Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

Overview

General Information

Sample URL:	https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d
Analysis ID:	1592015

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Uses ipconfig to lookup or modify the Windows network settings

Uses ping.exe to check the status of other devices and networks

Creates a process in suspended mode (likely to inject code)

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

×

Process Tree

System is w10x64_ra

chrome.exe (PID: 5504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2004,i,15527857064081672887,4597833807114158072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 2424 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb2a44427h1ee3h407ah80e8hed8c7f73af4b MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 6140 cmdline: "C:\Windows\system32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5124 cmdline: ipconfig MD5: 62F170FB07FDBB79CEB7147101406EB8)

PING.EXE (PID: 3936 cmdline: ping 8.8.8.8 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

HTTP Parser: Title: Creation de mot de passe BluePass does not match URL

Source: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

HTTP Parser: <input type="password" .../> found

Source: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

HTTP Parser: No <meta name="author".. found

Source: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.15.253:443 -> 192.168.2.16:49785 version: TLS 1.2

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 2.22.50.144
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	DNS traffic detected: DNS query: bluefiles.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.16:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.20:443 -> 192.168.2.16:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.1.33.206:443 -> 192.168.2.16:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.104.15.253:443 -> 192.168.2.16:49785 version: TLS 1.2

Source: classification engine

Classification label: mal48.troj.win@25/10@6/118

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2004,i,15527857064081672887,4597833807114158072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2004,i,15527857064081672887,4597833807114158072,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb2a44427h1ee3h407ah80e8hed8c7f73af4b
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE

Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 File and Directory Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	2 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.185.228	true	false		high
bluefiles.com	148.253.98.69	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States		15169	GOOGLEUS	false
142.250.185.67	unknown	United States		15169	GOOGLEUS	false
142.250.74.202	unknown	United States		15169	GOOGLEUS	false
148.253.98.69	bluefiles.com	France		50624	OUTSCALEFR	false
142.250.185.228	www.google.com	United States		15169	GOOGLEUS	false
1.1.1.1	unknown	Australia		13335	CLOUDFLARENETUS	false
142.250.185.227	unknown	United States		15169	GOOGLEUS	false
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
64.233.167.84	unknown	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
142.250.185.174	unknown	United States		15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592015
Start date and time:	2025-01-15 16:48:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.troj.win@25/10@6/118

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d

LLM Input / Output

Input	Output
URL: https://bluefiles.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false, "reasoning": "This appears to be a straightforward URL with a common TLD (.com) and no suspicious elements. The domain name is simple and doesn't attempt to imitate any well-known brands." }
URL: https://bluefiles.com
URL: https://bluefiles.com/fr/reader/document/2c33782e9... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be setting up configuration settings and data for a web application. While it includes some potentially sensitive information like API URLs and an encryption key, the overall behavior does not indicate any high-risk activities. The script seems to be setting up necessary parameters for the application's functionality, which is a common and legitimate practice. There are no signs of dynamic code execution, data exfiltration, or other suspicious behaviors. The risk score is low, as the script appears to be part of a legitimate application." }
var apiSettings = {"url":"https:\/\/bluefiles.com\/api\/v1","pkiURL":"http:\/\/127.0.0.1:45127","siteURL":"https:\/\/bluefiles.com","bluepassURL":"https:\/\/bluepass.me","pkiVersion":"1.2","key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAreBC9UToLhy\/yFopO+9fP4oLSVGaofjN\/6mF+w28wzCcNSvRQ\/gpt1CfitJoUB\/OfpQe8Q03Hv6ZUxj3cvs5yPlQwBpr2g5DM88lL\/X5omsaiwYqpDou\/7ia2DaaAPWuuZ5jAdoBxmjHgwCrEuKNplIY45lPE4IvBXLkGFWHjYLxeCJUbkdLz1kStqKP7cd8FonUtIFNzIOC71ISE0c0jyyuvArmCkJ3Gdm63rJzhR5+JywXUESIKXR1GV9psisErI6TDE7MS1gK5VnOwPieixj4CgoxumJ3rZiFAXCVV\/xPgNbig6dcnETDLu4Pk7e5FWmaDp4jhEYXsLeI4de0nwIDAQAB","key_signature":"dq6NOY8PujK+6Lxe0kbN1fHVDvA8fWZuU5cyHig5sfyRmW7MSQM4yF18yrQ10mNhRi0IyOg1Y9SKVvzu8Cor9hkBw32sU7YbFxggXKvOjZetI1Aru0NTdvGhqNQi8DHf\/rC+ytQGvTM11gwq1KLJK4IOkkBhvLI20ayB9K2vZelC+43wE537fQnmbb\/CC8Ou\/7zcl+bhqdkUSeH2qIqNr+\/XUsr8n\/XE6WEnDxOluDdQD5WhCV6wY2m2T8FS3K\/spkNpR4T6Z0A+RHdkXjYNZVcKvuqHPesxS14a2jVG39qdqBLSm8B8jEHb7qtyJzwj3IoLk4K1VLIaxJ0VBZkDtA==","lang":"fr"}; var data = {"email":"agnes.legal@esea-na.fr","token":"2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d","sso_servers":[],"mandatory_sso":false,"sso_match_address":false,"selectable_teams":[]};
URL: https://bluefiles.com/fr/reader/document/2c33782e9... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The script demonstrates a mix of behaviors, some of which are low-risk (e.g., language selection, error handling) and others that are moderately risky (e.g., dynamic code execution, external data transmission). The overall risk is medium due to the potential for abuse if the script is not properly implemented or secured." }
var LanguageSelectorMixin = { data: { language: "fr", translateCGS: false, }, mounted: function() { var self = this; this.client.axios.interceptors.request.use(function (config) { config.headers['Accept-Language'] = self.language; return config; }, function (error) { // Do something with request error return Promise.reject(error); }); if (this.translateCGS) this.getCGS(this.language); }, methods: { showCGS: function () { window.scrollTo(0,0); document.querySelector('html').style.overflow = 'hidden'; document.querySelector('html').style.height = '100vh'; }, selectLanguage: function(lang) { this.language = lang; this.$i18n.locale = lang; axios.get('/js/errors/' + lang + '.0.1736549934.js') .then(function (response) { if (response.status === 200) { eval(response.data) } }) .catch(function() {}); if (this.translateCGS) { this.getCGS(lang); } if (this.$refs.passwordStrength) { var selfInst = this; this.$nextTick().then(function() { selfInst.$refs.passwordStrength.getStrength(); }) } }, getCGS: function(lang) { axios.get('/' + lang + '/cgs').then(function (response) { var cgsNode = document.getElementById('cgu-section-1'); cgsNode.innerHTML = response.data; document.querySelector('#cgu-section-1 .modal-content').addEventListener('scroll', function() { var modalContent = document.querySelector('#cgu-section-1 .modal-content'); if (Math.ceil(modalContent.scrollTop + modalContent.clientHeight) >= modalContent.scrollHeight) { document.querySelector('#validate_CGU').disabled = false; } }); document.querySelector('#validate_CGU').addEventListener('click', function() { if (!document.querySelector('#accept_CGU').checked) { document.querySelector('#accept_CGU').click(); } }); }); } }, beforeCreate: function() { this.$i18n.mergeLocaleMessage('en', { 'language': 'Language', 'bluepass_password_mode': 'Account secured by password', 'bluepass_certificate_mode': 'Account secured by certificate', 'bluepass_certificate_subtitle': 'Select the certificate to use to secure your account :', 'bluepass_create_password_subtitle': 'You must create a password, of your choice, below.', 'bluepass_create_password_subtitle2': 'This password must validate the required conditions, indicated below.', 'bluepass_create_password_title': 'BlueFiles uses BluePass in order to guarantee your identity.', 'bluefiles_select_team': 'Select the team you belong to', 'default_team_name': 'None', 'create_password_placeholder': 'Enter your password', 'create_password_placeholder2': 'Confirm your password', 'create_password_min_length': '12 characters min.', 'create_password_tip': 'Please keep this password. It will guarantee your identity and allow you to access all BlueFiles services on every platform.', 'validate': 'Validate', 'success_create_accounts': 'Your BluePass and BlueFiles accounts have been successfully created', 'validation_accounts_email': 'An email has been sent to confirm your accounts.', 'signup_validation': 'Your BluePass and BlueFiles account have been successfully created. An e-mail has been sent to you in order to validate your accounts.', 'signup_bluefiles_validation': 'Your BlueFiles account has been successfully created. An e-mail has been sent to you in order to validate your account.', 'signup_bluepass_validation': 'Your BluePass account has been successfully created. An e-ma
URL: https://bluefiles.com/front/js/bluefiles-front.min... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script contains a mix of behaviors, some of which are low-risk (e.g., analytics/telemetry, error reporting) and others that are moderate-risk (e.g., external data transmission, aggressive DOM manipulation). While the script appears to have a legitimate purpose related to user authentication and account creation, there are some concerning practices that warrant further review, such as the use of obfuscated URLs and the potential for data exfiltration. Overall, the script requires closer inspection to ensure it is not engaging in any malicious activities." }
function browserSupported(){if(!window.crypto&&!window.msCrypto)return{valid:!1,error:BrowserCryptoError};var e="test";try{localStorage.setItem(e,e),localStorage.removeItem(e)}catch(e){return{valid:!1,error:BrowserPrivateError}}return{valid:!0}}function createAccount(o){var e={headers:{"Accept-Language":apiSettings.lang}},t={firstName:o.firstName.value,lastName:o.lastName.value,email:o.email.value};axios.post(o.action,t,e).then(function(e){var t;0===e.data.status\|\|1===e.data.status\|\|2===e.data.status?(window.mustCreateBluepass=!0,o.action=e.data.location,o.submit()):(loader(),t=document.querySelector("#form-connect-2")&&0<document.querySelector("#form-connect-2").offsetWidth&&0<document.querySelector("#form-connect-2").offsetHeight,document.querySelector("#"+o.id+" .alert").innerHTML=e.data.error,document.querySelector("#"+o.id+" .alert").style.display="block",t&&document.querySelector("#"+o.id+" .alert").parentElement.classList.add("show"))})}function validateEmail(e){return/^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)\|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])\|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/.test(e)}function cookieBannerExpires(){return new Date((new Date).setFullYear((new Date).getFullYear()+1))}function loader(){var e=arguments.length<=0\|\|void 0===arguments[0]?"login":arguments[0];document.querySelector("#form-"+e+" .loader").parentElement.children.forEach(function(e){0<e.offsetWidth&&0<e.offsetHeight?e.style.display="none":e.style.display="block"})}function login(t){if(!window.loginHandler\|\|!window.loginHandler.pki){loader();for(var o=document.querySelector("#form-login .alert"),r=o.parentElement,n=document.querySelector("#form-connect-2")&&0<document.querySelector("#form-connect-2").offsetWidth&&0<document.querySelector("#form-connect-2").offsetHeight;o.firstChild;)o.removeChild(o.firstChild);o.style.display="none",n&&r.classList.remove("show");var c=document.querySelector("input[name=login-email]").value,l=document.querySelector("input[name=current-password]").value,e=null;if(!1===t.forAccessPoint&&(null!==t.email&&0<t.email.length&&(c=t.email),null!==t.password&&0<t.password.length&&(l=t.password),null!==t.code&&(e=t.code)),""==c\|\|""==l)return loader(),o.textContent=LoginFieldsError,o.setAttribute("class","alert alert-danger"),o.style.display="block",n&&r.classList.add("show"),!1;if(!validateEmail(document.querySelector("input[name=login-email]").value))return loader(),o.textContent=EmailFieldError,o.setAttribute("class","alert alert-danger"),o.style.display="block",n&&r.classList.add("show"),!1;var i=browserSupported();return i.valid?new BluefilesClient(c,apiSettings.key,apiSettings.url,!1,"BlueFiles Site").login(l,"",e).then(function(e){location.href=e}).catch(function(e){if(e instanceof Object)if(1002===e.status\|\|1003===e.status\|\|1004===e.status\|\|2002===e.status){if(!1!==t.connectError(e.error))return void loader();o.textContent=e.error,o.setAttribute("class","alert alert-warning")}else{if(1010===e.status\|\|1012===e.status)return t.open(),t.email=c,1010===e.status?t.forAccessPoint=!0:(t.forAccessPoint=!1,t.password=l),void loader();if(1011===e.status)return loader(),void t.invalidCode();if(!1!==t.connectError(e.error))return void loader();o.textContent=e.error,o.setAttribute("class","alert alert-warning")}else{if(""==e)return void loader();if(!1!==t.connectError(e))return void loader();o.textContent=e,o.setAttribute("class","alert alert-warning")}loader(),o.style.display="block",n&&r.classList.add("show")}):(o.innerHTML=i.error,o.setAttribute("class","alert alert-danger"),o.style.display="block",loader(),n&&r.classList.add("show")),!1}window.loginHandler.submit()}function loginFormHandler(){this.pki=!1,this.certificateID=null,this.certificates=[],this.certificate=null,this.certificateHash=null,this.nonce=null,this.signatureNonce=null,this.client=new BluefilesClient(null,apiSettings.key,apiSettings.url,!1,"BlueFiles Site"),this.errorSpan=document.querySelector("#form-login .alert"),this.loa
URL: https://bluefiles.com/js/lib/scrypt.0.1736549934.j... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of the SHA-256 hashing algorithm, which is a common cryptographic function used for various security purposes. It does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or obfuscated code. The script is well-structured and follows best practices for implementing cryptographic algorithms. While it uses some legacy APIs like `Uint32Array`, these are not inherently malicious and are commonly used in cryptographic implementations. Overall, the script seems to be a benign, security-focused utility and poses a low risk." }
"use strict"; (function(root) { const MAX_VALUE = 0x7fffffff; // The SHA256 and PBKDF2 implementation are from scrypt-async-js: // See: https://github.com/dchest/scrypt-async-js function SHA256(m) { const K = new Uint32Array([ 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 ]); let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a; let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19; const w = new Uint32Array(64); function blocks(p) { let off = 0, len = p.length; while (len >= 64) { let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7, u, i, j, t1, t2; for (i = 0; i < 16; i++) { j = off + i*4; w[i] = ((p[j] & 0xff)<<24) \| ((p[j+1] & 0xff)<<16) \| ((p[j+2] & 0xff)<<8) \| (p[j+3] & 0xff); } for (i = 16; i < 64; i++) { u = w[i-2]; t1 = ((u>>>17) \| (u<<(32-17))) ^ ((u>>>19) \| (u<<(32-19))) ^ (u>>>10); u = w[i-15]; t2 = ((u>>>7) \| (u<<(32-7))) ^ ((u>>>18) \| (u<<(32-18))) ^ (u>>>3); w[i] = (((t1 + w[i-7]) \| 0) + ((t2 + w[i-16]) \| 0)) \| 0; } for (i = 0; i < 64; i++) { t1 = ((((((e>>>6) \| (e<<(32-6))) ^ ((e>>>11) \| (e<<(32-11))) ^ ((e>>>25) \| (e<<(32-25)))) + ((e & f) ^ (~e & g))) \| 0) + ((h + ((K[i] + w[i]) \| 0)) \| 0)) \| 0; t2 = ((((a>>>2) \| (a<<(32-2))) ^ ((a>>>13) \| (a<<(32-13))) ^ ((a>>>22) \| (a<<(32-22)))) + ((a & b) ^ (a & c) ^ (b & c))) \| 0; h = g; g = f; f = e; e = (d + t1) \| 0; d = c; c = b; b = a; a = (t1 + t2) \| 0; } h0 = (h0 + a) \| 0; h1 = (h1 + b) \| 0; h2 = (h2 + c) \| 0; h3 = (h3 + d) \| 0; h4 = (h4 + e) \| 0; h5 = (h5 + f) \| 0; h6 = (h6 + g) \| 0; h7 = (h7 + h) \| 0; off += 64; len -= 64; } } blocks(m); let i, bytesLeft = m.length % 64, bitLenHi = (m.length / 0x20000000) \| 0, bitLenLo = m.length << 3, numZeros = (bytesLeft < 56) ? 56 : 120, p = m.slice(m.length - bytesLeft, m.length); p.push(0x80); for (i = bytesLeft + 1; i < numZeros; i++) { p.push(0); } p.push((bitLenHi >>> 24) & 0xff); p.push((bitLenHi >>> 16) & 0xff); p.push((bitLenHi >>> 8) & 0xff); p.push((bitLenHi >>> 0) & 0xff); p.push((bitLenLo >>> 24) & 0xff); p.push((bitLenLo >>> 16) & 0xff); p.push((bitLenLo >>> 8) & 0xff); p.pus
URL: https://bluefiles.com/js/bluefiles.min.0.173654993... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet contains a mix of behaviors that warrant further review. While it does not exhibit any clear high-risk indicators, such as dynamic code execution or data exfiltration, it does include some moderate-risk behaviors, like external data transmission and the use of legacy APIs. Additionally, the extensive use of cryptographic functions and the handling of sensitive data (e.g., private keys) suggest the need for a more thorough security assessment. Overall, this script requires closer inspection to determine the full extent of its functionality and potential risks." }
var BluefilesClientExport=(()=>{var B=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var O=Object.prototype.hasOwnProperty;var U=(b,t)=>{for(var e in t)B(b,e,{get:t[e],enumerable:!0})},C=(b,t,e,r)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let a of R(t))!O.call(b,a)&&a!==e&&B(b,a,{get:()=>t[a],enumerable:!(r=I(t,a))\|\|r.enumerable});return b};var N=b=>C(B({},"__esModule",{value:!0}),b);var x={};U(x,{default:()=>L});var n=class{static hexToArray(t){var e=t.match(/.{1,2}/g);return e.map(r=>parseInt(r,16))}static hexToArrayBuffer(t){var e=Uint8Array.from(n.hexToArray(t));return e.buffer}static base64ToArrayBuffer(t){for(var e=window.atob(t),r=e.length,a=new Uint8Array(r),s=0;s<r;s++)a[s]=e.charCodeAt(s);return a.buffer}static base64ToArray(t){for(var e=window.atob(t),r=e.length,a=[],s=0;s<r;s++)a.push(e.charCodeAt(s));return a}static arrayBufferToBase64(t){for(var e="",r=new Uint8Array(t),a=r.byteLength,s=0;s<a;s++)e+=String.fromCharCode(r[s]);return window.btoa(e)}static arrayBufferToBase64URL(t){return n.arrayBufferToBase64(t).replace(/\//g,"_").replace(/\+/g,"-").replace(/=+$/,"")}static stringToArrayBuffer(t){var e=new TextEncoder("utf-8");return e.encode(t)}static stringToBytes(t){for(var e=t.length,r=new Uint8Array(e),a=0;a<e;a++)r[a]=t.charCodeAt(a);return r.subarray(0,a)}static arrayBufferToString(t){var e=new TextDecoder("utf-8");return e.decode(t)}static arrayBufferToHexString(t){for(var e=new Uint8Array(t),r="",a,s=0;s<e.byteLength;s++)a=e[s].toString(16),a.length<2&&(a="0"+a),r+=a;return r}static toHex(t){var e="";try{e=unescape(encodeURIComponent(t)).split("").map(function(r){return r.charCodeAt(0).toString(16)}).join("")}catch{e=t}return e}static bufferSlice(t,e){for(var r=t.byteLength,a=r-e,s=new ArrayBuffer(a),i=new Uint8Array(t),u=new Uint8Array(s),c=0,o=e;o<r;o++)u[c]=i[o],c++;return s}static setCookie(t,e,r){var a=new Date;a.setTime(a.getTime()+r601e3);var s="expires="+a.toUTCString();document.cookie=t+"="+e+";secure;httponly"+s+";path=/"}static encodeBase64url(t){var e=forge.util.bytesToHex(t);if(e.substr(0,2)==="00")var t=forge.util.hexToBytes(e.substr(2));return forge.util.encode64(t).replace(/\//g,"_").replace(/\+/g,"-").replace(/=+$/,"")}static decodeBase64url(e){var e=e.replace(/-/g,"+").replace(/_/g,"/"),r=4-e.length%4;return r!=4&&(e+=Array(r+1).join("=")),forge.util.decode64(e)}static generateJWK(t,e,r,a,s,i,u,c){return r?{kty:"RSA",n:n.encodeBase64url(t),e:n.encodeBase64url(e),d:n.encodeBase64url(r),p:n.encodeBase64url(a),q:n.encodeBase64url(s),dp:n.encodeBase64url(i),dq:n.encodeBase64url(u),qi:n.encodeBase64url(c)}:{kty:"RSA",n:n.encodeBase64url(t),e:n.encodeBase64url(e)}}static addZeroes(t){var e=n.decodeBase64url(t),r=forge.util.bytesToHex(e).substr(0,2);return parseInt(r,16)>=128?forge.util.createBuffer(new Uint8Array([0,0])).bytes()+n.decodeBase64url(t):n.decodeBase64url(t)}static JWKToPrivateRSA(t){var e=forge.asn1,r=e.create(e.Class.UNIVERSAL,e.Type.SEQUENCE,!0,[e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,forge.util.createBuffer(new Uint8Array([0])).bytes()),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.n)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.decodeBase64url(t.e)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.d)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.p)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.q)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.dp)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.dq)),e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,n.addZeroes(t.qi))]),a=forge.asn1.toDer(r).getBytes(),r=e.create(e.Class.UNIVERSAL,e.Type.SEQUENCE,!0,[e.create(e.Class.UNIVERSAL,e.Type.INTEGER,!1,forge.util.createBuffer(new Uint8Array([0])).bytes()),e.create(e.Class.UNIVERSAL,e.Type.SEQUENCE,!0,[e.create(e.Class.UNIVERSAL,e.Type.OID,!1,e.oidToDer(forge.pki.oids.rsaEncryption).getBytes()),e.create(e.Class.UNIVERSAL,e.Type.NULL,!1,"")]),e.create(e.Clas
URL: https://bluefiles.com/js/errors/fr.0.1736549934.js... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript code appears to be a set of error messages and warnings related to a web application's authentication and security features. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or obfuscated code. The code is primarily used for displaying user-friendly error messages to the end-user, which is a common and legitimate practice. While some of the error messages mention technical details about the application's requirements, such as browser compatibility and certificate management, this information is not inherently malicious. Overall, the code seems to be part of a legitimate web application's error handling and user experience functionality." }
window.UnknownError = 'Une erreur inconnue est survenue.'; window.InvalidPasswordError = 'Ce compte ou mot de passe est incorrect.'; window.AuthenticationError = 'L\'authentification a chou.'; window.BadPublicKeys = 'Les cls publiques de votre compte BluePass n\'ont pas pu tre valides, ce qui peut signifier que celui-ci a t corrompu. Vous devez gnrer de nouvelles cls, ce qui peut tre ralis en utilisant la fonctionnalit de "mot de passe oubli".'; window.CGUError = 'Vous devez valider les Conditions Gnrales de Service.'; window.LoginFieldsError = 'Les champs E-mail et Mot de passe sont obligatoires.'; window.EmailFieldError = 'Cette adresse e-mail est invalide.'; window.BrowserCryptoError = '<p>Votre navigateur n\'est pas compatible avec notre service. La solution BlueFiles ncessite l\'utilisation d\'un navigateur supportant certaines fonctionnalits techniques (dont cryptographiques), c\'est pourquoi il est recommand d\'utiliser un navigateur rcent.</p>'; window.BrowserPrivateError = '<p>Le mode priv de ce navigateur est incompatible avec le dchiffrement au niveau local essentiel la confidentialit des changes</p>'; window.PKITimeoutError = 'Le service BluePass "Accs au certificat" n\'a pas rpondu.'; window.PKIVersionError = 'Vous devez mettre jour le service BluePass "Accs au certificat".'; window.PKIPopupError = 'Vous devez autoriser les popups partir de notre site.'; window.PKICertificateError = 'Erreur dans la rcupration du certificat.'; window.PKICertificateUserError = 'Ce certificat n\'est pas associ cet utilisateur.'; window.PKICertificatesError = 'Erreur dans la rcupration des certificats disponibles.'; window.PKINoCertificatesError = 'Il n\'y a aucun certificat disponible.'; window.PKIServerKeyError = 'La cl du serveur n\'a pas pu tre rcupre ou sa signature est invalide.'; window.PKISignError = 'Le service BluePass "Accs au certificat" n\'a pas russi signer les donnes.'; window.PKIDecryptError = 'Le service BluePass "Accs au certificat" n\'a pas russi dchiffrer les donnes.'; window.PKIOriginError = 'L\'origine du service BluePass "Accs au certificat" est invalide.'; window.CreatePasswordValidationError = 'La validation de votre compte a chou. Essayez de rafraichir la page.'; window.BrandingError = { requiredLogo: 'Veuillez slectionner une image pour le logo.', requiredLoginBackgroundImage: 'Veuillez slectionner une image de fond pour l\'cran de connexion.', imageSize: '<strong>Taille invalide !</strong> La taille d\'image autorise est de 1024x1024px max.', imageFormat: '<strong>Format invalide !</strong> Les formats autoriss sont JPG JPEG PNG SVG.' }; window.BrowserMicrosoftPrivateWarning = 'Le mode priv de ce navigateur est limit par onglets. Vous ne serez pas en mesure d\'ouvrir les liens dans de nouveaux onglets / fentres sans obtenir une erreur.';
URL: https://bluefiles.com/front/js/bluefiles-create-pa... Model: Joe Sandbox AI	{ "risk_score": 5, "reasoning": "The provided JavaScript snippet appears to be a part of a larger application that handles user authentication and account management. While it does not exhibit any clear signs of malicious behavior, there are a few moderate-risk indicators that warrant further review: 1. External Data Transmission: The script sends user data (email, token, SSO parameters) to external domains (BluefilesClient, SSO servers) without explicit transparency. 2. Fallback Domains: The script uses multiple SSO servers, some of which may be of unknown or dubious reputation. 3. Aggressive DOM Manipulation: The script extensively manipulates the DOM, including clearing and modifying elements, which could potentially impact the user experience or introduce vulnerabilities. Additionally, the script includes some legacy practices, such as the use of the `XDomainRequest` API, which pose minor risks but are not inherently malicious. Overall, the script appears to be part of a legitimate application, but the lack of clear transparency around data handling and the use of potentially untrusted domains warrant further investigation to ensure the security and privacy of user data." }
var vm=new Vue({el:"main",mixins:[formDataMixin,passwordCheckMixin,PKIMixin,LanguageSelectorMixin],data:{client:new BluefilesClient(data.email,apiSettings.key,apiSettings.url),cgs:data.cgs\|\|!1,newsletter:data.newsletter\|\|!1,email:data.email,token:null,createaccount:data.createaccount\|\|!1,sso:!1,ssoParams:null,ssoAccessTokenInfos:null,ssoServers:[],ssoServerID:null,ssoServerSelected:null,ssoDialog:!1,ssoPromiseHandle:null,ssoServerHasAesKeyStorage:!1,mandatorySSO:data.mandatory_sso\|\|!1,ssoMatchAddress:data.sso_match_address\|\|!1,selectableTeams:data.selectable_teams\|\|[],selectedTeam:null,BluefilesClient:BluefilesClient},created:function(){this.translateCGS=!this.cgs,data.token&&(this.token=data.token,delete data.token),data.sso_servers&&(this.ssoServers=data.sso_servers,delete data.sso_servers),data.mandatory_server&&(this.ssoServerID=data.mandatory_server.id,this.ssoServerHasAesKeyStorage=data.mandatory_server.has_aes_key_storage,delete data.mandatory_server),this.$i18n.mergeLocaleMessage("de",{bluepass_sso_mode:"Konto durch SSO gesichert",bluepass_sso_subtitle:"Whlen Sie den SSO-Dienst aus, der zum Schutz Ihres Kontos verwendet werden soll :",bluepass_sso_subtitle2:"Sie mssen sich mit dem fr Ihr Team definierten SSO-Dienst verbinden",connect:"Einloggen",sso:{selected_server:"Mit diesem SSO-Server",team_server:"Sie verwenden den fr Ihr Team definierten SSO-Server",warning:"{0}, eine Ende-zu-Ende-Verschlsselung ist nur gewhrleistet, wenn bei bertragungen ein zustzliches Passwort verwendet wird."}}),this.$i18n.mergeLocaleMessage("en",{bluepass_sso_mode:"Account secured by SSO",bluepass_sso_subtitle:"Select the SSO service to use to protect your account :",bluepass_sso_subtitle2:"You must connect to the SSO service defined for your team",connect:"Log In",sso:{selected_server:"With this SSO server",team_server:"You will use the SSO server defined for your team",warning:"{0}, end-to-end encryption will only be guaranteed if an additional password is applied on transfers."}}),this.$i18n.mergeLocaleMessage("es",{bluepass_sso_mode:"Cuenta asegurada por SSO",bluepass_sso_subtitle:"Seleccione el servicio de SSO a usar para proteger su cuenta :",bluepass_sso_subtitle2:"Debe conectarse al servicio SSO definido para su equipo",connect:"Conectarse",sso:{selected_server:"Con este servidor SSO",team_server:"Usars el servidor SSO definido para tu equipo",warning:"{0}, el cifrado de extremo a extremo se garantizar solo si se aplica una contrasea adicional en las transferencias."}}),this.$i18n.mergeLocaleMessage("fr",{bluepass_sso_mode:"Protection par SSO",bluepass_sso_subtitle:"Slectionnez le service SSO utiliser pour protger votre compte :",bluepass_sso_subtitle2:"Vous devez vous identifier sur le service SSO dfini pour votre quipe",connect:"Se connecter",sso:{selected_server:"Avec ce serveur SSO",team_server:"Vous allez utiliser le serveur SSO dfini pour votre quipe",warning:"{0}, le chiffrement de bout en bout sera garanti seulement si un mot de passe supplmentaire est appliqu sur les transferts."}}),this.mandatorySSO&&this.useSSO()},watch:{"$i18n.locale":function(e){this.language!==e&&(this.$i18n.locale=this.language,this.$refs.sso&&this.$refs.sso.$i18n&&(this.$refs.sso.$i18n.locale=this.language))}},methods:{copyFingerprint:function(){var e=document.createElement("textArea");e.value="0x"+this.client.publicKeyFingerprint,document.body.appendChild(e),e.focus(),e.select(),document.execCommand("copy"),document.body.removeChild(e)},onSSOCancel:function(){this.ssoPromiseHandle.reject("")},onSSOSuccess:function(e){e.user_infos.lastName&&(data.lastName=e.user_infos.lastName),e.user_infos.firstName&&(data.firstName=e.user_infos.firstName),this.ssoParams=e.sso_params,this.ssoAccessTokenInfos=e.access_token_infos,this.ssoPromiseHandle.resolve()},submit:function(e){var s,t=this;this.cgs?(this.sendingForm=!0,this.error="",this.pki?(delete window.data.passwordDigest,delete window.data.encryption,delete window.data.signing,s=null===this.c
URL: https://bluefiles.com/js/lib/axios.min.0.173654993... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script is a minified version of the Axios library, which is a widely used HTTP client for making requests in JavaScript. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The script is intended for legitimate use in web applications for handling HTTP requests." }
/* axios v0.21.0 \| (c) 2020 by Matt Zabriskie / !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.axios=t():e.axios=t()}(this,function(){return function(e){function t(r){if(n[r])return n[r].exports;var o=n[r]={exports:{},id:r,loaded:!1};return e[r].call(o.exports,o,o.exports,t),o.loaded=!0,o.exports}var n={};return t.m=e,t.c=n,t.p="",t(0)}([function(e,t,n){e.exports=n(1)},function(e,t,n){"use strict";function r(e){var t=new i(e),n=s(i.prototype.request,t);return o.extend(n,i.prototype,t),o.extend(n,t),n}var o=n(2),s=n(3),i=n(4),a=n(22),u=n(10),c=r(u);c.Axios=i,c.create=function(e){return r(a(c.defaults,e))},c.Cancel=n(23),c.CancelToken=n(24),c.isCancel=n(9),c.all=function(e){return Promise.all(e)},c.spread=n(25),e.exports=c,e.exports.default=c},function(e,t,n){"use strict";function r(e){return"[object Array]"===R.call(e)}function o(e){return"undefined"==typeof e}function s(e){return null!==e&&!o(e)&&null!==e.constructor&&!o(e.constructor)&&"function"==typeof e.constructor.isBuffer&&e.constructor.isBuffer(e)}function i(e){return"[object ArrayBuffer]"===R.call(e)}function a(e){return"undefined"!=typeof FormData&&e instanceof FormData}function u(e){var t;return t="undefined"!=typeof ArrayBuffer&&ArrayBuffer.isView?ArrayBuffer.isView(e):e&&e.buffer&&e.buffer instanceof ArrayBuffer}function c(e){return"string"==typeof e}function f(e){return"number"==typeof e}function p(e){return null!==e&&"object"==typeof e}function d(e){if("[object Object]"!==R.call(e))return!1;var t=Object.getPrototypeOf(e);return null===t\|\|t===Object.prototype}function l(e){return"[object Date]"===R.call(e)}function h(e){return"[object File]"===R.call(e)}function m(e){return"[object Blob]"===R.call(e)}function y(e){return"[object Function]"===R.call(e)}function g(e){return p(e)&&y(e.pipe)}function v(e){return"undefined"!=typeof URLSearchParams&&e instanceof URLSearchParams}function x(e){return e.replace(/^\s/,"").replace(/\s*$/,"")}function w(){return("undefined"==typeof navigator\|\|"ReactNative"!==navigator.product&&"NativeScript"!==navigator.product&&"NS"!==navigator.product)&&("undefined"!=typeof window&&"undefined"!=typeof document)}function b(e,t){if(null!==e&&"undefined"!=typeof e)if("object"!=typeof e&&(e=[e]),r(e))for(var n=0,o=e.length;n<o;n++)t.call(null,e[n],n,e);else for(var s in e)Object.prototype.hasOwnProperty.call(e,s)&&t.call(null,e[s],s,e)}function E(){function e(e,n){d(t[n])&&d(e)?t[n]=E(t[n],e):d(e)?t[n]=E({},e):r(e)?t[n]=e.slice():t[n]=e}for(var t={},n=0,o=arguments.length;n<o;n++)b(arguments[n],e);return t}function C(e,t,n){return b(t,function(t,r){n&&"function"==typeof t?e[r]=S(t,n):e[r]=t}),e}function j(e){return 65279===e.charCodeAt(0)&&(e=e.slice(1)),e}var S=n(3),R=Object.prototype.toString;e.exports={isArray:r,isArrayBuffer:i,isBuffer:s,isFormData:a,isArrayBufferView:u,isString:c,isNumber:f,isObject:p,isPlainObject:d,isUndefined:o,isDate:l,isFile:h,isBlob:m,isFunction:y,isStream:g,isURLSearchParams:v,isStandardBrowserEnv:w,forEach:b,merge:E,extend:C,trim:x,stripBOM:j}},function(e,t){"use strict";e.exports=function(e,t){return function(){for(var n=new Array(arguments.length),r=0;r<n.length;r++)n[r]=arguments[r];return e.apply(t,n)}}},function(e,t,n){"use strict";function r(e){this.defaults=e,this.interceptors={request:new i,response:new i}}var o=n(2),s=n(5),i=n(6),a=n(7),u=n(22);r.prototype.request=function(e){"string"==typeof e?(e=arguments[1]\|\|{},e.url=arguments[0]):e=e\|\|{},e=u(this.defaults,e),e.method?e.method=e.method.toLowerCase():this.defaults.method?e.method=this.defaults.method.toLowerCase():e.method="get";var t=[a,void 0],n=Promise.resolve(e);for(this.interceptors.request.forEach(function(e){t.unshift(e.fulfilled,e.rejected)}),this.interceptors.response.forEach(function(e){t.push(e.fulfilled,e.rejected)});t.length;)n=n.then(t.shift(),t.shift());return n},r.prototype.getUri=function(e){return e=u(this.defaults,e),s
URL: https://bluefiles.com/js/lib/webcrypto-shim.min.0.... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script is a Web Cryptography API shim, which provides polyfills for cryptographic functions. It does not exhibit any high-risk behaviors such as dynamic code execution or data exfiltration. The use of base64 encoding and decoding functions is typical for cryptographic operations and does not indicate malicious intent. The script does not interact with external domains or perform aggressive DOM manipulations, thus posing low risk." }
/! License is available inside /js/lib/licenses.txt / /** * @file Web Cryptography API shim * @author Artem S Vybornov <vybornov@gmail.com> * @license MIT */ var webCryptoShim=function(e){"use strict";if("function"!=typeof Promise)throw"Promise support required";var l,r,t,y,f,s,p,o,h=e.crypto\|\|e.msCrypto;function g(e){return btoa(e).replace(/\=+$/,"").replace(/\+/g,"-").replace(/\//g,"_")}function A(e){return e=(e+="===").slice(0,-e.length%4),atob(e.replace(/-/g,"+").replace(/_/g,"/"))}function w(e){for(var r=new Uint8Array(e.length),t=0;t<e.length;t++)r[t]=e.charCodeAt(t);return r}function m(e){return e instanceof ArrayBuffer&&(e=new Uint8Array(e)),String.fromCharCode.apply(String,e)}function b(e){var r={name:(e.name\|\|e\|\|"").toUpperCase().replace("V","v")};switch(r.name){case"SHA-1":case"SHA-256":case"SHA-384":case"SHA-512":break;case"AES-CBC":case"AES-GCM":case"AES-KW":e.length&&(r.length=e.length);break;case"HMAC":e.hash&&(r.hash=b(e.hash)),e.length&&(r.length=e.length);break;case"RSAES-PKCS1-v1_5":e.publicExponent&&(r.publicExponent=new Uint8Array(e.publicExponent)),e.modulusLength&&(r.modulusLength=e.modulusLength);break;case"RSASSA-PKCS1-v1_5":case"RSA-OAEP":e.hash&&(r.hash=b(e.hash)),e.publicExponent&&(r.publicExponent=new Uint8Array(e.publicExponent)),e.modulusLength&&(r.modulusLength=e.modulusLength);break;default:throw new SyntaxError("Bad algorithm name")}return r}function S(e){return{HMAC:{"SHA-1":"HS1","SHA-256":"HS256","SHA-384":"HS384","SHA-512":"HS512"},"RSASSA-PKCS1-v1_5":{"SHA-1":"RS1","SHA-256":"RS256","SHA-384":"RS384","SHA-512":"RS512"},"RSAES-PKCS1-v1_5":{"":"RSA1_5"},"RSA-OAEP":{"SHA-1":"RSA-OAEP","SHA-256":"RSA-OAEP-256"},"AES-KW":{128:"A128KW",192:"A192KW",256:"A256KW"},"AES-GCM":{128:"A128GCM",192:"A192GCM",256:"A256GCM"},"AES-CBC":{128:"A128CBC",192:"A192CBC",256:"A256CBC"}}[e.name][(e.hash\|\|{}).name\|\|e.length\|\|""]}function d(r){var t={kty:(r=r instanceof ArrayBuffer\|\|r instanceof Uint8Array?JSON.parse(decodeURIComponent(escape(m(r)))):r).kty,alg:r.alg,ext:r.ext\|\|r.extractable};switch(t.kty){case"oct":t.k=r.k;case"RSA":["n","e","d","p","q","dp","dq","qi","oth"].forEach(function(e){e in r&&(t[e]=r[e])});break;default:throw new TypeError("Unsupported key type")}return t}function k(e,r){if(e instanceof ArrayBuffer&&(e=new Uint8Array(e)),(r=r\|\|{pos:0,end:e.length}).end-r.pos<2\|\|r.end>e.length)throw new RangeError("Malformed DER");var t=e[r.pos++],n=e[r.pos++];if(128<=n){if(n&=127,r.end-r.pos<n)throw new RangeError("Malformed DER");for(var o=0;n--;)o<<=8,o\|=e[r.pos++];n=o}if(r.end-r.pos<n)throw new RangeError("Malformed DER");switch(t){case 2:i=e.subarray(r.pos,r.pos+=n);break;case 3:if(e[r.pos++])throw new Error("Unsupported bit string");n--;case 4:i=new Uint8Array(e.subarray(r.pos,r.pos+=n)).buffer;break;case 5:i=null;break;case 6:var a=btoa(m(e.subarray(r.pos,r.pos+=n)));if(!(a in s))throw new Error("Unsupported OBJECT ID "+a);i=s[a];break;case 48:for(var i=[],u=r.pos+n;r.pos<u;)i.push(k(e,r));break;default:throw new Error("Unsupported DER tag 0x"+t.toString(16))}return i}function c(e,r){var t=0,n=0,o=(r=r\|\|[]).length+2;if(r.push(0,0),e instanceof Uint8Array){t=2,n=e.length;for(var a=0;a<n;a++)r.push(e[a])}else if(e instanceof ArrayBuffer){t=4,n=e.byteLength,e=new Uint8Array(e);for(a=0;a<n;a++)r.push(e[a])}else if(null===e)t=5,n=0;else if("string"==typeof e&&e in p){var i=w(atob(p[e])),t=6;n=i.length;for(a=0;a<n;a++)r.push(i[a])}else if(e instanceof Array){for(a=0;a<e.length;a++)c(e[a],r);t=48,n=r.length-o}else{if(!("object"==typeof e&&3===e.tag&&e.value instanceof ArrayBuffer))throw new Error("Unsupported DER value "+e);t=3,n=(e=new Uint8Array(e.value)).byteLength,r.push(0);for(a=0;a<n;a++)r.push(e[a]);n++}if(128<=n){var u=n,n=4;for(r.splice(o,0,u>>24&255,u>>16&255,u>>8&255,255&u);1<n&&!(u>>24);)u<<=8,n--;n<4&&r.splice(o,4-n),n\|=128}return r.splice(o-2,2,t,n),r}function K(e,r,t,n){Object.defineProperties(this,{_key:{value:e},type:{value:e.type,enumerable:!0},extractable:{value:void 0===t?e.extractab
URL: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To view secured document, click here", "prominent_button_name": "unknown", "text_input_field_labels": [ "email", "bluefiles_select_team" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d Model: Joe Sandbox AI	{ "brands": [ "BluePass" ] }
	{ "brands": [ "BluePass" ] }
URL: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d Model: Joe Sandbox AI	```json{ "legit_domain": "bluepass.com", "classification": "unknown", "reasons": [ "The brand 'BluePass' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'bluefiles.com' does not match the expected domain for 'BluePass', which would likely be 'bluepass.com'.", "The URL 'bluefiles.com' could be a legitimate domain for a different service, but it does not directly associate with 'BluePass'.", "The presence of input fields like 'email' and 'bluefiles_select_team' could be legitimate for a service, but without a clear brand association, it raises suspicion.", "No obvious misspellings or unusual characters in the URL, but the domain does not match the brand." ], "riskscore": 7}
URL: bluefiles.com Brands: BluePass Input Fields: email, bluefiles_select_team
URL: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "BlueFiles utilise l'authentification BluePass pour garantir votre identit numrique.", "prominent_button_name": "VALIDER", "text_input_field_labels": [ "Saisissez votre mot de passe", "Confirmez votre mot de passe" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://bluefiles.com/js/vue/bluefiles-vue.0.17365... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script appears to be a part of a Vue.js library, which is a popular JavaScript framework. There are no high-risk indicators such as dynamic code execution or data exfiltration. The script does not show any signs of obfuscation or suspicious behavior. It seems to be a legitimate use of a JavaScript library for UI components, with no malicious intent." }
/! For license information please see bluefiles-vue.js.LICENSE.txt / !function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define("Vue",[],t):"object"==typeof exports?exports.Vue=t():e.Vue=t()}(self,(function(){return function(){var e,t,n,r,o={37890:function(e,t,n){"use strict";n.d(t,{Z:function(){return nt}});var r={};n.r(r),n.d(r,{easeInCubic:function(){return I},easeInOutCubic:function(){return N},easeInOutQuad:function(){return R},easeInOutQuart:function(){return B},easeInOutQuint:function(){return z},easeInQuad:function(){return E},easeInQuart:function(){return D},easeInQuint:function(){return V},easeOutCubic:function(){return F},easeOutQuad:function(){return M},easeOutQuart:function(){return U},easeOutQuint:function(){return H},linear:function(){return L}});n(89554),n(26699),n(32023),n(54747);var o=n(70538),i=n(54496);n(30489),n(68304);var a={breakpoint:{mobileBreakpoint:1264,scrollBarWidth:16,thresholds:{xs:600,sm:960,md:1280,lg:1920}},icons:{iconfont:"mdi",values:{}},lang:{current:"en",locales:{en:{badge:"Badge",close:"Close",dataIterator:{noResultsText:"No matching records found",loadingText:"Loading items..."},dataTable:{itemsPerPageText:"Rows per page:",ariaLabel:{sortDescending:"Sorted descending.",sortAscending:"Sorted ascending.",sortNone:"Not sorted.",activateNone:"Activate to remove sorting.",activateDescending:"Activate to sort descending.",activateAscending:"Activate to sort ascending."},sortBy:"Sort by"},dataFooter:{itemsPerPageText:"Items per page:",itemsPerPageAll:"All",nextPage:"Next page",prevPage:"Previous page",firstPage:"First page",lastPage:"Last page",pageText:"{0}-{1} of {2}"},datePicker:{itemsSelected:"{0} selected",nextMonthAriaLabel:"Next month",nextYearAriaLabel:"Next year",prevMonthAriaLabel:"Previous month",prevYearAriaLabel:"Previous year"},noDataText:"No data available",carousel:{prev:"Previous visual",next:"Next visual",ariaLabel:{delimiter:"Carousel slide {0} of {1}"}},calendar:{moreEvents:"{0} more"},fileInput:{counter:"{0} files",counterSize:"{0} files ({1} in total)"},timePicker:{am:"AM",pm:"PM"},pagination:{ariaLabel:{wrapper:"Pagination Navigation",next:"Next page",previous:"Previous page",page:"Goto Page {0}",currentPage:"Current Page, Page {0}"}},rating:{ariaLabel:{icon:"Rating {0} of {1}"}}}},t:void 0},rtl:!1,theme:{dark:!1,default:"light",disable:!1,options:{cspNonce:void 0,customProperties:void 0,minifyTheme:void 0,themeCache:void 0,variations:!0},themes:{light:{primary:"#1976D2",secondary:"#424242",accent:"#82B1FF",error:"#FF5252",info:"#2196F3",success:"#4CAF50",warning:"#FB8C00"},dark:{primary:"#2196F3",secondary:"#424242",accent:"#FF4081",error:"#FF5252",info:"#2196F3",success:"#4CAF50",warning:"#FB8C00"}}}},c=n(95940);function u(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}var s=function(){function e(){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,e),this.framework={}}var t,n,r;return t=e,(n=[{key:"init",value:function(e,t){}}])&&u(t.prototype,n),r&&u(t,r),e}();function f(e){return(f="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function l(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0\|\|(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function d(e,t){return(d=Object.setPrototypeOf\|\|function(e,t){return e.__proto__=t,e})(e,t)}function p(e){var t=function(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construc
URL: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d Model: Joe Sandbox AI	{ "brands": [ "BluePass" ] }
	{ "brands": [ "BluePass" ] }
URL: https://bluefiles.com/fr/reader/document/2c33782e98658214c7dff875dd234fc3b9b9a60915ac1685fe35abcc657c139d Model: Joe Sandbox AI	```json{ "legit_domain": "bluepass.com", "classification": "unknown", "reasons": [ "The brand 'BluePass' is not widely recognized, making it difficult to classify as 'known' or 'wellknown'.", "The URL 'bluefiles.com' does not match the expected domain for 'BluePass', which would likely be 'bluepass.com'.", "The URL 'bluefiles.com' contains a different word 'files' instead of 'pass', which is suspicious and could indicate phishing.", "The input fields are in French, which may not align with the expected language for the brand, adding to the suspicion." ], "riskscore": 8}
URL: bluefiles.com Brands: BluePass Input Fields: Saisissez votre mot de passe, Confirmez votre mot de passe

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1d5a0743-f15a-4f60-829d-e087def80589.tmp

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58057
Entropy (8bit):	6.106055894299626
Encrypted:	false
SSDEEP:
MD5:	2C2EFB899F9E0FBB82E3A6B476CA0CD8
SHA1:	73D072F6CDD6C78E86C865181E6A4C5C16E49968
SHA-256:	5B9B358ECB978DE3AAB179C79D5BB8F167C68725FD207A2C494F05C847DA1C8A
SHA-512:	58E88B0AE82399CF106ADAF3E0712F8D57CA615FFBF4938D4DC7C6B91A9F0EE97A452B191F06013A123D2B64D49FC393645B16B93B193B7C7C50A846D9E3E2AC
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6787D94D-978.pma

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.024032726989256053
Encrypted:	false
SSDEEP:
MD5:	804B6B84ED278DF0A928CA5D290676AD
SHA1:	16255DCC0ABAB6FE01D336D8BF1F548BA25EB569
SHA-256:	94358EB9B060DBE0B91A89EC2B83D60305E1E6E6F21F2E5A859CB17F32F2DDDC
SHA-512:	F03E71474B740CAC7D0B7F7A481D64C228C7DF3DF5AEE53F0495BA3426CFC15B9FB253C9A47BE20099AAAF9956F7B5F7BBB1A2A3DA622FEE936993F8A62085E1
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................@...@..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64".en-GB...Windows NT..10.0.190452(..x86_64..?........".jwyira20,1...x86_64J....?.^o..P....2.................>.2..."..:...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.0882503192190573
Encrypted:	false
SSDEEP:
MD5:	4AF6B3A6CB76D53D5853E4F070E22844
SHA1:	0289FE4362C7CA36C900CA95464701E79FF4A8FE
SHA-256:	517AB2BE6929E4628629514949AC8EAAA55BB77DC53DF0B4753EC1C6D46AE11E
SHA-512:	650D77D16542A84028F2B343B8CCF5502FCAC94268332BFABC843A305DEDED830879444CAD037165DBEC0391D03929838BA1A6C38E79FE6860B71C8FADAB5542
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................z....K..s...x.................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7dc5f755-0f90-4102-bc8e-37d02917bdc7............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2C2EFB899F9E0FBB82E3A6B476CA0CD8
SHA1:	73D072F6CDD6C78E86C865181E6A4C5C16E49968
SHA-256:	5B9B358ECB978DE3AAB179C79D5BB8F167C68725FD207A2C494F05C847DA1C8A
SHA-512:	58E88B0AE82399CF106ADAF3E0712F8D57CA615FFBF4938D4DC7C6B91A9F0EE97A452B191F06013A123D2B64D49FC393645B16B93B193B7C7C50A846D9E3E2AC
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"8ABCE35666CBACA121128B98C75E78308AAC1CE803625FAFB4A7AFA722C77CA4\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:
MD5:	E9E365607374115B92E4ABE4B9628101
SHA1:	D5054EA9B22317DCA83801EB3586017BFCC0E2A8
SHA-256:	5CD2C4D9F13524923046198C92213691539407E04FA520CDAE9EADE1BAD3D91D
SHA-512:	A84D65ED53E43883E5ECB7848FBD48F5305A63E6975E6AF480CF85532879720061106BE54F2A5888EBC3569F7123081A0E6EB48CCB8D7DBA3E1DA1C8A3C50401
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":3}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 14:49:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991311864209686
Encrypted:	false
SSDEEP:
MD5:	0E42EAAFBF924FD231CFE1890DE31867
SHA1:	90CE9C99175B53A8BE02C9C895FD1A0A6D3CF29E
SHA-256:	E3A166353F16D8E7D502DB004A6922BEEA1CC8F1B12AA1C7EBACB1292E3F0ECA
SHA-512:	960784303EA8907D235920B2B62B7A870797E2DCA9986C8ED5D463BBC697A4C833579D4F8878215EEC113A8563E4100E23787DC2B590DC30897BF651C30563F2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,........eg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z"~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z"~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z"~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z#~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 14:49:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.005043635328221
Encrypted:	false
SSDEEP:
MD5:	F8132A72C7E9155CC2E8A9DB1DF19A58
SHA1:	AB332BEB50F3FFB9DB87784EEDE000C691A6B671
SHA-256:	D01F77066ADC2C3D16204AC5AF8EE171D49AC566BBE00ABD412F798A97C5B340
SHA-512:	7F25D9F9440F5EA3572E41FFDF861675A47A416D00BB4B08EE1ACD8CD3FECFE4061719C06055E3EE85AB6A9A199A429C348675FAB2027443E50D56283FC29ADD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,..../...eg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z"~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z"~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z"~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z#~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.016684628481291
Encrypted:	false
SSDEEP:
MD5:	656B4EF1E8CD4EEFD245DE93E84C3FAC
SHA1:	F56CA51C7E8E57755945D1C6F21B02BD754588AA
SHA-256:	7244986BDA0E200A1E8D2B87A08E2DFA0707E6B8CDEAF48812D4F4FCDE62019A
SHA-512:	276C3EB467C4DF0215AB8FC8686DB61AFA56A34660393221F5F6C8C83D23573D191FFB8815FABAFEC782BBB5B7576C8EA7D67EA01A2261065289C370620190DD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z"~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z"~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z"~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 14:49:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.003502630266564
Encrypted:	false
SSDEEP:
MD5:	550CCD64A36C051DFDD208ECE51F07A9
SHA1:	7F6A26C032033B065355E1CF28534FD9457DB02C
SHA-256:	0C22F3F56359A92E7FBFBE83259A94B3F9DB139EE7FB50BA86A20CF569784BDC
SHA-512:	E58BE2E53D52260792937B220C8BF52110DEE5E11E630A74666159E6AB6F1A590E81AAD0BF2DD9195AF766376810C75C24A4B1F923195A5BED96DC1744D8EBC9
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Mz.eg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z"~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z"~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z"~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z#~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 14:49:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9934777340566328
Encrypted:	false
SSDEEP:
MD5:	60D990CED2F0376FF912BC8FC22D5F01
SHA1:	DECDF4A4419E3C9B3E8A4D71BCE3038CEF79AC99
SHA-256:	16214E0EEFEF95B3EDDF4039C4FE5C65202A558D70871C6FBC2B4475F902C55B
SHA-512:	38BBB55D2A703DEB983ABBB0E520F405E5EF6F874FE8C26E236C277A531C71FAABD4A8E48263FA5AD3C7C2020F9A009069E19E26AFF3B4284B97DC1F8BE4B9AD
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....&..eg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z"~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z"~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z"~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z#~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 14:49:05 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.999591742639472
Encrypted:	false
SSDEEP:
MD5:	2467884CADF6BDED7DB66139846C68E0
SHA1:	5699DBB5D1E3ADB93A966B041EFBC30E9F7CFD45
SHA-256:	0C3F3B987F10FA8138469F6F0966FA8DBCB1BEC56540F8701DD6EAA68CE807AC
SHA-512:	911E199BC41297B81FA9F6884DE1350BD21488BE3793DC1A77A979F8B835B3A2A98EE3ECD8C2702F673D6E71A93FD6D0AEDCBD955C8C5EAEAAE570CCA7B24E9E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....;p.eg..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I/Z.~....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z"~....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z"~....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z"~..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z#~...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............q......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info