Edit tour

Windows Analysis Report
https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/

Overview

General Information

Sample URL:	https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/
Analysis ID:	1636963
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains password input but no form action

HTML page contains hidden javascript code

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2448,i,17708118831512831231,16263542347099790622,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /v1/p HTTP/1.1Host: api.segment.ioConnection: keep-aliveContent-Length: 1375sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plainsec-ch-ua-mobile: ?0Accept: */*Origin: https://replit.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://replit.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: https://replit.com/signup?goto=agentVerify?prompt%3DLIQw1gpgBCB2UQCYFcDGIAuBLA9rEANlAM44EgBOJAnsRhALYwAOzUAZjlQRJbFrADmMAEY5kGKBgAW0ZuVgQMxAHRA%26skipOnboarding%3Dtrue	HTTP Parser: Iframe src: https://js.stripe.com/v3/controller-with-preconnect-af32ea7af19d288bc12d850bf58f1679.html#__shared_params__[version]=v3&apiKey=pk_live_515YpNsJAmnYVOvfnsBqRdATWS6SzbNAslOz1z2tujdKuvRMDAwWMeFXp6dJL1YKRrQjB0WAp0UDGwlFYL7hxw7Fc00QkfxBFsL&stripeJsId=e747d999-5089-4fc6-be5d-0563ec83da03&controllerCount=1&isCheckout=false&stripeJsLoadTime=1741855680522&manualBrowserDeprecationRollout=false&mids[guid]=NA&mids[muid]=NA&mids[sid]=NA&referrer=https%3A%2F%2Freplit.com%2Fsignup%3Fgoto%3DagentVerify%3Fprompt%253DLIQw1gpgBCB2UQCYFcDGIAuBLA9rEANlAM44EgBOJAnsRhALYwAOzUAZjlQRJbFrADmMAEY5kGKBgAW0ZuVgQMxAHRA%2526skipOnboarding%253Dtrue&controllerId=__privateStripeController0111
Source: https://replit.com/signup?goto=agentVerify?prompt%3DLIQw1gpgBCB2UQCYFcDGIAuBLA9rEANlAM44EgBOJAnsRhALYwAOzUAZjlQRJbFrADmMAEY5kGKBgAW0ZuVgQMxAHRA%26skipOnboarding%3Dtrue	HTTP Parser: Iframe src: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html#url=https%3A%2F%2Freplit.com%2Fsignup%3Fgoto%3DagentVerify%3Fprompt%253DLIQw1gpgBCB2UQCYFcDGIAuBLA9rEANlAM44EgBOJAnsRhALYwAOzUAZjlQRJbFrADmMAEY5kGKBgAW0ZuVgQMxAHRA%2526skipOnboarding%253Dtrue&title=Sign%20Up%20-%20Replit&referrer=https%3A%2F%2Freplit.com%2F&muid=NA&sid=NA&version=6&preview=false&__shared_params__[version]=v3

Source: https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/	HTTP Parser: No favicon
Source: https://replit.com/	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.23.99
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	String found in binary or memory: return f}CG.K="internal.enableAutoEventOnTimer";var cc=wa(["data-gtm-yt-inspected-"]),EG=["www.youtube.com","www.youtube-nocookie.com"],FG,GG=!1; equals www.youtube.com (Youtube)
Source: chromecache_332.3.dr	String found in binary or memory: var RF=function(a,b,c,d,e){var f=NC("fsl",c?"nv.mwt":"mwt",0),g;g=c?NC("fsl","nv.ids",[]):NC("fsl","ids",[]);if(!g.length)return!0;var k=SC(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!AB(k,CB(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev
Source: global traffic	DNS traffic detected: DNS query: replit.com
Source: global traffic	DNS traffic detected: DNS query: cdn.sanity.io
Source: global traffic	DNS traffic detected: DNS query: cdn.replit.com
Source: global traffic	DNS traffic detected: DNS query: sp.replit.com
Source: global traffic	DNS traffic detected: DNS query: snap.licdn.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: static.ads-twitter.com
Source: global traffic	DNS traffic detected: DNS query: scripts.attributionapp.com
Source: global traffic	DNS traffic detected: DNS query: analytics.tiktok.com
Source: global traffic	DNS traffic detected: DNS query: www.redditstatic.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: pixel-config.reddit.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: api.segment.io
Source: global traffic	DNS traffic detected: DNS query: track.attributionapp.com
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: analytics.twitter.com
Source: global traffic	DNS traffic detected: DNS query: alb.reddit.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: csp-reporting.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: polyfill-fastly.io
Source: global traffic	DNS traffic detected: DNS query: www.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: elements.stytch.com
Source: global traffic	DNS traffic detected: DNS query: o1151714.ingest.sentry.io
Source: global traffic	DNS traffic detected: DNS query: app.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: cdn.segment.com
Source: global traffic	DNS traffic detected: DNS query: js.zi-scripts.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: js.stripe.com
Source: global traffic	DNS traffic detected: DNS query: logs.browser-intake-us5-datadoghq.com
Source: global traffic	DNS traffic detected: DNS query: api.stripe.com
Source: global traffic	DNS traffic detected: DNS query: events.launchdarkly.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: r.stripe.com

Source: chromecache_305.3.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_325.3.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_309.3.dr	String found in binary or memory: https://api.stripe.com
Source: chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_293.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/ibmplexsans/v21/zYXGKVElMYYaJe8bpLHnCwDKr932-G7dytD-Dmu1swZSAXcomDVmadSD
Source: chromecache_305.3.dr	String found in binary or memory: https://google.com
Source: chromecache_305.3.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_301.3.dr	String found in binary or memory: https://hcaptcha.com/license
Source: chromecache_209.3.dr	String found in binary or memory: https://helpcenter.affirm.ca
Source: chromecache_309.3.dr	String found in binary or memory: https://js.stripe.com/v3/fingerprinted/js/controller-with-preconnect-f0314e0b43df971303f3ad103cca15b
Source: chromecache_309.3.dr	String found in binary or memory: https://js.stripe.com/v3/fingerprinted/js/shared-96615c6cfd2491da8a1fb845666d6263.js
Source: chromecache_305.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_332.3.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: chromecache_325.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_209.3.dr	String found in binary or memory: https://stripe.com/docs/testing.
Source: chromecache_325.3.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_334.3.dr	String found in binary or memory: https://www.fastly.com/documentation/guides/concepts/errors/#routing-errors
Source: chromecache_325.3.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_325.3.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_325.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_305.3.dr	String found in binary or memory: https://www.google.com
Source: chromecache_325.3.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_352.3.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/16798129826/?random
Source: chromecache_305.3.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_305.3.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_325.3.dr, chromecache_215.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_242.3.dr, chromecache_229.3.dr	String found in binary or memory: https://www.redditstatic.com/ads/49267bce/pixel.js

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2448,i,17708118831512831231,16263542347099790622,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2448,i,17708118831512831231,16263542347099790622,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://helpcenter.affirm.ca	0%	Avira URL Cloud	safe
https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/favicon.ico	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
js.zi-scripts.com	172.64.150.44	true	false	high
polyfill-fastly.io	151.101.129.91	true	false	high
beacons-handoff.gcp.gvt2.com	142.250.180.67	true	false	high
events.launchdarkly.com	52.20.64.16	true	false	high
elements.stytch.com	18.66.147.32	true	false	high
platform.twitter.map.fastly.net	146.75.120.157	true	false	high
beacons6.gvt2.com	172.217.18.3	true	false	high
cdn.replit.com	104.18.35.46	true	false	high
l-0005.l-msedge.net	13.107.42.14	true	false	high
o1151714.ingest.sentry.io	34.120.195.249	true	false	high
d296je7bbdd650.cloudfront.net	99.86.8.175	true	false	high
replit.com	172.64.152.210	true	false	high
t.co	172.66.0.227	true	false	high
script.hotjar.com	13.33.187.109	true	false	high
9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev	34.75.151.117	true	false	unknown
www.google.com	142.250.185.196	true	false	high
api.segment.io	44.240.52.117	true	false	high
c3.shared.global.fastly.net	151.101.194.217	true	false	high
static-cdn.hotjar.com	18.66.102.53	true	false	high
fluffy-alpaca-j1w7zdv61tmqz86b33z4c6tl.herokudns.com	3.33.241.96	true	false	high
s.twitter.com	172.66.0.227	true	false	high
e35058.api15.akamaiedge.net	95.101.182.74	true	false	high
d279x8308vq8mj.cloudfront.net	143.204.98.95	true	false	unknown
csp-reporting.cloudflare.com	104.18.20.157	true	false	high
beacons.gvt2.com	142.251.143.35	true	false	high
stripecdn.map.fastly.net	151.101.64.176	true	false	high
r.stripe.com	54.187.119.242	true	false	high
dualstack.reddit.map.fastly.net	151.101.193.140	true	false	high
www.linkedin.com.cdn.cloudflare.net	104.18.41.41	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
googleads.g.doubleclick.net	216.58.206.34	true	false	high
js.hcaptcha.com	104.19.230.21	true	false	high
sp.replit.com	35.224.251.249	true	false	high
logs.browser-intake-us5-datadoghq.com	34.149.66.134	true	false	high
dexeqbeb7giwr.cloudfront.net	18.245.46.115	true	false	high
cdn.i.sanity.io	34.149.250.58	true	false	high
td.doubleclick.net	142.250.186.66	true	false	high
a1916.dscg2.akamai.net	88.221.110.136	true	false	high
api.stripe.com	34.250.89.120	true	false	high
alb.reddit.com	unknown	unknown	false	high
static.ads-twitter.com	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
cdn.sanity.io	unknown	unknown	false	high
cdn.segment.com	unknown	unknown	false	high
static.hotjar.com	unknown	unknown	false	high
pixel-config.reddit.com	unknown	unknown	false	high
scripts.attributionapp.com	unknown	unknown	false	high
track.attributionapp.com	unknown	unknown	false	high
www.redditstatic.com	unknown	unknown	false	high
app.launchdarkly.com	unknown	unknown	false	high
www.linkedin.com	unknown	unknown	false	high
px.ads.linkedin.com	unknown	unknown	false	high
analytics.twitter.com	unknown	unknown	false	high
snap.licdn.com	unknown	unknown	false	high
analytics.tiktok.com	unknown	unknown	false	high
js.stripe.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
18.66.102.53	static-cdn.hotjar.com	United States	3	MIT-GATEWAYSUS	false
151.101.129.91	polyfill-fastly.io	United States	54113	FASTLYUS	false
151.101.193.140	dualstack.reddit.map.fastly.net	United States	54113	FASTLYUS	false
151.101.65.140	reddit.map.fastly.net	United States	54113	FASTLYUS	false
104.18.35.46	cdn.replit.com	United States	13335	CLOUDFLARENETUS	false
143.204.98.95	d279x8308vq8mj.cloudfront.net	United States	16509	AMAZON-02US	false
104.19.230.21	js.hcaptcha.com	United States	13335	CLOUDFLARENETUS	false
34.250.89.120	api.stripe.com	United States	16509	AMAZON-02US	false
34.149.250.58	cdn.i.sanity.io	United States	2686	ATGS-MMD-ASUS	false
18.66.147.32	elements.stytch.com	United States	3	MIT-GATEWAYSUS	false
104.18.20.157	csp-reporting.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
88.221.110.136	a1916.dscg2.akamai.net	European Union	20940	AKAMAI-ASN1EU	false
162.159.140.229	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
34.75.151.117	9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev	United States	15169	GOOGLEUS	false
13.107.42.14	l-0005.l-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
172.64.152.210	replit.com	United States	13335	CLOUDFLARENETUS	false
146.75.120.157	platform.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
99.86.8.175	d296je7bbdd650.cloudfront.net	United States	16509	AMAZON-02US	false
34.149.66.134	logs.browser-intake-us5-datadoghq.com	United States	2686	ATGS-MMD-ASUS	false
13.33.187.109	script.hotjar.com	United States	16509	AMAZON-02US	false
151.101.64.176	stripecdn.map.fastly.net	United States	54113	FASTLYUS	false
216.58.206.34	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
44.240.52.117	api.segment.io	United States	16509	AMAZON-02US	false
151.101.194.217	c3.shared.global.fastly.net	United States	54113	FASTLYUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
35.224.251.249	sp.replit.com	United States	15169	GOOGLEUS	false
104.18.41.41	www.linkedin.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
18.245.46.115	dexeqbeb7giwr.cloudfront.net	United States	16509	AMAZON-02US	false
52.20.64.16	events.launchdarkly.com	United States	14618	AMAZON-AESUS	false
3.33.241.96	fluffy-alpaca-j1w7zdv61tmqz86b33z4c6tl.herokudns.com	United States	8987	AMAZONEXPANSIONGB	false
151.101.1.140	unknown	United States	54113	FASTLYUS	false
172.64.150.44	js.zi-scripts.com	United States	13335	CLOUDFLARENETUS	false
151.101.129.140	unknown	United States	54113	FASTLYUS	false
172.66.0.227	t.co	United States	13335	CLOUDFLARENETUS	false
34.120.195.249	o1151714.ingest.sentry.io	United States	15169	GOOGLEUS	false
142.250.186.66	td.doubleclick.net	United States	15169	GOOGLEUS	false
35.163.144.222	unknown	United States	16509	AMAZON-02US	false
95.101.182.74	e35058.api15.akamaiedge.net	European Union	20940	AKAMAI-ASN1EU	false

IP
192.168.2.4
192.168.2.6

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636963
Start date and time:	2025-03-13 09:45:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@29/290@120/42
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1600 x 1200, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	191248
Entropy (8bit):	7.916966346904307
Encrypted:	false
SSDEEP:	3072:k/1LicC1IhBVDTpDeFgKg0Tn5gqB+W6AC5l64hKg65NVLMxyIfGzioPSRaRv/IGr:kwxIvV1wNOqB56LEFPL+giuv9/INg
MD5:	4508BAEDC13FFA1F05398660DCB8DCF2
SHA1:	E956627AB0102F6A5A89A73A54FD3F164B584743
SHA-256:	FDE89693756FB018D34358938206879A84C08B080E989703849ED898AAF4C315
SHA-512:	FC9B3C906743635E8D86C7469975A5A0666290F6736C856D091C5D4FC3B47CEBD6EA02B50149281D1BE759EE10106F75BED8D4AA77A743F65AB9D942F239F4FE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@.........,c......pHYs............... .IDATx...W...7..Oy.... .D..W..].{.^.......#....Kh!....^'.....3....Bh....9{V.3.L&1..u_..1.0...........L.................`...X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X...........sd.`............A............0G.................X.....`.a....!........'..

Name	Malicious	Antivirus Detection	Reputation
https://cdn.sanity.io/images/bj34pdbp/migration/4aa92fcf5a2e1f568290451b88c873b885d8372f-1760x1350.png?w=1200&q=80&fit=clip&auto=format	false		high
https://sp.replit.com/next-integrations/integrations/vendor/commons.a61d7bea37d2de5d4b69.js.gz	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/9ab6a2465699e73b6d408072f46cc0c9cfd68aa1-1601x1201.png?w=1601&q=90&auto=format	false		high
https://o1151714.ingest.sentry.io/api/6318792/envelope/?sentry_key=8aa91189a4274b5a8c9b7b01d46ea360&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.112.0	false		high
https://www.redditstatic.com/ads/pixel.js	false		high
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6858996&time=1741855644264&li_adsId=cb6c59a8-99b2-47cc-a939-f6884d7e1d3d&url=https%3A%2F%2Freplit.com%2F&cookiesTest=true&liSync=true	false		high
https://js.stripe.com/v3/fingerprinted/js/controller-with-preconnect-f0314e0b43df971303f3ad103cca15ba.js	false		high
https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/a2_g67wzvbo1o9y_telemetry	false		high
https://sp.replit.com/next-integrations/integrations/twitter-ads/2.5.2/twitter-ads.dynamic.js.gz	false		high
https://api.segment.io/v1/p	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/7cb277f6ca67b05aa73508e31c367c464d99a707-1601x1200.png?w=1601&q=90&auto=format	false		high
https://api.segment.io/v1/t	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/242638fc2e0a4a9f7ff06b632f3968a6cfbf97ae-800x600.png?w=800&q=90&fit=clip&auto=format	false		high
https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/	true		unknown
https://cdn.sanity.io/images/bj34pdbp/migration/2e1aa4aed5d3e36c9249e623759812d10c53f02c-1760x1350.png?w=1200&q=80&fit=clip&auto=format	false		high
https://px.ads.linkedin.com/attribution_trigger?pid=6858996&time=1741855644264&url=https%3A%2F%2Freplit.com%2F	false		high
https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://alb.reddit.com/rp.gif?ts=1741855645249&id=a2_g67wzvbo1o9y&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=40afc968-f378-475c-9683-af29cee415b7&aaid=&em=&pn=&external_id=&idfa=&integration=reddit&partner=&opt_out=0&sh=1280&sw=1024&v=rdt_b9dc81c1&dpm=&dpcc=&dprc=	false		high
https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html	false		high
https://sp.replit.com/sdk.js/v1/dMePKGC4BqfBivpe0Hvl8IoPpzSHgjdX/sdk.min.js	false		high
https://sp.replit.com/v1/projects/dMePKGC4BqfBivpe0Hvl8IoPpzSHgjdX/settings	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/3846937448210f98bd123b0f82f004c2c3e6d241-1440x1040.png?w=1440&q=90&fit=clip&auto=format	false		high
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6858996&time=1741855644264&li_adsId=cb6c59a8-99b2-47cc-a939-f6884d7e1d3d&url=https%3A%2F%2Freplit.com%2F&cookiesTest=true	false		high
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=6858996&time=1741855644264&li_adsId=cb6c59a8-99b2-47cc-a939-f6884d7e1d3d&url=https%3A%2F%2Freplit.com%2F	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/6ccb843f45024c2fc9ee955c5b3ed49e0958666a-1760x1350.png?w=1200&q=80&fit=clip&auto=format	false		high
https://sp.replit.com/next-integrations/actions/845/449cd4534726259c2a8c.js	false		high
https://sp.replit.com/next-integrations/actions/tiktok-pixel/cd7d14bb4dc70ff30f2f.js	false		high
https://replit.com/	false		high
https://static.ads-twitter.com/uwt.js	false		high
https://polyfill-fastly.io/v3/polyfill.min.js?version=3.111.0&flags=gated&features=default,es2015,es2016,es2017,es2018,es2019,es2020,es2021,es2022,ResizeObserver,smoothscroll,TextEncoder	false		high
https://logs.browser-intake-us5-datadoghq.com/api/v2/logs?ddsource=browser&ddtags=sdk_version%3A4.46.0%2Capi%3Abeacon%2Cenv%3Aproduction%2Cservice%3Awebsite%2Cversion%3Ac68d6739&dd-api-key=pub31a5047a3a4692afb84a423db984dc57&dd-evp-origin-version=4.46.0&dd-evp-origin=browser&dd-request-id=e99fbf77-ad89-482c-b69d-4fe555cf79ff	false		high
https://sp.replit.com/next-integrations/integrations/google-analytics/2.18.5/google-analytics.dynamic.js.gz	false		high
https://pixel-config.reddit.com/pixels/a2_g67wzvbo1o9y/config	false		high
https://snap.licdn.com/li.lms-analytics/insight.min.js	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/26280dc59e937e0e8bd76b65dee1e818ad9aae2b-1760x1350.png?w=1200&q=80&fit=clip&auto=format	false		high
https://replit.com/signup?goto=agentVerify?prompt%3DLIQw1gpgBCB2UQCYFcDGIAuBLA9rEANlAM44EgBOJAnsRhALYwAOzUAZjlQRJbFrADmMAEY5kGKBgAW0ZuVgQMxAHRA%26skipOnboarding%3Dtrue	false		high
https://js.stripe.com/v3/.deploy_status_henson.json	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/951c3e3b9f04c0086d81580652699895fc118864-1600x1200.png?w=1600&q=90&auto=format	false		high
https://sp.replit.com/next-integrations/integrations/google-adwords-new/1.3.0/google-adwords-new.dynamic.js.gz	false		high
https://cdn.sanity.io/images/bj34pdbp/migration/5ddc88f5c16081bd0c5f767e32d489f9113ac854-1600x1200.png?w=1600&q=90&auto=format	false		high
https://js.stripe.com/v3/fingerprinted/js/shared-96615c6cfd2491da8a1fb845666d6263.js	false		high
https://js.stripe.com/v3/controller-with-preconnect-af32ea7af19d288bc12d850bf58f1679.html	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.fastly.com/documentation/guides/concepts/errors/#routing-errors	chromecache_334.3.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_325.3.dr	false		high
https://www.redditstatic.com/ads/49267bce/pixel.js	chromecache_242.3.dr, chromecache_229.3.dr	false		high
https://www.google.com	chromecache_305.3.dr	false		high
https://api.stripe.com	chromecache_309.3.dr	false		high
https://stripe.com/docs/testing.	chromecache_209.3.dr	false		high
https://js.stripe.com/v3/fingerprinted/js/controller-with-preconnect-f0314e0b43df971303f3ad103cca15b	chromecache_309.3.dr	false		high
https://stats.g.doubleclick.net/j/collect	chromecache_325.3.dr	false		high
https://hcaptcha.com/license	chromecache_301.3.dr	false		high
https://www.google.com/pagead/1p-user-list/16798129826/?random	chromecache_352.3.dr	false		high
https://googleads.g.doubleclick.net	chromecache_305.3.dr	false		high
https://tagassistant.google.com/	chromecache_325.3.dr	false		high
https://cct.google/taggy/agent.js	chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	false		high
https://www.google.com/ads/ga-audiences	chromecache_325.3.dr	false		high
https://www.google.%/ads/ga-audiences	chromecache_325.3.dr	false		high
https://td.doubleclick.net	chromecache_332.3.dr, chromecache_322.3.dr, chromecache_305.3.dr	false		high
https://helpcenter.affirm.ca	chromecache_209.3.dr	false	Avira URL Cloud: safe	unknown
https://google.com	chromecache_305.3.dr	false		high
https://adservice.google.com/pagead/regclk?	chromecache_305.3.dr	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 218

Chrome Cache Entry: 221

Chrome Cache Entry: 223

Windows Analysis Report
https://9b861c16-89be-495d-af06-94ec1b71b5cd-00-3shcaiuf2cafc.worf.replit.dev/