort/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.att.com/acctmgmt/profile/overview_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.auctionzip.com/cgi-bin/userpanel.cgi?mode=3_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.bathandbodyworks.com/my-account/edit-profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.bbq-grill-world.de/customer/account/edit/changepass/1/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.bedbathandbeyond.com/store/account/personalinfo_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.belk.com/account-edit-profile/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.berlet.de/mein-konto.htm#my-account--edit-pass_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.bestbuy.com/identity/accountSettings/page/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.biblegateway.com/user/account/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.birkenstock.com/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.bloomberg.com/portal/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.blutdruck-shop.de/mein-passwort/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.boredpanda.com/settings/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.browserstack.com/accounts/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.businessinsider.com/#_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.buzzfeed.com/settings/password/change_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cakeresume.com/settings/account?ref=navs_settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.canva.com/login?redirect=%2Fsettings%2Flogin-and-security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cargurus.com/Cars/myAccount#/accountSettings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.carnival.com/profilemanagement/profiles/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cars.com/reset_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cbsnews.com/user/change-password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cbssports.com/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.change.org/account_settings/change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.chegg.com/my/account-next_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.chess.com/settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.chewy.com/app/resetpassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cinemark.com.br/minha-conta_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.clien.net/service/mypage/myInfoComfrim_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cnbc.com/account/#profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cnn.com/account/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.columbia.com/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.consumidor.gov.br/pages/usuario/editar_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.costco.com/AccountInformationView?identifier=manage-membership_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.coursehero.com/my-account/#/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.crackle.com/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.creditkarma.com/myprofile/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.credly.com/earner/settings/privacy_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.crunchyroll.com/resetpw_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.cvs.com/my-account/profile/sign-in-and-security/edit-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dailymail.co.uk/registration/profile/change-password.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.darty.com/espace_client/donnees-personnelles/mot-de-passe/edition_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dell.com/identity/global/editaccount?_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.delta.com/myprofile/security-settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.deviantart.com/settings/general_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dickssportinggoods.com/MyAccount/AccountSettings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.discogs.com/settings/user_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.disneyplus.com/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dominos.com/en/pages/customer/#
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.doordash.com/accounts/password/reset/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dotloop.com/my/account/#/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dropbox.com/account/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dsw.com/en/us/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.dwr.com/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.epicgames.com/account/password?lang=en&productName=epicgames_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.eporner.com/profile/mturk_eporn/my/edit-pass/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.espn.com/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.eventbrite.com/account-settings/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.evite.com/reset_password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.expedia.com/user/forgotpassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.familysearch.org/identity/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.fanfiction.net/account/password.php_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.fedex.com/en-us/create-account/how-to-reset-forgot-password.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.findagrave.com/user/account/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.fitbit.com/settings/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.foodnetwork.com/user-profile-page_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.foxsports.com/#_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.frutifica.com.br/conta/alterar_senha_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.gamespot.com/change-details/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.geocaching.com/account/settings/changepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.glassdoor.com/member/profile/settings.htm_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.gocomics.com/profiles/create-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.gog.com/account/settings/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.goodreads.com/ap/cnep_
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.google.com/?client=safari&channel=mac_bmVGoogle
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.grainger.com/myaccount/loginoptions_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.grubhub.com/account/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.happycow.net/members/profile/update/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.hilton.com/en/hilton-honors/guest/profile/password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.homedepot.com/myaccount/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.hsn.com/myaccount/update_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.huffpost.com/member/edit-profile_
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.icloud.com/ViCloud
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ign.com/account/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ihg.com/rewardsclub/gb/en/account-mgmt/personalInformation_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ikea.com/in/en/profile/dashboard/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.independent.co.uk/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.insider.com/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.instacart.com/store/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.instagram.com/accounts/password/change/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.istockphoto.com/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.jcpenney.com/account/dashboard/personal/info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.kohls.com/myaccount/accountsettings.jsp_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.kroger.com/account/update_
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.linkedin.com/XLinkedIn
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.linkedin.com/psettings/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.livejasmin.com/en/girls/#
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.lowes.com/mylowes/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.marktplaats.nl/account/password-reset/confirm.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.marriott.com/loyalty/myAccount/changePassword.mi_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.mediafire.com/myaccount/accountbilling.php#change-pwd-block_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.meliuz.com.br/minha-conta/meus-dados/senha_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.menards.com/main/accountoverview.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.mercari.com/mypage/email_password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.michaels.com/on/demandware.store/Sites-MichaelsUS-Site/default/Account-EditProfile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.mlb.com/account/general_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.mountainwarehouse.com/account/details-link/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.myfreecams.com/php/account.php?request=status&vcc=1674246522#change_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.mylo.id/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.nba.com/account/nbaprofile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.netflix.com/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.netvibes.com/account/password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.newsweek.com/contact_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.nike.com/member/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.nordstrom.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.nordstromrack.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.nytimes.com/account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.officedepot.com/account/editLoginDisplay.do_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.overleaf.com/user/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.overstock.com/myaccount/account/email-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.paramountplus.com/account/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.patreon.com/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.paypal.com/myaccount/security/password/change_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.peacocktv.com/forgot_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.pinterest.com/settings/account-settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.politico.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.pornhub.com/user/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ppomppu.co.kr/myinfo/profile.php_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.prowlapp.com/settings.php_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.quora.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.rakuten.com/account-settings.htm_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.realtor.com/myaccount/profile/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.reddit.com/prefs/update/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.redfin.com/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.redtube.com/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.rei.com/YourAccountCredentials_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.reuters.com/account/forgot-password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.roblox.com/my/account#
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.rottentomatoes.com/user/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.safeway.com/customer-account/account-settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.samsclub.com/account/personal-info?xid=hdr_account_change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.santahelenasaude.com.br/beneficiario/#/alterar-senha_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.saturn.de/webapp/wcs/stores/servlet/MultiChannelMAChangePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.scribd.com/account-settings#change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.sephora.com/profile/MyAccount_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.serasa.com.br/meus-dados/alterar-senha_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.shoop.de/einstellungen/benutzerdaten_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.shopback.co.kr/account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.shutterfly.com/account-settings/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.sonos.com/myaccount/user/profile/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.southwest.com/loyalty/myaccount/profile-security.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.spectrum.net/user-preferences/your-info/manage/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.speedway.com/my-account/security/passcode_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.splunk.com/my-account/#/profile-details_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.spotify.com/in-en/account/change-password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.swagbucks.com/account/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.swinglifestyle.com/profile/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.tasteofhome.com/login/updatepassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.teacherspayteachers.com/My-Account/Basics/edit_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.temu.com/bgp_account_security.html_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.thesimsresource.com/account#/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.thetrainline.com/my-account/change-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.thetvdb.com/dashboard/account/changepass_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.tiktok.com/login/email/forget-password_
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.tripadvisor.com/
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.tripadvisor.com/Settings-cp_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.trulia.com/account/user_profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.tumblr.com/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.turkishairlines.com/tr-int/miles-and-smiles/forgot-password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.twilio.com/console/user/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.twitch.tv/settings/security_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.uline.com/MyAccount/ContactPref_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ulta.com/myaccount/index.jsp_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.united.com/ual/en/US/account/security/setpassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ups.com/lasso/updatePass?loc=en_US_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ventrachicago.com/account/manage-account/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.victoriassecret.com/us/account/profile#changePassword_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.vrbo.com/traveler/profile/edit_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.walgreens.com/account/user_and_password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.walmart.com/account/profile_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.wayfair.com/v/account/personal_info/edit_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.wikihow.com/Special:ChangeCredentials/MediaWiki%5CAuth%5CPasswordAuthenticationRequest_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.wired.com/account/reset-password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.worldwinner.com/cgi/finance/account.pl_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.wunderground.com/member/settings_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.xvideos.com/account/security_
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.yahoo.com/UYahoo
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.yellowpages.com/settings/password_
Source: TopSites.plist.244.dr	String found in binary or memory: https://www.yelp.com/TYelp
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.youporn.com/settings/change/password/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.zhihu.com/settings/account_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.zillow.com/myzillow/profile/_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.ziprecruiter.com/login/forgot-password?realm=candidates_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.zocdoc.com/patient/editprofile?section=Password_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://www.zulily.com/account/edit?rel=top_flyout_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://xhamster.com/password-recovery_
Source: AutoFillQuirks.plist.244.dr	String found in binary or memory: https://yelp.com/profile_password_

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 49483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49445
Source: unknown	Network traffic detected: HTTP traffic on port 49437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49442
Source: unknown	Network traffic detected: HTTP traffic on port 49414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49440
Source: unknown	Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49437
Source: unknown	Network traffic detected: HTTP traffic on port 49409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49436
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 49440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown	Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49391
Source: unknown	Network traffic detected: HTTP traffic on port 49377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49390
Source: unknown	Network traffic detected: HTTP traffic on port 49423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49429
Source: unknown	Network traffic detected: HTTP traffic on port 49479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49428
Source: unknown	Network traffic detected: HTTP traffic on port 49383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49424
Source: unknown	Network traffic detected: HTTP traffic on port 49435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49388
Source: unknown	Network traffic detected: HTTP traffic on port 49406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49387
Source: unknown	Network traffic detected: HTTP traffic on port 49412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown	Network traffic detected: HTTP traffic on port 49393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49382
Source: unknown	Network traffic detected: HTTP traffic on port 49429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49419
Source: unknown	Network traffic detected: HTTP traffic on port 49384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49415
Source: unknown	Network traffic detected: HTTP traffic on port 49375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49413
Source: unknown	Network traffic detected: HTTP traffic on port 49484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49375
Source: unknown	Network traffic detected: HTTP traffic on port 49415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49371
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 49410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49486
Source: unknown	Network traffic detected: HTTP traffic on port 49408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49483
Source: unknown	Network traffic detected: HTTP traffic on port 49427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49479
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 49405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 49486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49475 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.250:443 -> 192.168.11.12:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.229:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.11.12:49387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.11.12:49388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.42.211:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.250:443 -> 192.168.11.12:49422 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.59.250:443 -> 192.168.11.12:49424 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49474 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49479 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49483 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49484 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49485 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49486 version: TLS 1.2

System Summary

Classification label

Source: classification engine

Classification label: mal48.mac@0/14@5/0

Persistence and Installation Behavior

Reads data from the local random generator

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Random device file read: /dev/urandom			Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 645)	Random device file read: /dev/random			Jump to behavior

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Writes property list (.plist) files to disk

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/AutoFillQuirks.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/SearchDescriptions.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 2)/LastSession.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari 3)/PerSiteZoomPreferences.plist			Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/TopSites.plist			Jump to dropped file

Language, Device and Operating System Detection

Reads the system or server version plist file

Source: /usr/bin/open (PID: 609)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 610)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior