Edit tour

Windows Analysis Report
https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14

Overview

General Information

Sample URL:	https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14
Analysis ID:	1638805
Infos:

Detection

Phisher

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected Phisher

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Suricata IDS alerts with low severity for network traffic

Suspicious form URL found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5356 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,9154750469346591474,5062974565342647225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2056 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_138	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

Suricata Signatures

ETPRO EXPLOIT_KIT FoxTDS Initial Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T19:35:31.174080+0100	2859622	1	Exploit Kit Activity Detected	138.199.167.132	443	192.168.2.4	49722	TCP

ETPRO EXPLOIT_KIT Possible Evil Redirect Leading to EK Dec 04 2016

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T19:36:16.656604+0100	2823606	1	Exploit Kit Activity Detected	45.223.19.68	443	192.168.2.4	49853	TCP

HTTP traffic detected: POST /2.16.0/GenerateToken?msn=1&pid=68b93993-cfd0-4857-bc6c-29fafc7dd853&_=638385365 HTTP/1.1Host: create.leadid.comConnection: keep-aliveContent-Length: 342sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0Accept: */*Origin: https://energybillprogram.orgSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://energybillprogram.org/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Address: gin_throttle_mw_7200000000_8.46.123.189X-Ratelimit-Limit: 500X-Ratelimit-Remaining: 498X-Ratelimit-Reset: 1741980931Date: Fri, 14 Mar 2025 18:35:31 GMTContent-Length: 0Connection: close

Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Form action: /api/lead/index.php
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Form action: /api/lead/index.php
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Form action: /api/lead/index.php
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Form action: /api/lead/index.php

Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-KG7333KQ
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://tsdtocl.com
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-KG7333KQ
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://tsdtocl.com
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.16.0&lck=C84D3FA8-2C62-85BC-06AF-E93EB112C80C&lac=B0EDB9A0-EF60-B8F2-F065-F2177C3A6E16
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-KG7333KQ
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://tsdtocl.com
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.16.0&lck=C84D3FA8-2C62-85BC-06AF-E93EB112C80C&lac=B0EDB9A0-EF60-B8F2-F065-F2177C3A6E16
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://www.googletagmanager.com/ns.html?id=GTM-KG7333KQ
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://tsdtocl.com
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: Iframe src: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.16.0&lck=C84D3FA8-2C62-85BC-06AF-E93EB112C80C&lac=B0EDB9A0-EF60-B8F2-F065-F2177C3A6E16

Source: https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14	HTTP Parser: No favicon
Source: https://toysforhottubs.com/t/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14	HTTP Parser: No favicon
Source: https://energybillprogram.org/homeownersb/?utm_source=email&key=367&clid=846904104	HTTP Parser: No favicon
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: No favicon
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: No favicon

Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: No <meta name="copyright".. found
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: No <meta name="copyright".. found
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: No <meta name="copyright".. found
Source: https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.199.167.132:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.199.167.132:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.241:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.194.241:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.140.52.47:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.226.236.56:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.184.8:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.184.8:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.184.8:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.184.8:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.251.35:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.13:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.44:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.252.13:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.105.241:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.193.44:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.129.44:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 70.42.32.127:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 70.42.32.127:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.0.6:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.105.241:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.105.241:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.0.6:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.105.241:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.44:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.226.224.32:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 141.226.228.48:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.202.112.255:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.202.184.8:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.226.236.56:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.98.109.24:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.23.37.119:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.44:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.157.208.73:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.41.229:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.222.38.67:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.66.147.11:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.223.204.43:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.16.107.162:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.23.195:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.223.204.43:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.223.204.43:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.223.204.43:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.223.19.68:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.5.112.130:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.223.19.68:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.157.208.73:443 -> 192.168.2.4:49856 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.watonixt.com to https://nwrkvh.com/?a=367&c=421120&p=r&s1=164444&s2=ce02e36009884570904519cfb9955039&s3=14
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: nwrkvh.com to https://chefpm.com/?a=367&c=421120&p=r&s1=164444&s2=ce02e36009884570904519cfb9955039&s3=14&ch-redir=1&ckmxid=cva7dttv00012l3quiu0&ckmguid=42233d98-bad9-4ecb-b7e7-9b377c23ad01
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: chefpm.com to https://energybillprogram.org/homeownersb/?utm_source=email&key=367&clid=846904104

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_107.1.dr	String found in binary or memory: <iframe src="https://www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fenergybillprogram&width=138&layout=button&action=like&size=large&share=true&height=65&appId" width="150" height="30" style="border:none;overflow:hidden" scrolling="no" frameborder="0" allowfullscreen="true" allow="autoplay; clipboard-write; encrypted-media; picture-in-picture; web-share"></iframe> equals www.facebook.com (Facebook)
Source: chromecache_162.1.dr, chromecache_126.1.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/A4tfXiHOGrs/ equals www.facebook.com (Facebook)
Source: chromecache_162.1.dr, chromecache_126.1.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/ equals www.facebook.com (Facebook)
Source: chromecache_162.1.dr, chromecache_126.1.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/V9vdYColc4k/ equals www.facebook.com (Facebook)
Source: chromecache_162.1.dr, chromecache_126.1.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/WRsJ32R7YJG/ equals www.facebook.com (Facebook)
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},Qk:function(){e=sb()},Nd:function(){d()}}};var bc=wa(["data-gtm-yt-inspected-"]),DG=["www.youtube.com","www.youtube-nocookie.com"],EG,FG=!1; equals www.youtube.com (Youtube)
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=oD(a,c,e);Q(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return Q(122),!0;if(d&&f){for(var m=Cb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},rD=function(){var a=[],b=function(c){return gb(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: if(!(f\|\|g\|\|k\|\|m.length\|\|n.length))return;var q={Uh:f,Sh:g,Th:k,Ai:m,Bi:n,pf:p,Rb:e},r=z.YT;if(r)return r.ready&&r.ready(d),e;var u=z.onYouTubeIframeAPIReady;z.onYouTubeIframeAPIReady=function(){u&&u();d()};E(function(){for(var v=A.getElementsByTagName("script"),t=v.length,w=0;w<t;w++){var x=v[w].getAttribute("src");if(OG(x,"iframe_api")\|\|OG(x,"player_api"))return e}for(var y=A.getElementsByTagName("iframe"),B=y.length,C=0;C<B;C++)if(!FG&&MG(y[C],q.pf))return sc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_171.1.dr	String found in binary or memory: return f}BG.K="internal.enableAutoEventOnTimer";var bc=wa(["data-gtm-yt-inspected-"]),DG=["www.youtube.com","www.youtube-nocookie.com"],EG,FG=!1; equals www.youtube.com (Youtube)
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: var QF=function(a,b,c,d,e){var f=MC("fsl",c?"nv.mwt":"mwt",0),g;g=c?MC("fsl","nv.ids",[]):MC("fsl","ids",[]);if(!g.length)return!0;var k=RC(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);Q(121);if(m==="https://www.facebook.com/tr/")return Q(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!zB(k,BB(b, equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: toysforhottubs.com
Source: global traffic	DNS traffic detected: DNS query: www.watonixt.com
Source: global traffic	DNS traffic detected: DNS query: nwrkvh.com
Source: global traffic	DNS traffic detected: DNS query: chefpm.com
Source: global traffic	DNS traffic detected: DNS query: energybillprogram.org
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: cdn.taboola.com
Source: global traffic	DNS traffic detected: DNS query: amplify.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: psb.taboola.com
Source: global traffic	DNS traffic detected: DNS query: trc.taboola.com
Source: global traffic	DNS traffic detected: DNS query: tr.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: wave.outbrain.com
Source: global traffic	DNS traffic detected: DNS query: pips.taboola.com
Source: global traffic	DNS traffic detected: DNS query: cds.taboola.com
Source: global traffic	DNS traffic detected: DNS query: trc-events.taboola.com
Source: global traffic	DNS traffic detected: DNS query: i.liadm.com
Source: global traffic	DNS traffic detected: DNS query: api.trustedform.com
Source: global traffic	DNS traffic detected: DNS query: create.lidstatic.com
Source: global traffic	DNS traffic detected: DNS query: tsdtocl.com
Source: global traffic	DNS traffic detected: DNS query: cdn.trustedform.com
Source: global traffic	DNS traffic detected: DNS query: i6.liadm.com
Source: global traffic	DNS traffic detected: DNS query: create.leadid.com
Source: global traffic	DNS traffic detected: DNS query: d2m2wsoho8qq12.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: deviceid.trueleadid.com

Source: chromecache_91.1.dr	String found in binary or memory: http://api.trustedform.com/ns.gif
Source: chromecache_102.1.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk?
Source: chromecache_91.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Source: chromecache_171.1.dr	String found in binary or memory: https://amplify.outbrain.com/cp/obtp.js
Source: chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_171.1.dr	String found in binary or memory: https://cdn.taboola.com/libtrc/unip/
Source: chromecache_174.1.dr, chromecache_96.1.dr	String found in binary or memory: https://cdn.taboola.com/scripts/cds-pips.js
Source: chromecache_174.1.dr, chromecache_96.1.dr	String found in binary or memory: https://cdn.taboola.com/scripts/eid.es5.js
Source: chromecache_96.1.dr	String found in binary or memory: https://cdn.taboola.com/scripts/ifs.js
Source: chromecache_132.1.dr	String found in binary or memory: https://deviceid.trueleadid.com/iframe.html
Source: chromecache_147.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins:wght
Source: chromecache_170.1.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Roboto:wght
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1JlFc-K.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1JlFc-K.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLGT9Z1JlFc-K.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2)
Source: chromecache_168.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJnecmNE.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_104.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_96.1.dr	String found in binary or memory: https://i.liadm.com/s/66627?bidder_id=88068&bidder_uuid=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecd
Source: chromecache_102.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_136.1.dr, chromecache_98.1.dr	String found in binary or memory: https://swiperjs.com
Source: chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_102.1.dr	String found in binary or memory: https://www.google.com
Source: chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_102.1.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://www.googletagmanager.com/a?
Source: chromecache_107.1.dr, chromecache_91.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-W66KBS3X4F
Source: chromecache_107.1.dr, chromecache_91.1.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_107.1.dr, chromecache_91.1.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-KG7333KQ
Source: chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://www.googletagmanager.com/static/service_worker/
Source: chromecache_162.1.dr, chromecache_126.1.dr	String found in binary or memory: https://www.internalfb.com/intern/invariant/
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_138.1.dr	String found in binary or memory: https://www.watonixt.com/BHLNN6Q1/JBKT7Z3/?sub1=14&sub2=279-16160&sub3=610-3572627-3008
Source: chromecache_111.1.dr, chromecache_102.1.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://energybillprogram.org/quote/images/favicon.ico	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/js/f7-2.js?v=1705308362	0%	Avira URL Cloud	safe
https://nwrkvh.com/?a=367&c=421120&p=r&s1=164444&s2=ce02e36009884570904519cfb9955039&s3=14&ch-redir=1&ckmxid=cva7dttv00012l3quiu0	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/cross.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/money4.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/css/swiper-bundle.min.css	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/js/libphonenumber-min.js	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/tick.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/homeownersb/images/banner-img.jpg	0%	Avira URL Cloud	safe
https://energybillprogram.org/homeownersb/css/style.css	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/solar.png	0%	Avira URL Cloud	safe
https://www.watonixt.com/BHLNN6Q1/JBKT7Z3/?sub1=14&sub2=279-16160&sub3=610-3572627-3008	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/logo-symbol.png	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/money1.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/homeownersb/css/new_style.css	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/money3.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/little-shade.svg	0%	Avira URL Cloud	safe
https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.16.0&lck=C84D3FA8-2C62-85BC-06AF-E93EB112C80C&lac=B0EDB9A0-EF60-B8F2-F065-F2177C3A6E16	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/no-shade.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/uncertain.svg	0%	Avira URL Cloud	safe
https://nwrkvh.com/?a=367&c=421120&p=r&s1=164444&s2=ce02e36009884570904519cfb9955039&s3=14	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/js/swiper-bundle.min.js	0%	Avira URL Cloud	safe
https://toysforhottubs.com/favicon.ico	0%	Avira URL Cloud	safe
https://energybillprogram.org/homeownersb/images/writer.png	0%	Avira URL Cloud	safe
https://chefpm.com/?a=367&c=421120&p=r&s1=164444&s2=ce02e36009884570904519cfb9955039&s3=14&ch-redir=1&ckmxid=cva7dttv00012l3quiu0&ckmguid=42233d98-bad9-4ecb-b7e7-9b377c23ad01	0%	Avira URL Cloud	safe
https://energybillprogram.org/homeownersb/images/logo-symbol.png	0%	Avira URL Cloud	safe
https://energybillprogram.org/homeownersb/images/favicon.ico	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/css/style.css?v=1669197476	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/lot-of-shade.svg	0%	Avira URL Cloud	safe
https://energybillprogram.org/quote/images/money2.svg	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
star-mini.c10r.facebook.com	157.240.251.35	true	false	high
tls13.taboola.map.fastly.net	151.101.65.44	true	false	high
nydc1.outbrain.org	70.42.32.127	true	false	high
toysforhottubs.com	138.199.167.132	true	true	unknown
www.watonixt.com	172.67.194.241	true	false	unknown
us-cds.taboola.com	141.226.224.32	true	false	high
nwrkvh.com	104.140.52.47	true	false	unknown
chefpm.com	23.226.236.56	true	false	unknown
d2m2wsoho8qq12.cloudfront.net	13.32.23.195	true	false	high
create.lidstatic.com	172.67.41.229	true	false	high
scontent.xx.fbcdn.net	157.240.252.13	true	false	high
tsdtocl.com	151.101.65.44	true	false	high
create.leadid.com	3.223.204.43	true	false	high
dualstack.tls13.taboola.map.fastly.net	151.101.129.44	true	false	high
e10883.g.akamaiedge.net	2.19.105.241	true	false	high
idaas-ext.cph.liveintent.com	23.23.37.119	true	false	high
www.google.com	142.250.184.228	true	false	high
api.trustedform.com	54.157.208.73	true	false	high
dw4luqp.ng.impervadns.net	45.223.19.68	true	false	high
idaas6.cph.liveintent.com	44.222.38.67	true	false	high
energybillprogram.org	35.202.184.8	true	false	unknown
cdn.trustedform.com	18.66.147.11	true	false	high
am-vip001.taboola.com	141.226.228.48	true	false	high
amplify.outbrain.com	unknown	unknown	false	high
psb.taboola.com	unknown	unknown	false	high
wave.outbrain.com	unknown	unknown	false	high
trc-events.taboola.com	unknown	unknown	false	high
cds.taboola.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
i6.liadm.com	unknown	unknown	false	high
trc.taboola.com	unknown	unknown	false	high
i.liadm.com	unknown	unknown	false	high
static.xx.fbcdn.net	unknown	unknown	false	high
cdn.taboola.com	unknown	unknown	false	high
deviceid.trueleadid.com	unknown	unknown	false	high
tr.outbrain.com	unknown	unknown	false	high
pips.taboola.com	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://api.trustedform.com/certs/f9c7a157ec9f7b267575eb0b1f7d94e8fb7cbd72/fingerprints	false		high
https://www.facebook.com/plugins/like.php?href=https%3A%2F%2Fwww.facebook.com%2Fenergybillprogram&width=138&layout=button&action=like&size=large&share=true&height=65&appId	false		high
https://energybillprogram.org/quote/js/libphonenumber-min.js	false	Avira URL Cloud: safe	unknown
https://energybillprogram.org/quote/images/money4.svg	false	Avira URL Cloud: safe	unknown
https://tr.outbrain.com/cachedClickId?marketerId=00ed52d6aa981d4804649821eafc2a9c54	false		high
https://energybillprogram.org/quote/images/favicon.ico	false	Avira URL Cloud: safe	unknown
https://cdn.trustedform.com/trustedform-1.10.9.js	false		high
https://trc-events.taboola.com/1538786/log/3/unip?en=pre_d_eng_tb&tos=56850&scd=0&ssd=2&est=1741977341708&ver=36&isls=true&src=i&invt=10000&msa=0&rv=1&tim=1741977399818&vi=1741977369647&ri=efce7715e058a88461a379c8c7e97294&sd=v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977371_CITngy4Q4vVdGK_4xK_ZMiACKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA&ui=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&ref=https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104&cv=20250310-44-RELEASE&item-url=https%3A%2F%2Fenergybillprogram.org%2Fquote%2F%3Fho%3D1%26utm_source%3Demail%26key%3D367%26clid%3D846904104&ler=other&it=JS_PIXEL	false		high
https://create.leadid.com/2.16.0/Snap?msn=6&pid=68b93993-cfd0-4857-bc6c-29fafc7dd853&token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&_=638385370	false		high
https://nwrkvh.com/?a=367&c=421120&p=r&s1=164444&s2=ce02e36009884570904519cfb9955039&s3=14&ch-redir=1&ckmxid=cva7dttv00012l3quiu0	false	Avira URL Cloud: safe	unknown
https://energybillprogram.org/homeownersb/css/style.css	false	Avira URL Cloud: safe	unknown
https://i.liadm.com/s/66627?bidder_id=88068&bidder_uuid=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&_li_chk=true&previous_uuid=eacd5e63b4d34f77b01175f81d3a3f14	false		high
https://deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=548891121	false		high
https://energybillprogram.org/homeownersb/images/banner-img.jpg	false	Avira URL Cloud: safe	unknown
https://create.leadid.com/2.16.0/InitFormData?msn=3&pid=68b93993-cfd0-4857-bc6c-29fafc7dd853&token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&_=638385367	false		high
https://energybillprogram.org/quote/js/f7-2.js?v=1705308362	false	Avira URL Cloud: safe	unknown
https://trc-events.taboola.com/1538786/log/3/unip?en=pre_d_eng_tb&tos=46834&scd=0&ssd=2&est=1741977341708&ver=36&isls=true&src=i&invt=10000&msa=0&rv=1&tim=1741977389802&vi=1741977369647&ri=efce7715e058a88461a379c8c7e97294&sd=v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977371_CITngy4Q4vVdGK_4xK_ZMiACKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA&ui=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&ref=https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104&cv=20250310-44-RELEASE&item-url=https%3A%2F%2Fenergybillprogram.org%2Fquote%2F%3Fho%3D1%26utm_source%3Demail%26key%3D367%26clid%3D846904104&ler=other&it=JS_PIXEL	false		high
https://wave.outbrain.com/mtWavesBundler/handler/00ed52d6aa981d4804649821eafc2a9c54	false		high
https://toysforhottubs.com/t/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14	false		unknown
https://energybillprogram.org/quote/css/swiper-bundle.min.css	false	Avira URL Cloud: safe	unknown
https://api.trustedform.com/certs/f9c7a157ec9f7b267575eb0b1f7d94e8fb7cbd72/snapshot	false		high
https://energybillprogram.org/quote/images/cross.svg	false	Avira URL Cloud: safe	unknown
https://trc-events.taboola.com/1538786/log/3/unip?en=pre_d_eng_tb&tos=10092&scd=0&ssd=1&est=1741977341708&ver=36&isls=true&src=i&invt=5500&msa=1622&rv=1&tim=1741977351801&vi=1741977341702&ri=7e22415f77508f0f6715a3c286b0a51c&sd=v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977343_CITngy4Q4vVdGIaew6_ZMiABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA&ui=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&ref=https%3A%2F%2Ftoysforhottubs.com%2F&cv=20250310-44-RELEASE&item-url=https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104&ler=other&it=JS_PIXEL	false		high
https://create.leadid.com/2.16.0/Snap?msn=9&pid=68b93993-cfd0-4857-bc6c-29fafc7dd853&token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&_=638385373	false		high
https://i6.liadm.com/s/66627?bidder_id=88068&bidder_uuid=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f	false		high
https://api.trustedform.com/certs/f9c7a157ec9f7b267575eb0b1f7d94e8fb7cbd72/events	false		high
https://trc-events.taboola.com/1538786/log/3/unip?en=pre_d_eng_tb&tos=36818&scd=0&ssd=2&est=1741977341708&ver=36&isls=true&src=i&invt=10000&msa=0&rv=1&tim=1741977379786&vi=1741977369647&ri=efce7715e058a88461a379c8c7e97294&sd=v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977371_CITngy4Q4vVdGK_4xK_ZMiACKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA&ui=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&ref=https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104&cv=20250310-44-RELEASE&item-url=https%3A%2F%2Fenergybillprogram.org%2Fquote%2F%3Fho%3D1%26utm_source%3Demail%26key%3D367%26clid%3D846904104&ler=other&it=JS_PIXEL	false		high
https://energybillprogram.org/quote/?ho=1&utm_source=email&key=367&clid=846904104	false		unknown
https://trc-events.taboola.com/1538786/log/3/unip?en=pre_d_eng_tb&tos=4575&scd=0&ssd=1&est=1741977341708&ver=36&isls=true&src=i&invt=4500&msa=1622&rv=1&tim=1741977346283&vi=1741977341702&ri=7e22415f77508f0f6715a3c286b0a51c&sd=v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977343_CITngy4Q4vVdGIaew6_ZMiABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA&ui=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&ref=https%3A%2F%2Ftoysforhottubs.com%2F&cv=20250310-44-RELEASE&item-url=https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104&ler=other&it=JS_PIXEL	false		high
https://create.leadid.com/2.16.0/Snap?msn=4&pid=68b93993-cfd0-4857-bc6c-29fafc7dd853&token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&_=638385368	false		high
https://energybillprogram.org/quote/images/tick.svg	false	Avira URL Cloud: safe	unknown
https://www.watonixt.com/BHLNN6Q1/JBKT7Z3/?sub1=14&sub2=279-16160&sub3=610-3572627-3008	false	Avira URL Cloud: safe	unknown
https://energybillprogram.org/quote/images/solar.png	false	Avira URL Cloud: safe	unknown
https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.16.0&lck=C84D3FA8-2C62-85BC-06AF-E93EB112C80C&lac=B0EDB9A0-EF60-B8F2-F065-F2177C3A6E16	false	Avira URL Cloud: safe	unknown
https://create.leadid.com/2.16.0/GenerateToken?msn=1&pid=68b93993-cfd0-4857-bc6c-29fafc7dd853&_=638385365	false		high
https://trc-events.taboola.com/1538786/log/3/unip?en=pre_d_eng_tb&tos=20097&scd=0&ssd=1&est=1741977341708&ver=36&isls=true&src=i&invt=10000&msa=1622&rv=1&tim=1741977361806&vi=1741977341702&ri=7e22415f77508f0f6715a3c286b0a51c&sd=v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977343_CITngy4Q4vVdGIaew6_ZMiABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA&ui=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f&ref=https%3A%2F%2Ftoysforhottubs.com%2F&cv=20250310-44-RELEASE&item-url=https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104&ler=other&it=JS_PIXEL	false		high
https://trc.taboola.com/1538786/trc/3/json?tim=1741977369657&data=%7B%22id%22%3A316%2C%22ii%22%3A%22%2Fquote%22%2C%22it%22%3A%22video%22%2C%22sd%22%3A%22v2_4bf2e2bebcd8436e10e4b828b7fe53c3_bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f_1741977343_1741977343_CITngy4Q4vVdGIaew6_ZMiABKAEw4QE4kaQOQNWmD0jZiNcDUPUDWABgAGjyjeG-qeeu5iZwAYABAA%22%2C%22ui%22%3A%22bf044cf2-a8da-4c09-9890-4172d500e352-tuctecdfc7f%22%2C%22vi%22%3A1741977369647%2C%22cv%22%3A%2220250310-44-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fenergybillprogram.org%2Fquote%2F%3Fho%3D1%26utm_source%3Demail%26key%3D367%26clid%3D846904104%22%2C%22e%22%3A%22https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104%22%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fho%3D1%26utm_source%3Demail%26key%3D367%26clid%3D846904104%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnxtlvlllc-solar6-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1741977369656%2C%22ref%22%3A%22https%3A%2F%2Fenergybillprogram.org%2Fhomeownersb%2F%3Futm_source%3Demail%26key%3D367%26clid%3D846904104%22%2C%22item-url%22%3A%22https%3A%2F%2Fenergybillprogram.org%2Fquote%2F%3Fho%3D1%26utm_source%3Demail%26key%3D367%26clid%3D846904104%22%2C%22tos%22%3A26688%2C%22ssd%22%3A2%2C%22scd%22%3A0%2C%22ler%22%3A%22other%22%2C%22it%22%3A%22JS_PIXEL%22%2C%22supv%22%3Atrue%7D%2C%22pa%22%3A%7B%22su%22%3Atrue%7D%2C%22psb%22%3Atrue%7D&pubit=i	false		high
https://cdn.taboola.com/scripts/cds-pips.js	false		high
https://cdn.taboola.com/libtrc/unip/1538786/tfa.js	false		high
https://create.leadid.com/2.16.0/SaveDeviceId.js?lac=B0EDB9A0-EF60-B8F2-F065-F2177C3A6E16&lck=C84D3FA8-2C62-85BC-06AF-E93EB112C80C&methods=48&token=4536F62D-EBF8-6CAC-4845-59EE168DEDB4&uuid=56b6e004a2704e71a066fd5e21aeaf80	false		high

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,9154750469346591474,5062974565342647225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2056 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,9154750469346591474,5062974565342647225,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2056 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Name	Source	Malicious	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_111.1.dr, chromecache_102.1.dr	false	high
https://swiperjs.com	chromecache_136.1.dr, chromecache_98.1.dr	false	high
https://www.google.com	chromecache_102.1.dr	false	high
https://www.internalfb.com/intern/invariant/	chromecache_162.1.dr, chromecache_126.1.dr	false	high
https://www.youtube.com/iframe_api	chromecache_111.1.dr, chromecache_102.1.dr	false	high
https://i.liadm.com/s/66627?bidder_id=88068&bidder_uuid=bf044cf2-a8da-4c09-9890-4172d500e352-tuctecd	chromecache_96.1.dr	false	high
https://deviceid.trueleadid.com/iframe.html	chromecache_132.1.dr	false	high
https://cdn.taboola.com/libtrc/unip/	chromecache_171.1.dr	false	high
https://cct.google/taggy/agent.js	chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	false	high
https://stats.g.doubleclick.net/g/collect?v=2&	chromecache_111.1.dr, chromecache_102.1.dr	false	high
http://api.trustedform.com/ns.gif	chromecache_91.1.dr	false	high
https://td.doubleclick.net	chromecache_171.1.dr, chromecache_111.1.dr, chromecache_102.1.dr	false	high
https://www.merchant-center-analytics.goog	chromecache_111.1.dr, chromecache_102.1.dr	false	high
https://adservice.google.com/pagead/regclk?	chromecache_102.1.dr	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
45.223.19.68	dw4luqp.ng.impervadns.net	United States	19551	INCAPSULAUS	false
20.98.109.24	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.240.0.6	unknown	United States	32934	FACEBOOKUS	false
172.67.194.241	www.watonixt.com	United States	13335	CLOUDFLARENETUS	false
64.202.112.255	unknown	United States	22075	AS-OUTBRAINUS	false
3.223.204.43	create.leadid.com	United States	14618	AMAZON-AESUS	false
141.226.228.48	am-vip001.taboola.com	Israel	200478	TABOOLA-ASIL	false
70.42.32.127	nydc1.outbrain.org	United States	22075	AS-OUTBRAINUS	false
18.66.147.11	cdn.trustedform.com	United States	3	MIT-GATEWAYSUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
157.240.252.13	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
23.23.37.119	idaas-ext.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
151.101.193.44	unknown	United States	54113	FASTLYUS	false
52.5.112.130	unknown	United States	14618	AMAZON-AESUS	false
2.19.105.241	e10883.g.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
54.157.208.73	api.trustedform.com	United States	14618	AMAZON-AESUS	false
151.101.1.44	unknown	United States	54113	FASTLYUS	false
151.101.129.44	dualstack.tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
50.16.107.162	unknown	United States	14618	AMAZON-AESUS	false
44.222.38.67	idaas6.cph.liveintent.com	United States	14618	AMAZON-AESUS	false
138.199.167.132	toysforhottubs.com	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	true
151.101.65.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
104.140.52.47	nwrkvh.com	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	false
13.32.23.195	d2m2wsoho8qq12.cloudfront.net	United States	7018	ATT-INTERNET4US	false
35.202.184.8	energybillprogram.org	United States	15169	GOOGLEUS	false
141.226.224.32	us-cds.taboola.com	Israel	200478	TABOOLA-ASIL	false
157.240.251.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
172.67.41.229	create.lidstatic.com	United States	13335	CLOUDFLARENETUS	false
23.226.236.56	chefpm.com	United States	3842	RAMNODEUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638805
Start date and time:	2025-03-14 19:34:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@28/147@76/30

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	8796
Entropy (8bit):	3.8800767900812607
Encrypted:	false
SSDEEP:	192:NUjGKNMYMbMC3hxU04gWooMkaVKkVvEVsZf37a/0nPDNRMMSd:NUvsz2gEaokVvEVsZ/7pLNWMSd
MD5:	94680FAEF78EB6C7BAE737D91254B8E3
SHA1:	A1E7EC5F5B5F0973C93CA3E6069E023545850A9D
SHA-256:	85CF3736510C1173B5608EFA680344255987A802BC5761F294072507C7B11160
SHA-512:	DD96DDFCDF0F405D5A0777B2EEF2B66BC81D3723DF82357B0414CD174737BE820122608734ABC70CD23B31B0422192DC96A4F056217745E56DA8EF2FF5DC27C0
Malicious:	false
Reputation:	low
URL:	https://energybillprogram.org/quote/images/money4.svg
Preview:	<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M39.8914 25.7466C39.8914 25.2164 40.3211 24.7865 40.8505 24.7865C41.3803 24.7865 41.81 25.2164 41.81 25.7466V27.3819C42.6253 27.3903 43.5253 27.4881 44.5126 27.6934C45.0295 27.7985 45.3633 28.3047 45.2582 28.8218C45.1532 29.339 44.6474 29.673 44.1305 29.5679C43.2669 29.3885 42.4951 29.3021 41.81 29.2918V35.5026C43.7313 35.805 45.0946 36.975 45.7573 38.4065C46.1356 39.225 46.2844 40.1311 46.1775 41.0123C46.0686 41.9043 45.6994 42.7707 45.0432 43.5015C44.3228 44.3043 43.2544 44.9332 41.81 45.2176V47.0141C41.81 47.5443 41.3803 47.9742 40.8505 47.9742C40.3215 47.9742 39.8914 47.5443 39.8914 47.0141V45.3818C39.0761 45.3742 38.1771 45.2756 37.1906 45.0703C36.6737 44.966 36.34 44.459 36.445 43.9419C36.5501 43.4247 37.0559 43.0907 37.5727 43.1958C38.4355 43.3752 39.2063 43.462 39.8913 43.4719V37.2626C37.9716 36.9594 36.6087 35.7883 35.9461 34.3575C35.5677 33.5398 35.4201 32.6349 35.5259 31.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Windows Analysis Report
https://toysforhottubs.com/4XFdob16160NKIj279hgkphiycps610KOHUGVLGONYFUDE3572627MVAO3008q14