Edit tour

Windows Analysis Report
https://donorbox.org/events/730855

Overview

General Information

Sample URL:	https://donorbox.org/events/730855
Analysis ID:	1600223

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1932,i,5451381531584552582,4917434273981352255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://donorbox.org/events/730855" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://donorbox.org/events/730855

HTTP Parser: Base64 decoded: 1737967073.000000

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.242.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	DNS traffic detected: DNS query: donorbox.org
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.242.162:443 -> 192.168.2.16:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49743 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/20@10/134

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1932,i,5451381531584552582,4917434273981352255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://donorbox.org/events/730855"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1932,i,5451381531584552582,4917434273981352255,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://donorbox.org/events/730855	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
static.cloudflareinsights.com	104.16.80.73	true	false	high
donorbox.org	104.22.51.249	true	false	unknown
www.google.com	216.58.206.68	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://donorbox.org/events/730855	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.195	unknown	United States	15169	GOOGLEUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.22.51.249	donorbox.org	United States	13335	CLOUDFLARENETUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
142.250.185.202	unknown	United States	15169	GOOGLEUS	false
104.16.80.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
104.22.50.249	unknown	United States	13335	CLOUDFLARENETUS	false
64.233.167.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1600223
Start date and time:	2025-01-27 09:37:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://donorbox.org/events/730855
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/20@10/134

Warnings

Exclude process from analysis (whitelisted): SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.185.110, 64.233.167.84, 142.250.185.142, 199.232.210.172, 216.58.206.46, 142.250.185.202, 142.250.186.42, 142.250.185.74, 216.58.212.170, 216.58.206.74, 172.217.18.106, 142.250.74.202, 142.250.186.74, 142.250.184.234, 172.217.23.106, 142.250.186.106, 142.250.185.170, 142.250.185.234, 142.250.186.138, 142.250.181.234, 142.250.185.138, 142.250.184.206
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, content-autofill.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://donorbox.org/events/730855

LLM Input / Output

Input	Output
URL: https://donorbox.org Model: Joe Sandbox AI	```json{ "brand": "unknown", "brand_classification": "unknown", "legit_url": "unknown", "similarity": 0, "spoofed": 0, "reasoning": "The URL 'https://donorbox.org' does not appear to be a typosquatting attempt. There are no obvious visual character substitutions or structural changes that suggest it is mimicking a well-known brand. The domain 'donorbox.org' seems to be a legitimate and standalone entity, likely related to donation or fundraising activities, as suggested by the name 'donorbox'. There is no indication of a subdomain or domain extension misuse that would imply an attempt to confuse users into thinking they are interacting with a different, more recognized brand."}
URL: https://donorbox.org
URL: https://donorbox.org/public.js... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript code appears to be a legitimate implementation of a header scroll event handler and a language selector functionality. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or obfuscated code. The code uses standard DOM manipulation techniques and event listeners, which are common practices in web development. While the code could be improved in terms of performance (e.g., using `requestAnimationFrame` instead of `setTimeout`), it does not exhibit any suspicious or malicious behavior." }
var scrollEventDebounce = null function headerScrollEvent () { clearTimeout(scrollEventDebounce); debounce = setTimeout(function() { var docBody = document.body; //IE 'quirks' var docElem = document.documentElement; //IE with doctype docElem = (docElem.clientHeight) ? docElem : docBody; if (docElem.scrollTop === 0) { app_header.classList.remove('header_active'); } else { app_header.classList.add('header_active'); } },10); } function createLanguageSelector () { var list = document.getElementById("footer_language_selector").querySelectorAll('ul li a'); var select = document.createElement('select'); var lang = document.querySelector('html').getAttribute('lang'); Array.from(list).forEach( function(item) { var option = document.createElement('option'); option.innerHTML = item.innerHTML; option.value = item.getAttribute('href'); if(option.value === '/' + lang) option.setAttribute('selected', 'selected'); select.appendChild(option); }); select.addEventListener('change', function(e) { window.location.href = select[select.selectedIndex].value; }) footer_language_selector.appendChild(select); footer_language_selector.querySelector('ul').remove(); } document.addEventListener("DOMContentLoaded", function() { window.addEventListener("scroll", headerScrollEvent, {passive: true}); if (document.getElementById("footer_language_selector")) createLanguageSelector(); });
URL: https://static.cloudflareinsights.com/beacon.min.j... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a utility function for generating a UUID (Universally Unique Identifier). It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or obfuscated code/URLs. The script uses standard JavaScript practices and interacts with trusted domains (e.g., `crypto.getRandomValues`). While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script seems to be a benign utility with no clear signs of malicious intent." }
!function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n\|\|0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]]].join("")}},944:function(e){"use strict";var t="undefined"!=typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto)\|\|"undefined"!=typeof msCrypto&&"function"==typeof window.msCrypto.getRandomValues&&msCrypto.getRandomValues.bind(msCrypto);if(t){var n=new Uint8Array(16);e.exports=function(){return t(n),n}}else{var r=new Array(16);e.exports=function(){for(var e,t=0;t<16;t++)0==(3&t)&&(e=4294967296*Math.random()),r[t]=e>>>((3&t)<<3)&255;return r}}},508:function(e,t,n){"use strict";var r=n(944),i=n(343);e.exports=function(e,t,n){var o=t&&n\|\|0;"string"==typeof e&&(t="binary"===e?new Array(16):null,e=null);var a=(e=e\|\|{}).random\|\|(e.rng\|\|r)();if(a[6]=15&a[6]\|64,a[8]=63&a[8]\|128,t)for(var c=0;c<16;++c)t[o+c]=a[c];return t\|\|i(a)}},168:function(e,t,n){"use strict";var r=this&&this.__assign\|\|function(){return r=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var i in t=arguments[n])Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e},r.apply(this,arguments)};t.__esModule=!0;var i=n(699),o=n(752),a=n(104),c=n(508);!function(){function e(e){var t="";if(t=window.location.origin?window.location.origin:"".concat(window.location.protocol,"://").concat(window.location.host),e&&"string"==typeof e)if(0===e.indexOf("/"))t+=e;else try{var n=new URL(e);return"".concat(n.protocol,"://").concat(n.host).concat(n.pathname)}catch(e){}else{var r=window.location.pathname;r&&r.length>0&&(t+=r)}return t}function t(e,t){for(var n in e){var r=e[n];void 0!==t&&("number"!=typeof r&&"string"!=typeof r\|\|(t[n]=r))}}!function(){var n,u,s=window.performance\|\|window.webkitPerformance\|\|window.msPerformance\|\|window.mozPerformance,f="data-cf-beacon",d=document.currentScript\|\|("function"==typeof document.querySelector?document.querySelector("script[".concat(f,"]")):void 0),l=c(),v=[],p=window.__cfBeacon?window.__cfBeacon:{};if(!p\|\|"single"!==p.load){if(d){var m=d.getAttribute(f);if(m)try{p=r(r({},p),JSON.parse(m))}catch(e){}else{var g=d.getAttribute("src");if(g&&"function"==typeof URLSearchParams){var y=new URLSearchParams(g.replace(/^[^\?]+\??/,"")),h=y.get("token");h&&(p.token=h);var T=y.get("spa");p.spa=null===T\|\|"true"===T}}p&&"multi"!==p.load&&(p.load="single"),window.__cfBeacon=p}if(s&&p&&p.token){var w,S,b=!1;document.addEventListener("visibilitychange",(function(){if("hidden"===document.visibilityState){if(L&&A()){var t=e();(null==w?void 0:w.url)==t&&(null==w?void 0:w.triggered)\|\|P(),_(t)}!b&&w&&(b=!0,B())}else"visible"===document.visibilityState&&(new Date).getTime()}));var E={};"function"==typeof PerformanceObserver&&((0,a.onLCP)(x),(0,a.onFID)(x),(0,a.onFCP)(x),(0,a.onINP)(x),(0,a.onTTFB)(x),PerformanceObserver.supportedEntryTypes&&PerformanceObserver.supportedEntryTypes.includes("layout-shift")&&(0,a.onCLS)(x));var L=p&&(void 0===p.spa\|\|!0===p.spa),C=p.send&&p.send.to?p.send.to:void 0===p.version?"https://cloudflareinsights.com/cdn-cgi/rum":null,P=function(r){var a=function(r){var o,a,c=s.timing,u=s.memory,f=r\|\|e(),d={memory:{},timings:{},resources:[],referrer:(o=document.referrer\|\|"",a=v[v.length-1],L&&w&&a?a.url:o),eventType:i.EventType.Load,firstPaint:0,firstContentfulPaint:0,startTime:F(),versions:{fl:p?p.version:"",js:"2024.6.1",timings:1},pageloadId:l,location:f,nt:S,serverTimings:I()};if(null==n){if("function"==typeof s.getEntriesByType){var m=s.getEntriesByType("navigation");m&&Array.isArray(m)&&m.length>0&&(d.timingsV2={},d.versions.timings=2,d.dt=m[0].deliveryType,delete d.timings,t(m[0],d.timingsV2))}1===d.versions.timings&&t(c,d.timings),t(u,d.memory)}else O(d);return d.firstPaint=k("first-paint"),d.firstContentfulPaint=k("first-contentful-paint"),p&&(p.icTag&&(d.icTag=p
URL: https://donorbox.org/events/730855 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Org Login", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://donorbox.org/events/730855 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Org Login", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false, "page_classification": "unknown" }

URL: https://donorbox.org/events/730855 Model: Joe Sandbox AI	{ "brands": [ "Donorbox" ] }
	{ "brands": [ "Donorbox" ] }
URL: https://donorbox.org/events/730855 Model: Joe Sandbox AI	{ "brands": [ "Donorbox" ] }
	{ "brands": [ "Donorbox" ] }

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 27 07:37:54 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9851442996859414
Encrypted:	false
SSDEEP:
MD5:	BA5985F8E47916E38EE1E807363A7FA3
SHA1:	89F369F55B467DC4E1AE0901D45BAA694D69CD6F
SHA-256:	98A2FB9997B41B574B42A936BA26FE034963F20B391171BB209DF3931767E39E
SHA-512:	2672B3016B58879A82ECAFD02A84E493C3F283F07625ACDB214822FA2338619C1F03132FEBA8714F0153E36265042B92BEB16E04FBC4CE7F3A9C05ECA2D6E7A6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....#...p..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Z.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Z.D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Z.D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Z.D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Z.D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 27 07:37:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003564708016941
Encrypted:	false
SSDEEP:
MD5:	86C0B5B13682058567DB33BFCD2ECC16
SHA1:	76A029B2E2B9CA6CA447F6F7699DF284B11331AE
SHA-256:	CF3A473C83D5510645CE4B29B7DDEB0E345BE3890134BA8B25580AB55A16616E
SHA-512:	1A287CF8594CFBC3D5795F24B66015F90B51DF59A349FED6C9993F10D0BAE384DEF5D61DA535EEEFD9546477DA2FCCDC81CBA6F8501B53B606C0BA692054F7FC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........p..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Z.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Z.D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Z.D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Z.D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Z.D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009102770704086
Encrypted:	false
SSDEEP:
MD5:	680FE9E3DE339CFFE15F1D39C787C02F
SHA1:	FCCCCDC17A76F85EE934AA199A390409172CF484
SHA-256:	34A051F575DB200A345FB23515D73A4F2844A83237262D75F46BD7438DB19AF0
SHA-512:	E0C895FC5BA7D53E5BDAB7381943EA12F5322D667D4F1B9122196B7DA7EA67F68728531B54D833B7ECB46270A4A480C5B61830449D1F1E96F73FA46417738F41
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Z.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Z.D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Z.D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Z.D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 27 07:37:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.998373248067033
Encrypted:	false
SSDEEP:
MD5:	8DE3CBD9C98163F08E193889A70C880C
SHA1:	B0F86AD93C0B47B4ABA9A4D97E89946F0C2CE59B
SHA-256:	84D9EACD70AACFE1AA9D06D6CC9A0318952741E106BDE87492C06A63C4AD21A2
SHA-512:	C112E0E5DEB0E143EAD2679025BE62F70F5CE4B7228908B58F466B411C58E1591A8DF3459D5DC6AA46D81DAB953EAEDD426B363A03614D778B8F5C51425FA6BC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....,...p..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Z.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Z.D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Z.D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Z.D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Z.D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 27 07:37:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989055114852946
Encrypted:	false
SSDEEP:
MD5:	A743DD9412C0BCFC85B1EB08F052302B
SHA1:	72CFA291B85D362556675631AAD50E7B7A7A9F06
SHA-256:	CFBD5AC2B544B12AE8B84D6C9F7B9540A91F9FBC1FA456D34A2A52C935203A53
SHA-512:	F44AF87EEE9D4EDD7AAB37617796CD0801757E64E6F8121FBA8F3466E67D8107F99E04C157A00303C3309A6719511F5B8AD28ACEFE4572BDE821B3E30F9027BC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........p..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Z.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Z.D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Z.D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Z.D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Z.D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 27 07:37:53 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9990640005273153
Encrypted:	false
SSDEEP:
MD5:	FBA655F563C2128901862967234C413B
SHA1:	77E78A30A1AB04830538558AB264C50DAFE2660B
SHA-256:	DB7A278079D9CCA28E264F9BC7DFF87B03CC35527F36FF8E4EF2DA566813BC79
SHA-512:	24498995812E5489E97F9E0DD46ECE66A8CC22FCB02A2B0C77839B2EDAFC8CAAF281BDCBB267597C0B50AF17641B797FFEF791C1E7CEE749A9B46192BECA904A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........p..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I;Z.D....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V;Z.D....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V;Z.D....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V;Z.D..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V;Z.D...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............1......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8776), with no line terminators
Category:	downloaded
Size (bytes):	8776
Entropy (8bit):	5.731221174917696
Encrypted:	false
SSDEEP:
MD5:	101C06958ABA99431F914199839C30F2
SHA1:	E3741E672CE5E5D46D65EC38F0BFEB779BEDE57F
SHA-256:	31EA966A950365C7B619FD20D6C7509F5C036BF516E60CC913C46A75487EAEC7
SHA-512:	452F185E0A84AAF0DC5DCAD834BDC791FC5D6BEF551A739CCCC670F27717A1F5EC8D296A61A44AF1E1083D2F66AC01D5FBFB2253851498E5CF59D7A97E8E6D4F
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/cdn-cgi/challenge-platform/h/b/scripts/jsd/725bd36e298b/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(322))/1(parseInt(V(263))/2)+-parseInt(V(298))/3+-parseInt(V(222))/4+-parseInt(V(255))/5(parseInt(V(273))/6)+parseInt(V(234))/7+parseInt(V(299))/8(-parseInt(V(239))/9)+parseInt(V(262))/10(parseInt(V(258))/11),g===e)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,426173),h=this\|\|self,i=h[W(319)],j={},j[W(275)]='o',j[W(333)]='s',j[W(251)]='u',j[W(242)]='z',j[W(268)]='n',j[W(320)]='I',j[W(300)]='b',k=j,h[W(266)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|void 0===E)return G;for(I=n(E),g[a1(216)][a1(240)]&&(I=I[a1(233)](g[a1(216)][a1(240)](E))),I=g[a1(291)][a1(217)]&&g[a1(311)]?g[a1(291)][a1(217)](new g[(a1(311))](I)):function(O,a2,P){for(a2=a1,O[a2(238)](),P=0;P<O[a2(305)];O[P]===O[P+1]?O[a2(286)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(254)][a1(265)](J),K=0;K<I[a1(305)];L=I[K],M=m(g,E,L),J(M)?(N=M==='s'&&!g[a1(282)](E[L]),a1(228

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	45460
Entropy (8bit):	4.5100829387921735
Encrypted:	false
SSDEEP:
MD5:	FBFA03A7ED78D5DB27718015F6787298
SHA1:	071C17564C5606839156767F154596CF93F87219
SHA-256:	2FBA63815D6A57836FE530FC203839890CBB3180FF6D0D926F3A7DBF11E67704
SHA-512:	84D51F0C9197D5183CD3FEEC2CDADC6327C31F86F7126FD4992C8F8126E1D1EAA6C6FC5413DCF98883E1C51DF1B51FA38E15769D4B30FDA98626B60888C53E3D
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/static/icons.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN". "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">.<svg xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.1" width="30" height="30" viewBox="0 0 30 570">.. <symbol id="check-icon" viewBox="0 0 14 12">. <path fill-rule="evenodd" clip-rule="evenodd" d="M11.8263 1.07622C12.0537 0.850784 12.3607 0.723911 12.681 0.723027C13.0012 0.722144 13.3089 0.847321 13.5375 1.0715C13.7662 1.29567 13.8974 1.60083 13.9029 1.921C13.9084 2.24117 13.7876 2.55063 13.5667 2.78247L7.0797 10.8912C6.96821 11.0113 6.83365 11.1077 6.68406 11.1746C6.53448 11.2415 6.37294 11.2775 6.20911 11.2805C6.04527 11.2836 5.88251 11.2535 5.73055 11.1922C5.57859 11.1309 5.44056 11.0396 5.3247 10.9237L1.02657 6.62397C0.906832 6.51239 0.810791 6.37784 0.744179 6.22834C0.677567 6.07884 0.641749 5.91746 0.638862 5.75382C0.635974 5.59017 0.666077 5.42763 0.727374 5.27587C0.78867 5.12412 0.8799

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	7F3EDE7167BBAA4FB86B4F9BBE5D0D1A
SHA1:	E57F3EDD1A84EFF767D5164BFC0EE32CA341B4F9
SHA-256:	3A7E590FC9782FE7AD0D3D926124970EBC55504AFDD230EF7FD6CE3C8C80B1B5
SHA-512:	FAE2B42A1F5E7ED139B1D38D920683D119CC9233323098C36D00AEFC3A49E05A300410976C0C0379CC3242B807193302BA1B664FD6C23D8A094C8B2CC0874C66
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkFsVE_zZPyPhIFDZSQkvo=?alt=proto
Preview:	CgkKBw2UkJL6GgA=

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1591
Entropy (8bit):	4.725848889895399
Encrypted:	false
SSDEEP:
MD5:	ADB8C118DB3C5ABF3BB8237A3F645BF5
SHA1:	7436B729DB0B84D832A42A4041005C87C91FB3C7
SHA-256:	7C29601EEA83F65AB3749F3BFFEC26489F5E3F5887A8B14A3956A027CF2DD274
SHA-512:	B016A865F222753EB67666A23C9E3341A832D7E862A93ADF86A388A74673D098EBCC595991B5815189D8DD2D5D0881BF31290F294E32DCB268BA1BFE57162BD9
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/public.js
Preview:	var scrollEventDebounce = null..function headerScrollEvent () {. clearTimeout(scrollEventDebounce);.. debounce = setTimeout(function() {. var docBody = document.body; //IE 'quirks'. var docElem = document.documentElement; //IE with doctype. docElem = (docElem.clientHeight) ? docElem : docBody;.. if (docElem.scrollTop === 0) {. app_header.classList.remove('header_active');. } else {. app_header.classList.add('header_active');. }. },10);.}..function createLanguageSelector () {. var list = document.getElementById("footer_language_selector").querySelectorAll('ul li a');. var select = document.createElement('select');. var lang = document.querySelector('html').getAttribute('lang');.. Array.from(list).forEach( function(item) {. var option = document.createElement('option');. option.innerHTML = item.innerHTML;. option.value = item.getAttribute('href');.. if(option.value ===

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2477
Entropy (8bit):	4.390962002096263
Encrypted:	false
SSDEEP:
MD5:	CCC0E36DCA5A2C3B4AF7EBA8E6AE5C00
SHA1:	D179F769FFF12158B7CD8B25AFE965F7C4E2A508
SHA-256:	68BC19D95BD24136B2DE813052DABFB26FFC327905885DB72DF774B16C3DACF0
SHA-512:	1D35C83C0E95CECB2ED0C01DEC7E032E67798B6F929CE51E19BDA514983718C1BC059FD344DE345390FD64FCBFF4C1060F782FEAD8B00D54B103908826316E65
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/static/donorbox-logo.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 139 31.75"><defs><style>.cls-1{fill:#f70059;fill-rule:evenodd;}.cls-2{fill:#056bbf;}</style></defs><path class="cls-1" d="M17.93,18.5c1.74-1.5,2.62-2.94,2.62-4.3a2.67,2.67,0,0,0-2.62-2.86,3.23,3.23,0,0,0-1.57.28,2.37,2.37,0,0,0-.73.52l-.67.68-.66-.68a2.52,2.52,0,0,0-.73-.51A3.34,3.34,0,0,0,12,11.34,2.65,2.65,0,0,0,9.37,14.2c0,1.36.88,2.8,2.62,4.3a17.29,17.29,0,0,0,3,2A17.29,17.29,0,0,0,17.93,18.5Z"/><path class="cls-2" d="M55.91,9.85A6.09,6.09,0,1,0,62,15.93,6.09,6.09,0,0,0,55.91,9.85Zm0,9.4a3.32,3.32,0,1,1,3.32-3.32A3.31,3.31,0,0,1,55.91,19.25Z"/><path class="cls-2" d="M74.18,14.86v5.78a1.39,1.39,0,0,1-2.77,0V14.86a2.25,2.25,0,0,0-4.49,0v5.78a1.39,1.39,0,0,1-2.77,0V11.23a1.39,1.39,0,0,1,2.37-1,1.55,1.55,0,0,1,.19.24,5,5,0,0,1,4.91,0A5,5,0,0,1,74.18,14.86Z"/><path class="cls-2" d="M97.93,11.34a1.38,1.38,0,0,1-1.38,1.38,1.66,1.66,0,0,1-.32,0,2.1,2.1,0,0,0-.56-.07,2.24,2.24,0,0,0-2.25,2.24v5.78a1.38,1.3

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	720
Entropy (8bit):	4.569092186365795
Encrypted:	false
SSDEEP:
MD5:	B58FCFA7628C9205CB11A1B2C3E8F99A
SHA1:	D11FEBF9E708A9E11BAEE37ED7DC5E99902580BE
SHA-256:	27ECA3E8297EB7FF340DEB3849B210185A459B3845456AA4D0036F6D966B3518
SHA-512:	66ED2703C1AE9A94DE01DD47707F9ED6CF3E2A035A3359793A06AFAE682A7DD4ABF06FF05109905841FE85747802C94708CE4A9EE56C7FBB8CC578EC556BF6D3
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/manifest.json
Preview:	{. "name": "App",. "icons": [. {. "src": "\/android-icon-36x36.png",. "sizes": "36x36",. "type": "image\/png",. "density": "0.75". },. {. "src": "\/android-icon-48x48.png",. "sizes": "48x48",. "type": "image\/png",. "density": "1.0". },. {. "src": "\/android-icon-72x72.png",. "sizes": "72x72",. "type": "image\/png",. "density": "1.5". },. {. "src": "\/android-icon-96x96.png",. "sizes": "96x96",. "type": "image\/png",. "density": "2.0". },. {. "src": "\/android-icon-144x144.png",. "sizes": "144x144",. "type": "image\/png",. "density": "3.0". },. {. "src": "\/android-icon-192x192.png",. "sizes": "192x192",. "type": "image\/png",. "density": "4.0". }. ].}

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 116284, version 2.45
Category:	downloaded
Size (bytes):	116284
Entropy (8bit):	7.989805359498794
Encrypted:	false
SSDEEP:
MD5:	411DF5CA73064C433801CB263C522119
SHA1:	9B7E77C4B76763AAEE5C6D8363610DAA9FBDBAC7
SHA-256:	93A2C33D347358CF5FA15C4E9EB3096D401F2B946AEB0976B9FEB88C9606B7BF
SHA-512:	4B3FADB9077F14E524D975DE77B1EBB0A665B5D11835E9F27A6506A2A49B794034490BACB1B30736E5AA64BF17D472D958A3AE1AB5BFF57BDF5D2B81F0E2CA47
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/static/sans-pro/bold.woff
Preview:	wOFF.......<..........-....................FFTM... ..........i.GDEF...............GPOS..J...{8..\|..0.:GSUB......,;..O.j.~.OS/2.......X...`_...cmap.......j......gasp................glyf..)....w..w(.+..head...X...6...6....hhea.......!...$...uhmtx...,...........loca...\|.......n.yXmaxp........... ....name...............~post......"...J."/............._.<..........].......f/6.7...m..............x.c`d``...=.......9r..".}.........x.c`d``..0...!.....C.,...,......x.c`fr`....................5......,.LL,..L....P.........?..l@........Ar.....)..>.SO..x....p......."i.....gH..$<.C ..#R..S"BU.b..Z..c.j....-.V...v2j....:hU..X..i..X.y.D......].%..N............4...,.ns..fK?0 :W..J.5.Rc..,0..U.k=e.M....f.t...L..A..*...A)...Uh.0..."..2.V..v....._...,.}...ZS.>.l{1e..0..x..Y....J..n.-u..2.hGK.....^R.>...c.i.,["sl'.X!U.5)..0G..-.m...Gy..mr.&.UezK...A.o_.}.r..$].R.l..x.)YQ{..!C..+.y..,9'....=...2.t.YZ.eZ"..Rf....d...,})..,f...Dz(({..`.7.....#...Iw....ep4...{...y7...}.uP.t.`...tP

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19948), with no line terminators
Category:	downloaded
Size (bytes):	19948
Entropy (8bit):	5.261902742187293
Encrypted:	false
SSDEEP:
MD5:	EC18AF6D41F6F278B6AED3BDABFFA7BC
SHA1:	62C9E2CAB76B888829F3C5335E91C320B22329AE
SHA-256:	8A18D13015336BC184819A5A768447462202EF3105EC511BF42ED8304A7ED94F
SHA-512:	669B0E9A545057ACBDD3B4C8D1D2811EAF4C776F679DA1083E591FF38AE7684467ABACEF5AF3D4AABD9FB7C335692DBCA0DEF63DDAC2CD28D8E14E95680C3511
Malicious:	false
Reputation:	unknown
URL:	https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Preview:	!function(){var e={343:function(e){"use strict";for(var t=[],n=0;n<256;++n)t[n]=(n+256).toString(16).substr(1);e.exports=function(e,n){var r=n\|\|0,i=t;return[i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],"-",i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]],i[e[r++]]].join("")}},944:function(e){"use strict";var t="undefined"!=typeof crypto&&crypto.getRandomValues&&crypto.getRandomValues.bind(crypto)\|\|"undefined"!=typeof msCrypto&&"function"==typeof window.msCrypto.getRandomValues&&msCrypto.getRandomValues.bind(msCrypto);if(t){var n=new Uint8Array(16);e.exports=function(){return t(n),n}}else{var r=new Array(16);e.exports=function(){for(var e,t=0;t<16;t++)0==(3&t)&&(e=4294967296*Math.random()),r[t]=e>>>((3&t)<<3)&255;return r}}},508:function(e,t,n){"use strict";var r=n(944),i=n(343);e.exports=function(e,t,n){var o=t&&n\|\|0;"string"==typeof e&&(t="binary"===e?new Array(16):null,e=null);var a=(e=e\|\|{}).random\|\|(e.rng\|\|r)();if(

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1257
Entropy (8bit):	7.1855330445399055
Encrypted:	false
SSDEEP:
MD5:	3B079E64B3B65245B6AEE657369E5001
SHA1:	D80C287434666DB4E7EA8B5246E553D0D648A5E2
SHA-256:	BCCCF1EC0137460A1B2EB351BC0A17EF21E06FEBA30AA4C6AE0373EC86D3F60F
SHA-512:	DF46BD22A227EB79A4A4AB6057E66662AE3EA9033DA222D234EFCBEF002B4024DB0DF54133609BF00C00BEBA38B5BCC44E4FC060DE98570529126AE0A2DB23B2
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/favicon-32x32.png
Preview:	.PNG........IHDR... ... .....D.......gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<...APLTE.........\|..}...................v..h..i..h..u.....v....m..k..o..q.....q..m.....l............l...........l.......k.......a..d....................................9e.)X.7c.......9d.......Z~.%U.(W.+Z.,Z.&V.Mt.......Nu.'V.?i....t..l........Ak.:e.......=g.8c..........Pw.&U.Ks....................w..i..j..i...........T.Y....bKGD....H....pHYs.................IDAT8.c`..`dbf..fV6..;.....V......\|.. 1..>^^.A...!a.Q1(........J..`6..........+.K......l...&.{TU...l..U......^..Z.:x.0.*2.W...P..o`hd.o`b.C..........-v.v....N....nX..{xZ....7V.z>.....~.....6.30..7.C\..a...GD.DE........D.!ijJ.......x.E..D....<.'%....a..`r.X.[zF&V....@.....L........%tEXtdate:create.2021-03-23T04:01:29+00:00......%tEXtdate:modify.2021-03-23T04:01:29+00:00.[....FtEXtsoftware.ImageMagick 6.7.8-9 2014-05-12 Q16 http://www.imagemagick.org.......tEXtThumb::Document::Pages.1.../....tEXtThumb::Image::h

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	10765
Entropy (8bit):	3.985008924865288
Encrypted:	false
SSDEEP:
MD5:	2E2465E38022034DEE6060D9385C743D
SHA1:	19303305F8287AA3AECE9D3083CB1F3910901377
SHA-256:	D6C2FE90E7FB44B98C6AD9639E465516CF13D96799D618E8DD8D46F7D3B503D1
SHA-512:	22927EB9892360D5BBC3A26476D9EC9ED21C5DDB2C9F15A5827F7A4CCC65CB30E7C72953A816048210A6ADA5173AA6E1DFCBBD2A9E9548B49325ECB56A379032
Malicious:	false
Reputation:	unknown
Preview:	<svg width="129" height="25" viewBox="0 0 129 25" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M122.786 1.06055H6.38624C3.48067 1.06055 1.12524 3.41425 1.12524 6.31769V18.8034C1.12524 21.7068 3.48067 24.0605 6.38624 24.0605H122.786C125.691 24.0605 128.047 21.7068 128.047 18.8034V6.31769C128.047 3.41425 125.691 1.06055 122.786 1.06055Z" stroke="#056BBE"/>.<path fill-rule="evenodd" clip-rule="evenodd" d="M59.6335 10.2161L57.6876 15.1893H56.6459L54.6928 10.2161H55.9297L57.1667 13.5629L58.4037 10.2161H59.6335ZM60.1977 15.1893V10.2161H63.3372V11.1992H61.4058V12.1895H63.0551V13.1364H61.4058V14.2063H63.3951V15.1893H60.1977ZM65.5074 11.1703V12.4859H66.0572C66.4695 12.4859 66.7661 12.204 66.7661 11.8281C66.7661 11.4377 66.4695 11.1703 66.0572 11.1703H65.5074ZM64.3283 15.1893V10.2161H66.2163C67.2435 10.2161 67.9741 10.8812 67.9741 11.8281C67.9741 12.4714 67.6341 12.9919 67.0627 13.2666L68.1694 15.1893H66.8818L65.9125 13.4328H65.5074V15.1893H64.3283ZM68.9579 15.1893V10.2161H70.166V15.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 629 x 220, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10929
Entropy (8bit):	7.933206286786215
Encrypted:	false
SSDEEP:
MD5:	B4D0845FE97B4FD9ED9942737334CF65
SHA1:	118ECC395CC87B9E7CA7C7C098AC6AA585FC50D3
SHA-256:	FE28DAB912CA5668F95E87BEE33CEF28184A9964CF9BB6BD1A2DBC04CBB92F7B
SHA-512:	1EE255D0CBCF2CC2E7BFC5FA20A9FBEFBBAA3B85C64BCE2C2EA8ABE6D1C4A28758636D1B9E5768D4C0C4F4ABAA4949C68FBBEB057B51F22DAB3AB0102938218B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...u..........{W[..*xIDATx..]..U...NN.C .%Wa... 0.f.f@..0.....3 W\RT...s..v..nY.........T...[.l-.Zk.&B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.Qc..H)....^....../.?{.#..B.!.....o_.~.../.<...H....}...D.G.!...."..q../...jQ."....?L.s..B.!....../..$?zW..A....(..!..B.....?..j.=u......B.!.x..b.]..SQ."..f..r%..B.!1........E......N_\...B.!$.e.._..=.[B.?..!..BH$.._]}i.S.z....Y....O......d~9.>..7...t.CB.!..s..p..r..!..w......#.,....>N...w.(..!..E.]......._.9....th\|G.M.!.X.....D...x..3.....!..b./.><.u.1.B.!..$NS..(A.!..B..#..B..;.u..B.!7`hQ7...k..,.q.@.!..3......'..".yL.!.....(1.E)..~.6......A...;zO.!..#..x....#..B.y..D....!..Bn.E.!..B....#..B....u..B.!7....B.!..P..B.!....:B.!....a....9.B.!..C..O'1...B.!....:B.!...@QG.!..r.(..!..Bn.E.!..B....#..B....u..B.!7....B.!..P..B.!....:B.!...@QG.!..r.(..!..Bn.E.!..B....#..B........E.~..i..eO?...y..MI./....o..B.w.........zt.-...1.I..L..j.^.......X.O.....(T.z.?~.......}Kn-.~..i..o).f.d.j...T...f...L..[.E..n

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	15051
Entropy (8bit):	4.92175631093971
Encrypted:	false
SSDEEP:
MD5:	9B11DF433E539CD8DBA44C0D3814C6F2
SHA1:	5D7D1211E4706F09FA02AAD55C4A604CFC0026B9
SHA-256:	E5605BFE9335003A484FFF8B1D33A59890CFE1FB035A42A40E2FD2CD7E8B6667
SHA-512:	03013364CD8C9C4BF9DF5F2B07E5DD1CEF8A051696534B0C43AD2BAD2D1BE69CAAEB265AD405ADC0FFE4DE58ABA591C180A2BF62B83B66FB33D38A22D1C99EA4
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/public.css
Preview:	@font-face {. font-family: 'Source Sans Pro';. src: url('static/sans-pro/regular.eot');. src: url('static/sans-pro/regular.woff') format('woff'),. url('static/sans-pro/regular.ttf') format('truetype');. font-display: swap;.}..@font-face {. font-family: 'Source Sans Pro';. src: url('static/sans-pro/semibold.eot');. src: url('static/sans-pro/semibold.woff') format('woff'),. url('static/sans-pro/semibold.ttf') format('truetype');. font-weight: 600;. font-display: swap;.}..@font-face {. font-family: 'Source Sans Pro';. src: url('static/sans-pro/bold.eot');. src: url('static/sans-pro/bold.woff') format('woff'),. url('static/sans-pro/bold.ttf') format('truetype');. font-weight: 600;. font-display: swap;.}..html, body {. scroll-behavior: smooth;.}..body {. margin: 0;. padding: 0;.. font-family: 'Source Sans Pro';. font-weight: normal;. font-size: 16px;.. color: #013159;. background-color: #FFFFFF;.}..main { padding-top: 76px; }..section {. max-width: 1024px;.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 116576, version 2.45
Category:	downloaded
Size (bytes):	116576
Entropy (8bit):	7.9910988132315355
Encrypted:	true
SSDEEP:
MD5:	FDF72C397778061E616824D64EA8DD80
SHA1:	C3D699B3CDC9FE0A97614A12E836477396B33105
SHA-256:	68825154FD02E361FFEF7BBB901B1E9D47682FCEABC48527F5F9E309178B5F49
SHA-512:	9BB8C6897C74CCD64A99A0F4304933511B48732643CCCCC8E8F98828204262DA15A8A73694D78636822C04A4FB27F8F627C7C41BD486B43BED9A5E877E8E3384
Malicious:	false
Reputation:	unknown
URL:	https://donorbox.org/static/sans-pro/regular.woff
Preview:	wOFF.......`.......X...-....................FFTM...D..........i.GDEF...$...........GPOS..K...\|/..~._.h)GSUB......,;..O.j.~.OS/2.......X...`]...cmap.......j......gasp................glyf..)t.....x..`.head...X...6...6....hhea.......!...$...xhmtx...,...........loca...p.......n....maxp........... ....name...0..........M"post... .."...J."/............D._.<..........].......f/6.:...o..............x.c`d``...=....V..8...".}.........x.c`d``...........!...f.+......x.c`f.e..........................,.LL,..L....P..........?..l@........Ar....)..>.8P..x....pU...s.$.e.%@x$.%..!..EL.(......kE\P.E.(.R......-.... .v...V.VE.n..RA..K.H$B...w.........w.Y....d...T..V8Gf..2..J.....\{.d.a.K..2..X...m.).\|x..'.i......t..@........I..AA.......2..Q.2...1_.W..N...N.g'.i............n3%..*...]..5..\|.....p.y.#...0ur...-....s.2..a..d.. 1...[\..d...3_..J<./q..b......?K..K&c......d..........Z..?..V.b/...}-..d....f..4........_.iN...5..ri{.....^....U.j.IJ..R..,'.B'.F..H..A..."...(:8.>

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8817), with no line terminators
Category:	dropped
Size (bytes):	8817
Entropy (8bit):	5.74403820499222
Encrypted:	false
SSDEEP:
MD5:	D312F6292C72A8DFEBEA548AC5C8ECB6
SHA1:	91E09C1F4A6E2E0A83AA8ACA791370AE56B68175
SHA-256:	1522BEBC3C0474EFE55359C4CD10E5ACE4BF03A4619182076CB1BE1868E1E6DB
SHA-512:	874A575A7E7CF2F494EBB01E2BA5AB72BE4A0DAAFCF14EE8B850E13BD2F87EE28B3F18B3946D099688BCBD96A728FD84A3D0D6A81A941D371197A9A7DD8D8993
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,j,k,o,s,B){W=b,function(d,e,V,f,g){for(V=b,f=d();!![];)try{if(g=-parseInt(V(433))/1(parseInt(V(469))/2)+parseInt(V(479))/3+parseInt(V(375))/4(-parseInt(V(365))/5)+parseInt(V(450))/6(parseInt(V(444))/7)+parseInt(V(382))/8+-parseInt(V(461))/9(parseInt(V(394))/10)+parseInt(V(426))/11*(-parseInt(V(418))/12),e===g)break;else f.push(f.shift())}catch(E){f.push(f.shift())}}(a,239214),h=this\|\|self,i=h[W(445)],j={},j[W(442)]='o',j[W(431)]='s',j[W(439)]='u',j[W(380)]='z',j[W(463)]='n',j[W(370)]='I',j[W(432)]='b',k=j,h[W(464)]=function(g,E,F,G,a1,I,J,K,L,M,N){if(a1=W,E===null\|\|E===void 0)return G;for(I=n(E),g[a1(466)][a1(449)]&&(I=I[a1(430)](g[a1(466)][a1(449)](E))),I=g[a1(417)][a1(456)]&&g[a1(367)]?g[a1(417)][a1(456)](new g[(a1(367))](I)):function(O,a2,P){for(a2=a1,O[a2(386)](),P=0;P<O[a2(480)];O[P+1]===O[P]?O[a2(438)](P+1,1):P+=1);return O}(I),J='nAsAaAb'.split('A'),J=J[a1(376)][a1(455)](J),K=0;K<I[a1(480)];L=I[K],M=m(g,E,L),J(M)?(N=M==='s'&&!g[

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://donorbox.org/events/730855

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 68

Chrome Cache Entry: 70

Chrome Cache Entry: 72

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Static File Info

Windows Analysis Report
https://donorbox.org/events/730855