Edit tour

Windows Analysis Report
https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y

Overview

General Information

Sample URL:	https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y
Analysis ID:	1559375

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 5988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2728 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,948045872538344977,11462452541051028269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y

HTTP Parser: Title: Portale gare d'appalto|Riattivazione utente does not match URL

Source: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y

HTTP Parser: <input type="password" .../> found

Source: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y	HTTP Parser: No <meta name="author".. found
Source: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y	HTTP Parser: No <meta name="author".. found

Source: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y	HTTP Parser: No <meta name="copyright".. found
Source: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.17:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.158:443 -> 192.168.2.17:49767 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 28MB

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: enea.ubuy.cineca.it
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.17:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.17:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.158:443 -> 192.168.2.17:49767 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@17/37@6/112

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,948045872538344977,11462452541051028269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,948045872538344977,11462452541051028269,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ubuyfe-prod-1.cineca.it	130.186.27.74	true	false	unknown
www.google.com	142.250.185.196	true	false	high
enea.ubuy.cineca.it	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	www.google.com	United States	15169	GOOGLEUS	false
130.186.27.74	ubuyfe-prod-1.cineca.it	Italy	137	ASGARRConsortiumGARREU	false
216.58.206.67	unknown	United States	15169	GOOGLEUS	false
142.250.184.238	unknown	United States	15169	GOOGLEUS	false
142.250.186.42	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559375
Start date and time:	2024-11-20 12:56:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@17/37@6/112

Warnings

Exclude process from analysis (whitelisted): TextInputHost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.46, 108.177.15.84, 216.58.206.67, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y

LLM Input / Output

Input	Output
URL: https://enea.ubuy.cineca.it Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://enea.ubuy.cineca.it
URL: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y Model: Joe Sandbox AI	```json { "contains_trigger_text": true, "trigger_text": "Clicca per iniziare", "prominent_button_name": "SALVA", "text_input_field_labels": [ "Password", "Conferma Password" ], "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y Model: Joe Sandbox AI	```json { "brands": [ "ENEA" ] }
	```json { "brands": [ "ENEA" ] }
URL: https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y Model: Joe Sandbox AI	```json{ "legit_domain": "enea.it", "classification": "known", "reasons": [ "The brand 'ENEA' is known and associated with the domain 'enea.it'.", "The URL 'enea.ubuy.cineca.it' contains multiple subdomains, which can be legitimate if 'ubuy' and 'cineca' are trusted partners or services.", "The presence of input fields for 'Password' and 'Conferma Password' suggests a login or registration page, which is common for phishing sites.", "The domain 'cineca.it' is a legitimate domain associated with CINECA, a consortium of Italian universities and research institutions, which may have legitimate collaborations with ENEA.", "The use of subdomains 'ubuy' and 'enea' could be legitimate if they are part of a service or project hosted by CINECA, but without further context, it raises suspicion." ], "riskscore": 5}
URL: enea.ubuy.cineca.it Brands: ENEA Input Fields: Password, Conferma Password

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 10:57:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.984010915513388
Encrypted:	false
SSDEEP:
MD5:	4D6512F02D581A6D5A3CACB5A70B6E04
SHA1:	A494FEB8C53EF97BFEEA48FCD7F4286F88FC6AA5
SHA-256:	874C8A27124FB2C50DAE40770EFC1F60CD840733A2C585EC044BE068314303E0
SHA-512:	A15C8F10F943E82420CBE030B9C08CF8CDC5C740E6066B00BB8E4C0068997B767B4E2C43D3EA93E7DC5960A0198E74B7F44E648549FF328008AE0FE5C2CE6726
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....~.\C;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ItY!_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY_....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VtY_....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VtY_...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VtY,_...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 10:57:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000732286009323
Encrypted:	false
SSDEEP:
MD5:	A14A2497D22BF321A3505E25EF8EF16D
SHA1:	CACBE692DBECA190961A7A18EBB907032215E8EB
SHA-256:	0E6553787A3F3D90969C001839EB46760A4176937CCEFA2717EFF0EAA65DEEFF
SHA-512:	16FBB4939F8FD6D9BA1BE608229A6590D9A61A2DE2CFC28692D52501DC77F9F1C79839D538E6F7AD9D61BECD5772CB1B6269E5C023EB93572E7CA4269C60AA1F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.......\C;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ItY!_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY_....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VtY_....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VtY_...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VtY,_...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.012955929739299
Encrypted:	false
SSDEEP:
MD5:	BEE1CB199E427393577A613F503D1D0C
SHA1:	8FCF9BB37DA2A12B8D9F316711D590B873B0BD32
SHA-256:	A0F7D2B5719FD812FBE16CEBF4CC6021BC9B07D839810E053F0095B896C680C2
SHA-512:	4780C761990B6C8E71AAF6E4BF094226508EB78BF5120AD40FFB2D850A8B8E6EB176802558791AE49D1FE05F5A9774594B001ABFF1F045CEB2DF702DE0FB5B99
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ItY!_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY_....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VtY_....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VtY_...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 10:57:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9975628462197235
Encrypted:	false
SSDEEP:
MD5:	A2CC1196DD33B8F46883C8DD6A98B7FF
SHA1:	5D6A6BAE2BD5ABB1B8372FDA1D159A6D16B0324D
SHA-256:	0D4BFDED6D0B92AE5C44E94386DE221D6F64B600018B641D8312DDFE76EB64FF
SHA-512:	56C7EB5436362FC1223E7EF151BAEEFEF38EA9405FCD77BCFF259CAC53ADF985D2F5B334822C65EFA586C2F76F1836E8C23CB8C0FC2E0BE41AF7031BDC3DBF4A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....q.z\C;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ItY!_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY_....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VtY_....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VtY_...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VtY,_...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 10:57:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9861001787499175
Encrypted:	false
SSDEEP:
MD5:	7F0B263DA6B437951704D6ED285C56A3
SHA1:	6D4706CC7436612BC8B7C7070FEB58CAFC4F6BC5
SHA-256:	556066F1C58A926453944222B717160162EB439210DF1F75C05CE6BDF844C3CC
SHA-512:	56FDC165CCCB251125EB7AFEE9852B5EB56830E003A2E0DAB8F9AFC20EF3DB44AF24C7A43F7C06B16030A29CA3D0BA0148CB3297B6ECFE5E2C020D7A43ED89E4
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....f.\C;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ItY!_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY_....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VtY_....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VtY_...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VtY,_...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 10:57:23 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996536924438852
Encrypted:	false
SSDEEP:
MD5:	A017A45D1AA75F1735EBEF8FEE4759B9
SHA1:	67597B9F3577040E304C3049CEB17C89F628B2E3
SHA-256:	C8A766FD9349AB86FC623427ABE0B10106A3C1AD7C4086BA0B1EA58F9D33A409
SHA-512:	71AD8FD92CD5D211BD9E21FC8F94E7EF0AC788AF9BF62591FB34B2602DF9662C73FFCB050C0913C5DBB617B19671689E935CBFDE8105C33CC51B6E16D46012FB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Bh\C;......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.ItY!_....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY_....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.VtY_....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.VtY_...........................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VtY,_...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............f.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	4.704643394292357
Encrypted:	false
SSDEEP:
MD5:	CD1F66226F7C10F7156325F6F5A27592
SHA1:	785DD1853732DC148312E9118FB72C04F10F7536
SHA-256:	C9F7E5FD8A9E1C25AD68F9E1F208962863851F97DE2B2259A26DDBFF769FA8EE
SHA-512:	BA03C4AD28F95FF8C2ED81DDD0B7DF36256CC53534D0D9E93961C9DDC5FF18AFB3D3715C388D311CC3949D6F3C3E6F1DF2AF5C64B2630960782572E3A45759CC
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/showlets/search_form.css
Preview:	#search-form {...text-align: right;..}....#search-form input.text {...width: 7em;..}

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	5027
Entropy (8bit):	5.498674939312304
Encrypted:	false
SSDEEP:
MD5:	A02EBA79312AABAEEE2D5726A143574E
SHA1:	A8ED34163EC0E91959FA43BB60ECD099C2512DFA
SHA-256:	315B7050069EA27F1BA402734BA126C0195257ADFFC817BE7F6F1D554F429F00
SHA-512:	405498CCE53324DA4916AB09A176BD43EB25C7A3A98336D4009F8BE02410957B130AC3825BA5FD0FBAB8544F4F23F7CB2E24A68A6F0EFC9F6D345E4A1956163E
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/js/jquery.validate.password.js
Preview:	/.. jQuery validate.password plug-in 1.0.. .. http://bassistance.de/jquery-plugins/jquery-plugin-validate.password/.. .. Copyright (c) 2009 J.rn Zaefferer.. * Modified by Marco Perazzetta (2014).. .. $Id$.. .. Dual licensed under the MIT and GPL licenses:.. * http://www.opensource.org/licenses/mit-license.php.. * http://www.gnu.org/licenses/gpl.html.. /..(function($) {......// il set di caratteri speciali e' il seguente ...//...//..~#"$%&'()+,-./:;<=>?!@[]^_\...//...// i caratteri speciali per le regex che necessitano escape sono...//...//..< > ( ).[ ] { }.\ ^.- =.$ !.\| ? * +.....//...// e quindi il set di caratteri con escapi diventa...//...//..~#"\$%&'\\+,\-\./:;\<\=\>\?\!@\[\]\^_\\......var LOWER = /[a-z]/,....UPPER = /[A-Z]/,....AT_LEAST_1_DIGITS = /(.\d.){1,}/,....AT_LEAST_2_DIGITS = /(.\d.){2,}/,....//DIGITS = /[0-9].[0-9]/,....//AT_LEAST_3_DIGITS = /(.\d.){3,}/,....//SPECIAL = /[_.]/,....//SPECIAL2 = /[_.&$@!-]/,....SPECIAL = /[~#"\$%&'\*\+,\

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	15013
Entropy (8bit):	5.309232920494707
Encrypted:	false
SSDEEP:
MD5:	A36D82BA1790EC09EDD8538F8E707497
SHA1:	9603752A983C09805D6220B3255A4BD0BBDDDC74
SHA-256:	7A5FFBEF14BE2695861ADAF69201DE8A955A33E66BA6039B370C3A7FB75DD769
SHA-512:	CD458583DE29B46DE99035B6E27A06C0E40EAD734A8FC90CB9A084C0296A310CB153789754EA8CCEAEF782EC4ED86E21CA1C4BFEA27CC854DFDC07C526C945C8
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/portale-agid.css
Preview:	/.Stylesheet base....Last modified date: 21/08/2014....By: Marco Perazzetta../..../* Table of Contents....=LAYOUT....=HEADER....=FOOTER....=MAIN-CONTENT....=2-COLUMN-LAYOUT-LEFT-MENU....=2-COLUMN-LAYOUT-RIGHT-MENU....=3-COLUMNS-LAYOUT....=ELEMENTS....=LINKS....=INPUTS-AND-BUTTONS....=TABLES....=OTHERS....=HEADER-MENU....=BREADCRUMBS......=LATERAL-MENU../..../...NOTE:...14px/16px = .875...18px/16px = 1.125...1em => 16px (normal text);....875em => 14px (small text);...1.125em => 18px (big text);../..................@import url(../fonts/fonts.css);..../ = RESPONSIVE LAYOUT /...... {...box-sizing: border-box;..}..../* = COLUMNS SETUP */...col-1 {width: 8.33%!important;}...col-2 {width: 16.66%!important;;}...col-3 {width: 25%!important;;}...col-4 {width: 33.33%!important;;}...col-5 {width: 41.66%!important;;}...col-6 {width: 50%!important;;}...col-7 {width: 58.33%!important;;}...col-8 {width: 66.66%!important;;}...col-9 {width: 75%!important;;}...col-10 {width: 83.33%!important;;}..

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (582), with CRLF line terminators
Category:	downloaded
Size (bytes):	53841
Entropy (8bit):	5.059070754819272
Encrypted:	false
SSDEEP:
MD5:	6B473C5112C26577D496E6F2A863F195
SHA1:	266DE364639EA2E8F5B8E90B64D1A4F11477C65C
SHA-256:	F972992044D5440F65CF152309E4A6648325616FB61ABF3FD8C5B4140A487E23
SHA-512:	FF08B8768D4894F98A429386831D8E195D2158F33555DDA6540159D7F8D8CEFFDE1D927901E515813B28B8F43990F217BB412B9E5B191F626E9A1CA1530F6873
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/js/jquery.validate.js
Preview:	/!.. jQuery Validation Plugin v1.20.0.. .. https://jqueryvalidation.org/.. .. Copyright (c) 2023 J.rn Zaefferer.. * Released under the MIT license.. */..(function( factory ) {...if ( typeof define === "function" && define.amd ) {....define( ["jquery"], factory );...} else if (typeof module === "object" && module.exports) {....module.exports = factory( require( "jquery" ) );...} else {....factory( jQuery );...}..}(function( $ ) {....$.extend( $.fn, {.....// https://jqueryvalidation.org/validate/...validate: function( options ) {......// If nothing is selected, return nothing; can't chain anyway....if ( !this.length ) {.....if ( options && options.debug && window.console ) {......console.warn( "Nothing selected, can't validate, returning nothing." );.....}.....return;....}......// Check if a validator for this form was already created....var validator = $.data( this[ 0 ], "validator" );....if ( validator ) {.....return validator;....}......// Add novalidate tag if HTML5.....thi

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 163 x 50, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	20223
Entropy (8bit):	3.747393377277401
Encrypted:	false
SSDEEP:
MD5:	A5E9C75C621B1D4E5659F1611B4415AB
SHA1:	309CFE28394C2DAD2EAB06310A9EC61E2385E35C
SHA-256:	349E5C1C030E3FE968704649EC33B60721FE2C4A12AC48EB0447008058003162
SHA-512:	FCFAF5CD64F5117FD386C22FBC04003505E785394DB04A9CF392E010998C4E8D7A57E554E4083D7566BB5CC41B7EC25AD15F8E0A935548920A3822B6B172B5D8
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/img/enea/banner_logo.png
Preview:	.PNG........IHDR.......2.....0Vkf....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 15 tables, 1st "GDEF", 9 names, Microsoft, language 0x409
Category:	downloaded
Size (bytes):	53896
Entropy (8bit):	6.399303032254469
Encrypted:	false
SSDEEP:
MD5:	D49A8EE8F1BAEE082909AB2E7C4062D1
SHA1:	1DE05D92173EDF1CF44696D3C8A5842EBBF1E75F
SHA-256:	FE3D6895510631F14E0BFF85E487B32BE20972364A457E7DF4047B58F41559C2
SHA-512:	B9511CDA253ACD67DA1CEAD7C272F9B148DE7D39222A2EBA3EAAA5481F8E49273C05CD85034E892CF45D7EE78A140153845487CB613D6FA7CC6FB25A6CB2AC52
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/fonts/titillium-web/TitilliumWeb-Bold.ttf
Preview:	...........pGDEF............GPOS..w.......BPGSUB'...........OS/2k..>.......`cmap(.3.........gasp............glyf.....^`..t(head.$.....h...6hhea.......D...$hmtx!.9_...D...hloca..9...4...6maxp...B...$... nameX.qD...l....post..bn.......apreph..........................................................?.................@...........m.\|...^. .,.#...........................^._.<..........u......2.'. ...#.Z.........................X...K...X...^...,............................UKWN. . ...m.\|...m.. .............. .........(.R..DFLT..latn....................case.$frac..locl.................................n.0.................u.v.t.s.w.x.y.z.{.\|.............................................>.@.^.`.c.x...\.].............Y...................(.................s.t...z.z...l.r.............}.....h.h...k.k...s.\|.................l.z.s.t.m.n.o.p.q.r.l.z.s.t.m.n.o.p.q.r...........s.\|.................A.B.C.D.........................................`.@... .~...1.7.>.H.~.......................... . . . " & 0 :

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	99
Entropy (8bit):	4.687155297101476
Encrypted:	false
SSDEEP:
MD5:	AFACF97BE31DB106E016256157162A89
SHA1:	11477E95C61F30365EE8085B8F895F770084E149
SHA-256:	13162EE0E1AD28498E43ACDBB53BBBC15E256EE6960DC220BCAB54CA95BED850
SHA-512:	219E73EB8DBCA75CF31646EBE0698B412C5E04A5588C57B65D9CF43F96E09520E287D17145AB410408B129C69B6F8C9775CF186183E9BA7A7A1E4E0BB40C30A9
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/enea/showlets/language_choose.css
Preview:	#language-sub-menu {...color: #004884 !important;..}....#language-sub-menu a {...color: #004884;..}

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob
Category:	downloaded
Size (bytes):	168260
Entropy (8bit):	6.494302450093614
Encrypted:	false
SSDEEP:
MD5:	8A36205BD9B83E03AF0591A004BC97F4
SHA1:	56C5C0D38BDE4C1F1549DDA43DB37B09C608AAD3
SHA-256:	4E147AB64B9FDF6D89D01F6B8C3CA0B3CDDC59D608A8E2218F9A2504B5C98E14
SHA-512:	E96B43B0CA3FD7775D75A702F44CD1B0DFD325E1DB317F7CBA84EFDF572571FE7594068F9132A937251AAB8BD1F68783213677D4953ACA197195FBE5DB1F90D7
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/fonts/roboto/Roboto-Regular.ttf
Preview:	........... GDEF.B.........bGPOS.m?6......].GSUBz..w..{.....OS/2.......l...`cmap..Qm........cvt +......p...Tfpgmw.`....h....gasp.......x....glyf&......,...lhdmxUz`z........head.j.z.......6hhea.......H...$hmtx.r.........8loca.w.........maxp.>........ name6!a.........post.m.d...X... prep.f.....$...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9\|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	157
Entropy (8bit):	4.747940967844616
Encrypted:	false
SSDEEP:
MD5:	4432F6357AF6368354BA5AA3F0329863
SHA1:	9C937DBC3F77F894891EAF9D67CA324086EEA46F
SHA-256:	2061AD17FA633CF88B1939A86A341B1AB047D5FC7EEB195F5A183B372B49F47F
SHA-512:	7969674059566248923D0FF4480FF449B56F6E26ED21EE92F5C12D252A1AC89400CCAEED62EBE75D77B8E55410ABED5E0EAA601E6922BC83D0D2A118DADBCDD7
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/showlets/date_time.css
Preview:	#date-time input {...background-color: transparent;...border: medium none;...padding: 0;...text-indent: -999em;...vertical-align: baseline;...width: 16px;..}

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 15 tables, 1st "GDEF", 9 names, Microsoft, language 0x409
Category:	downloaded
Size (bytes):	57392
Entropy (8bit):	6.396438581572035
Encrypted:	false
SSDEEP:
MD5:	57E937E4EEF39E324BD4F26745053687
SHA1:	C1D91BD86751BD0A186AC0323DCF47DE4D0C0981
SHA-256:	486E78BE7CA7596376418B5120443EE1A359E95488DA17F7A88282D82F34D51C
SHA-512:	84181F78C686936129B5A604BB3A017DEDA8D23D7F6B0A9FDD9D633ED8480512E867E426613AEE9A2A20202A996493BC8B308A98611184F827FEA6B28E385BB8
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/fonts/titillium-web/TitilliumWeb-Regular.ttf
Preview:	...........pGDEF............GPOS.......(..M.GSUB'...........OS/2i.}Q.......`cmap(.3.........gasp............glyfS!a...i(..w.head.+.....h...6hhea.......D...$hmtx..IB...\...flocae.I....4...6maxp...G...$... name[.s....l....post..bn.......apreph..........................................................D.................@...........m.\|...m. ...+............................<x_.<..........u......2.'. ...+.:.........................X...K...X...^...,............................UKWN.@. ...m.\|...m.. .............. .........(.R..DFLT..latn....................case.$frac..locl.................................n.0.................u.v.t.s.w.x.y.z.{.\|.............................................>.@.^.`.c.x...\.].............Y...................(.................s.t...z.z...l.r.............}.....h.h...k.k...s.\|.................l.z.s.t.m.n.o.p.q.r.l.z.s.t.m.n.o.p.q.r...........s.\|.................A.B.C.D.........................................`.@... .~...1.7.>.H.~.......................... . . . " & 0 :

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (424), with CRLF line terminators
Category:	downloaded
Size (bytes):	39493
Entropy (8bit):	5.3329207094093345
Encrypted:	false
SSDEEP:
MD5:	1CAE9A107073015E7035AD5B165A7676
SHA1:	89DEFBADF264494E496FCA02CF174F50BE53AE28
SHA-256:	C3967E04D6A8DFCDDB4DCA291121835722DE30BAE76693EA13BCF47853D964F3
SHA-512:	76FCDA6597D41805718B7684F9D9C46195BE3D784B17C8896A6C4AEDC76A1A0F584BBF56F1A6A076559FB7517F53BFCB49A5A8ECB5E8AD88B3F2334549DD314B
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y
Preview:	........................<!DOCTYPE html>....<html lang='it'>.....<head prefix="og: http://ogp.me/ns#; dcterms: http://purl.org/dc/terms/#">.... - - - - -->....<meta name="viewport" content="width=device-width, initial-scale=1.0" />.... - - - - -->..........<link rel="profile" href="http://dublincore.org/documents/dcq-html" />........<title>Portale gare d'appalto\|Riattivazione utente</title>........<meta http-equiv="X-UA-Compatible" content="IE=Edge" /> ......<link rel="shortcut icon" href="/PortaleAppalti/resources/static/img/favicon.ico" />..........................................................................................................<link type="text/css" rel="stylesheet" href="/PortaleAppalti/resources/static/css/normalize.css" />.........................<link type="text/css" rel="stylesheet" href="/PortaleAppalti/resources/static/css/portale-agid.css" />............<link type="text/css" rel="stylesheet" href="/PortaleAppalti/resources/static/css/enea/portale.css" />..

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.051921659777146
Encrypted:	false
SSDEEP:
MD5:	E9C084F30A4B607E0BF9BF201BB663EB
SHA1:	E896D180B621C3EC7EB0FC46C4CEBD0F2C1B5C17
SHA-256:	225CCD5B7C50EF78FA399432F468213E2A7BC9D7F85CA96194D77B05AC4FC05F
SHA-512:	BE0B9CDD917DC86E9A9FBC80C7BF4128D8CCD5512A5011D6C5690D3F3E4E11A9128C4DA715E50F8AF81A251FD7009F0BEC21E32454321E658A1B8176A91D4AAA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@......................................H...........................H...........................'...........................................'...............'...................................................'.......................................................................H...........................................................G....ttt.....................[[[.XXX.........!!!.GGG.........................................!!!.........]]].............................jjj.................!!!.........WWW.............................................!!!.!!!.........................................................!!!.RRR.............III.............................kkk.....eee.!!!.............................$$$........G................%%%.+++.........................~~~.888....[................<<<.!!!.}}}............................................'........nnn.!!!....................................'...............'..............................

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4462
Entropy (8bit):	4.89482441883554
Encrypted:	false
SSDEEP:
MD5:	10CBC3835A71C249DBD940F597B1E050
SHA1:	F1D72CC2F5A401C8AD7C79F3D4FB3F8BACB017E8
SHA-256:	241B336B49D1155AC83CDCE963938AD4ABF8035AF11E592C9DB478ED81608635
SHA-512:	FC19764886D40744A676B9A945FD5DF5A9F1A2F7A95021D20433E138473EED8E9ABB7A543C8118946AC41C2B0481706BA66C0A455E200FDC54FB5532619565CA
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/fonts/fonts.css
Preview:	/* Titillium Web */..@font-face {.. font-family: 'Titillium Web';.. font-style: normal;.. font-weight: 200;.. src: url(./titillium-web/TitilliumWeb-ExtraLight.ttf) format('truetype');..}..@font-face {.. font-family: 'Titillium Web';.. font-style: normal;.. font-weight: 300;.. src: url(./titillium-web/TitilliumWeb-Regular.ttf) format('truetype');..}....@font-face {.. font-family: 'Titillium Web';.. font-style: normal;.. font-weight: 400;.. src: url(./titillium-web/TitilliumWeb-Regular.ttf) format('truetype');..}....@font-face {.. font-family: 'Titillium Web';.. font-style: normal;.. font-weight: 600;.. src: url(./titillium-web/TitilliumWeb-SemiBold.ttf) format('truetype');..}....@font-face {.. font-family: 'Titillium Web';.. font-style: normal;.. font-weight: 700;.. src: url(./titillium-web/TitilliumWeb-Bold.ttf) format('truetype');..}....@font-face {.. font-family: 'Roboto';.. font-style: normal;.. font-weight: 300;..

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	302
Entropy (8bit):	4.792213438330872
Encrypted:	false
SSDEEP:
MD5:	25D427AD40F6476ABEE9C60236639CEA
SHA1:	ABB303BA7ABD7FF36250B7D96C3AA11C2A695D2C
SHA-256:	DA5F2E5738591E14F1CA90DB4BC670D8CCF45EF542A481A04E59A9C4695D30D8
SHA-512:	AD1EC3D530A51F5B6E8A749D36C09113B56B4920C77473BC984F21B892438C342E9434108FA6275A66897A164D3314D10D3A91F2A97B9352FBEE8F2C198F16C9
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/showlets/login_form.css
Preview:	.login-box p {...padding: .5em 5px;...margin: 0;..}.....login-box .links {...padding: .3em 15px;..}.....login-box form div {...text-align: right;...padding: .5em 5px .5em 2px;..}.....login-box .text {...width: 7em;..}.....welcome-message span {...font-style: italic;...padding: 0;...display: inline;..}

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1768
Entropy (8bit):	5.0786974251056165
Encrypted:	false
SSDEEP:
MD5:	67D565CCBCA5DDA6CF361234E6455BC7
SHA1:	DB1EECC7E8B3241DEB6058DF160A9028FE094001
SHA-256:	D89C9886AE818F3CF06E47C914C623995EC5605A84C3F2EF86298FC39AC3E55C
SHA-512:	F54008C620EB92FBE5AD099731E8BDAB6FEF5B13B358AE7B2326DCDAF09B76925C8CFF5165FF5593D29DBFE5F890927A570FC5FBAAFBC23762755E14C3CD9F63
Malicious:	false
Reputation:	unknown
Preview:	..$(document).ready(function(){......if(screen.width < 768){....if(document.getElementById("logo-main").children[0].children[0].src.includes("/appalti-contratti/") \|\| document.getElementById("logo-main").children[0].children[0].src.includes("/appalti-contratti-v1/")){.....document.getElementById("date-time").classList.add("responsive-banner-logo");....}else{.....document.getElementById("date-time").classList.remove("responsive-banner-logo");....}....var balloonDiv = document.getElementsByClassName("balloon");....var i;....for (i = 0; i < balloonDiv.length; i++) {.....const div = document.createElement('div');.....div.className='balloon-expand-div'.....div.innerHTML = '<a class="espandi-balloon ballon-expand-text" href="javascript:void(0)" onclick="collassaEspandi(event,this)"></a>';.....balloonDiv[i].appendChild(div);..............}....var balloonContent = document.getElementsByClassName("balloon-content");....var i;....for (i = 0; i < balloonContent.length; i++) {.......balloonContent

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5251
Entropy (8bit):	5.266352177439813
Encrypted:	false
SSDEEP:
MD5:	0AF17BABD188A7CA2A02C2C468422DD3
SHA1:	49AD8BC760AA45CF46F437039B30ECE73928A632
SHA-256:	8FCFBB266F66B0AAA22D80F2516D586590F6FF446D427095D7C7694D93D86D15
SHA-512:	33EFE6B6FF7A0BD252CF4C0A0F8083A72DD7E9B995A4BA8E5256EA6CC606679EBBBF0AFA77D0E3AEABC1CC7F7ECF235E6A6EE31FC3A70F960B77FB7E85B40246
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/img/info.svg
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<svg.. xmlns:dc="http://purl.org/dc/elements/1.1/".. xmlns:cc="http://creativecommons.org/ns#".. xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#".. xmlns:svg="http://www.w3.org/2000/svg".. xmlns="http://www.w3.org/2000/svg".. xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd".. xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape".. id="SvgjsSvg1062".. width="32".. height="32".. version="1.1".. sodipodi:docname="info_2.svg".. inkscape:version="0.92.5 (2060ec1f9f, 2020-04-08)">..<metadata.. id="metadata12">..<rdf:RDF>..<cc:Work.. rdf:about="">..<dc:format>image/svg+xml</dc:format>..<dc:type.. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />..<dc:title></dc:title>..</cc:Work>..</rdf:RDF>..</metadata>..<sodipodi:namedview.. pagecolor="#ffffff".. bordercolor="#666666".. borderopacity="1".. objecttolerance="10".. gridtolerance="10".. guidetolerance="10".. inkscape:pageopacity="0".. inkscape:pagesh

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.119965282647847
Encrypted:	false
SSDEEP:
MD5:	FF22DB4EB860AC4C80F3E1FEB1B04D8B
SHA1:	88E0B2DE30041DC90C878E0EB3F413C258482BF8
SHA-256:	5AD6C4621F4EC2AECEFD9597ACE359F7FBAF0C5D9E8A88C999F30E5640BF5D19
SHA-512:	2CBBF174DFBE898C1CD7EC7DE318AE8B7353C9ABF0D3C3137FD5B9C1365FDD8D2F7A73C525A1613B3D40C9D16E966B8CA0E3D764A1C12F20D5AB7CE8603991C0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>..<svg.. xmlns:dc="http://purl.org/dc/elements/1.1/".. xmlns:cc="http://creativecommons.org/ns#".. xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#".. xmlns:svg="http://www.w3.org/2000/svg".. xmlns="http://www.w3.org/2000/svg".. xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd".. xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape".. id="SvgjsSvg1062".. width="16".. height="16".. version="1.1".. sodipodi:docname="time.svg".. inkscape:version="0.92.5 (2060ec1f9f, 2020-04-08)">.. <metadata.. id="metadata12">.. <rdf:RDF>.. <cc:Work.. rdf:about="">.. <dc:format>image/svg+xml</dc:format>.. <dc:type.. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />.. <dc:title></dc:title>.. </cc:Work>.. </rdf:RDF>.. </metadata>.. <sodipodi:namedview.. pagecolor="#ffffff".. bordercolor="#666666".. borderopacity="1"..

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (28588), with CRLF line terminators
Category:	dropped
Size (bytes):	29020
Entropy (8bit):	5.873796973096277
Encrypted:	false
SSDEEP:
MD5:	85FD3D830DEF5CB0B95BDEEB97C91A65
SHA1:	5181EF8052770179EF261E47C382D986239C6555
SHA-256:	2A8A1A57216BB3BA7945F120BFA1E7BC66EA1B2091E6409A93F551590B660755
SHA-512:	42C2A79D23072E1D3AC4637D42EE1DD058F105EF6827EFF0A7EEF1CDD6F155C18762C15B7A2AB40595D6A0B0E18037DE3310E411E3BA6040B2A970920775AA8C
Malicious:	false
Reputation:	unknown
Preview:	const t='<circle cx="12" cy="12" r="8" stroke-width="3" stroke-dasharray="15 10" fill="none" stroke-linecap="round" transform="rotate(0 12 12)"><animateTransform attributeName="transform" type="rotate" repeatCount="indefinite" dur="0.9s" values="0 12 12;360 12 12"/></circle>',e='<path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm1 15h-2v-2h2v2zm0-4h-2V7h2v6z"/>';function r(t,e,r,A,i,o=!1,n,s){return`<div class="frc-container${s?" "+s:""}">\n<svg class="frc-icon" role="img" xmlns="http://www.w3.org/2000/svg" height="32" width="32" viewBox="0 0 24 24">${e}</svg>\n<div class="frc-content">\n <span class="frc-text" ${n?`title="${n}"`:""}>${r}</span>\n ${i?`<button type="button" class="frc-button">${i}</button>`:""}\n ${o?'<progress class="frc-progress" value="0">0%</progress>':""}\n</div>\n</div>\n<input name="${t}" class="frc-captcha-solution" type="hidden" value="${A}">`}function A(t,A,i,o=!0,n=!1){return r(t,e,`<b>${A.text_error}</b><br>${i}`,n?".HEADLE

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	17384
Entropy (8bit):	5.1947677241594485
Encrypted:	false
SSDEEP:
MD5:	A9FB71F235EEC293E1DF85A47E02BC30
SHA1:	DADC0D41177D4CB20CA0F2EC28D551071A5996D1
SHA-256:	CD26F9D61EDE26D870716EED838DB5878C88C40B33D6987CB2C1F124CC54629C
SHA-512:	535F742692D7F3876FB0168D31B72270B780E2F99AA2E2A5712366BF7B432FA448071273A018A37634D18CCD395C5C1435FB72D8049F9446024E04ED8D2F9914
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/showlets/application.css
Preview:	/.Stylesheet base....Last modified date: 21/08/2014....By: Marco Perazzetta../..../* Table of Contents....=ERRORS-AND-MESSAGES....=BALLOON....=TABLES....=TREES....=FILTER-FORM....=DETAIL-FORM....=LIST-FORM....=CHANGE-PASSWORD-FORM....=SIGN-AND-SEND-FORM....=HELP-FORM....=MENU-FORM....=WIZARD-STEPS....=PAGINATION....=LIST....=IMAGES../..../ =ERRORS-AND-MESSAGES /...errors, ...warnings {...font-size: .95em;...margin: .5em .5em 1em .5em;...padding: .2em;..}..../ WCAG 2.1 /...error,...errors, ...required-field {...color: #E00000;..}.....warnings, .warnings h3 {...color: #0047b8;..}.....errors ul {...list-style-type: square;...padding-left: 20px;..}..../ =BALLOON */.....balloon {...border-radius: 10px;...margin-bottom: 1em;...padding: 1em 10px;..}.....balloon-content {...background-repeat: no-repeat;...background-position: .25em 0;...margin: 0;...min-height: 48px;...padding: 0 0px 0 60px; ..}.....balloon ul {...list-style-type: square;...margin-left: 1em;..}.....balloon-info {...

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	9638
Entropy (8bit):	4.971528972714842
Encrypted:	false
SSDEEP:
MD5:	B441E4771D1BD2839210FF395B7DBEBA
SHA1:	3C467C69771D7A5FCE55F00E61D2704D39F8B28F
SHA-256:	E6BEC22433B28C0A2D5B3B64E2F88F41EB8BADDB515607886C879D16FE4A3228
SHA-512:	E1272B98928582A7D6C9E98719D98225FFDDC570CBFC05D974C362CA4804F7242AEBE6BBCDD3A1B714FA1DF452BC04EC450E335C16CBBF19F4AD6CF6044D94A8
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/normalize.css
Preview:	/! normalize.css v1.1.3 \| MIT License \| git.io/normalize /..../* ==========================================================================..HTML5 display definitions..========================================================================== /..../.. Correct `block` display not defined in IE 6/7/8/9 and Firefox 3.../....article,..aside,..details,..figcaption,..figure,..footer,..header,..hgroup,..main,..nav,..section,..summary {...display: block;..}..../.. Correct `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.../....audio,..canvas,..video {...display: inline-block;...display: inline;...zoom: 1;..}..../.. Prevent modern browsers from displaying `audio` without controls...* Remove excess height in iOS 5 devices.../....audio:not([controls]) {...display: none;...height: 0;..}..../.. Address styling not present in IE 7/8/9, Firefox 3, and Safari 4...* Known issue: no IE 6 support.../....[hidden] {...display: none;..}..../ ==============================

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2786), with CRLF line terminators
Category:	downloaded
Size (bytes):	24472
Entropy (8bit):	5.242998475744688
Encrypted:	false
SSDEEP:
MD5:	9F73B163879274773D23D0E8ECF66DBC
SHA1:	9BB35C4A9D7954EA82A4F49B918C2B4458A8B29A
SHA-256:	DC66CAC6D8B2DD9FCE58ADCAECBB10506044C77F954FD5A6B6332A1705F0B774
SHA-512:	2FFD34345BEB005A9E0235A906B2F6E73F66BB0C2D0C1B1E57506787772CA30AD6BB378AD18F64D242D34B3585CEF7B3E958C23A844C32C26CB5AB7EBB62A42B
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/js/jquery.alphanum.js
Preview:	/*******************************************************************.. Limit the characters that may be entered in a text field..* Common options: alphanumeric, alphabetic or numeric..* Kevin Sheedy, 2012..* http://github.com/KevinSheedy/jquery.alphanum..*********************************************************************/..(function( $ ){.....// API ///////////////////////////////////////////////////////////////////...$.fn.alphanum = function(settings) {......var combinedSettings = getCombinedSettingsAlphaNum(settings);......var $collection = this;......setupEventHandlers($collection, trimAlphaNum, combinedSettings);......return this;...};.....$.fn.alpha = function(settings) {......var defaultAlphaSettings = getCombinedSettingsAlphaNum("alpha");....var combinedSettings = getCombinedSettingsAlphaNum(settings, defaultAlphaSettings);......var $collection = this;......setupEventHandlers($collection, trimAlphaNum, combinedSettings);......return this;...};.....$.fn.numeric = function(set

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	5107
Entropy (8bit):	5.059111553354238
Encrypted:	false
SSDEEP:
MD5:	11865E384A2FB66E0B9288C7F69F93F2
SHA1:	590D31887689CF1FAC5FD68A2418AB1AE4911563
SHA-256:	B01BDB13A7463096C69CFC13E09356E35883DC9F32A58883E0F30C69B3D11780
SHA-512:	25A44879B709C1737E4A9FB6CF6987184135377A0569225A8066B282ABF442F55451BBA355EB2DFC82C72B13D01BC203BB6226FF50D24766740DCE84012AA470
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/enea/portale.css
Preview:	..body {.. font-family: "Titillium Web", Helvetica, Arial, sans-serif;.. color:#454545;.. font-size: 14px; }..../* typography /..h1 {.. font-size: 2.5rem; }....h2 {.. font-size: 1.685em;.. color: #5A6772;.. padding: 10px 0 10px 15px; ..}..../..h3 {.. font-size: 2rem;..}....h4 {.. font-size: 1.75rem..}....h5 {.. font-size: 1.5rem..}....h6 {.. font-size: 1.25rem;..}../..h1, h2, h3, h4, h5, h6 {.. margin: 0.5em 0; }....p {.. line-height: 150%; }....ul, ol {.. margin: 0;.. padding: 0 0 0 1em; }....dt {.. margin: 0;.. padding: 0;.. font-weight: bold; }....dd {.. margin: 0;.. padding: 0; }....pre {.. white-space: pre-wrap; }..../ inputs */..select, textarea, input[type=text], input[type=password], textarea {.. border: 1px solid #999999;.. padding: 0.4em 1.2em;.. border-radius: 0;.. -webkit-box-sizing: border-box;.. box-sizing: border-box;.. color: inherit;.. font-size: inherit;.. margin: 0;.. line-height: normal !important; }.....button {.. font-wei

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3473
Entropy (8bit):	5.189305544290511
Encrypted:	false
SSDEEP:
MD5:	5AB82F170D2C1B57C789B772DECB0C62
SHA1:	6964B25AE23747A4E84F01671CBD195201FBAB40
SHA-256:	B7BB62755F27D236910E6383466DDB336F6428EFAF037A6512D1C9F46516796B
SHA-512:	B3777F1F4EC55DE0696EAFA3B1AE36FACAEE1AD17D23024643E8AE9C599A4A534F815BF2224E7CE2E5BD0445FC84AC0092A6D282947961DCE76EDD2922CCBB8A
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/enea/showlets/application.css
Preview:	fieldset {.. min-width: 0; }....th, td {.. padding: 0.5em;.. border: none; }....tr:nth-child(odd) {.. background-color: #f6f7f9; }....hr {.. clear: both; }..../* =ERRORS-AND-MESSAGES /...error, .errors, .required-field {.. color: #FF0000; }.....warnings {.. color: #d1ae00; }..../ =BALLOON /...balloon {.. background-color: #f1f1f1;.. border: none;.. border-radius: 0; }..../ =DETAIL-FORM */...detail-section-title {.. font-weight: bold;.. text-align: center;.. padding: 5px;.. text-transform: uppercase; }.....detail-row label {.. font-weight: bold; }.....element .no-editable {.. background-color: #e6e6e6; }.....portgare-list label, .portgare-view label {.. font-weight: bold; }.....portgare-list{.. font-size: 1.1em;..}.........portgare-view h2 {.. font-weight: bold; }....div div.note {.. border: 1px solid #999999; }.....fieldset-row:nth-child(even) {.. background-color: #f6f7f9; }....div.sottosezione h4 {.. border-bottom: 1px solid #999999; }.....special {.. backg

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	76
Entropy (8bit):	4.838801409104103
Encrypted:	false
SSDEEP:
MD5:	3483C314013EE73538B809D29999982C
SHA1:	0CC1FAE71036B8A48B0FDCB3814EDE2A1571AA9A
SHA-256:	420FB90C1360AD495946605F6DCC498B8326D701CADE41CD1E4C5D372F5B0C21
SHA-512:	03D4390CC56E6FE38591A4CDC2311271D5C7A49CBFFE0FC77D8694058C3283283C88ED01937B4E6397355E00759E2D3BFCBFE7BE1E3E8BF0889A6F95CF62350E
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAmOaaTpWdo8PRIFDWdns_4SFwlpTGRygjuuvBIFDc5BTHoSBQ04NomH?alt=proto
Preview:	CgkKBw1nZ7P+GgAKKwocDc5BTHoaBAhMGAIqDwgKUgsKAUAQARj/////DwoLDTg2iYcaBAhfGAI=

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	4.7920824066629715
Encrypted:	false
SSDEEP:
MD5:	9DECA8A8D345439BB6D4DDCE0E599301
SHA1:	5BA860C501276B907EA0CBEBB02DF42FFEA8B1D3
SHA-256:	88D73E73E51D7ECF5F64DD4C3011B368617C90F9ACA9D5A528CCB5EA00AFD0D0
SHA-512:	1E7E1E8F3C81D7857736DD5E5D59141FEDE6A49970215977823CAF53371DA1FF02D6B11D5735F0224EC4A7A4CE7477744D87DC57871D5EA724F25B1D5C0B39A2
Malicious:	false
Reputation:	unknown
Preview:	./* ..* Gestione dei controlli sui caratteri ammessi..* FILE SALVATO IN FORMATO UTF-8 IN QUANTO IL PORTALE USA UTF-8 COME ENCODING STANDARD../.....$(window).on("load", function (){......$("textarea:visible, input:visible").alphanum({....allow : '!@#$%^&()+=[]\\\';,/{}\|":<>?~`.-_.........', // Allow extra characters... disallow : '', // Disallow extra characters... allowSpace : true, // Allow the space character... allowNewline : true, // Allow the newline character \n ascii 10... allowNumeric : true, // Allow digits 0-9... allowUpper : true, // Allow upper case characters... allowLower : true, // Allow lower case characters... allowCaseless : true, // Allow characters that do not have both upper & lower variants eg Arabic or Chinese... allowLatin : true, // a-z A-Z... allowOtherCharSets : false, // eg ., ., Arabic, Chinese etc... forceUpper

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	69
Entropy (8bit):	4.5368509499104235
Encrypted:	false
SSDEEP:
MD5:	44E8703F21DF0465DC6ECA10C8E5B5AA
SHA1:	5C037B300CC40912A1393B98B4E37C76F0FFBD50
SHA-256:	20F7ABCE1DACE5481902FFD131BCE642FDFED1A95F7383F7A1D852B3CA3BA843
SHA-512:	0A0471B9D025F0168CB65A4A11BEF862A91B9D6002BF6DA410A5093BC0927929B8620B8A977EE31D0284036D49BE93B3F6921829B8884C3A172FB89760532FAF
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/enea/showlets/date_time.css
Preview:	#date-time {.. text-transform: uppercase;.. font-size: 0.989em; }..

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64394), with CRLF line terminators
Category:	downloaded
Size (bytes):	255089
Entropy (8bit):	5.159752797884137
Encrypted:	false
SSDEEP:
MD5:	B4BAECB73B7A75044853D7F4D363CB49
SHA1:	CEE14F8598C3C7F75ED141896F976FE94ED286A0
SHA-256:	9D9B75E6BF99296F7797ED12F73137F52966DBB02180FF054C6C01680C7BDB1D
SHA-512:	B5E6510052414B90C694C0A01835A7B49C73801757BC12F0AFA7BB96808FC63E474A38CC7C28ADCF3A4A43D145BE9DCCF0A1923A405777FE3D2FD06474583229
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/js/jquery-ui-1.13.2.min.js
Preview:	/! jQuery UI - v1.13.2 - 2022-07-14.. http://jqueryui.com..* Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js, focusable.js, form-reset-mixin.js, jquery-patch.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable.js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, widgets/sor

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, 15 tables, 1st "GDEF", 11 names, Microsoft, language 0x409
Category:	downloaded
Size (bytes):	56752
Entropy (8bit):	6.385254783405857
Encrypted:	false
SSDEEP:
MD5:	C21564022E51245CA150237EEB23A2BB
SHA1:	3EC2A03E4F87634460200B350BA7FDB8CC37934F
SHA-256:	3A285881FAADBB793538867D008DC972EC70A7244099B6ED84BB5691C519BE28
SHA-512:	44E36D957465543709DE4418CEDEAC623795C0DC0250F86D766F771B79687B7E970A35604411D430F0674F403C136E4BB1ACB2A374B66999E46BB1639BCC5B3F
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/fonts/titillium-web/TitilliumWeb-SemiBold.ttf
Preview:	...........pGDEF............GPOS.....X..K.GSUB'...........OS/2j..X.......`cmap(.3.........gasp............glyf9..l..h ..u.head.&.....h...6hhea.......D...$hmtx.^@........hloca.C.....4...6maxp...J...$... name^..;...l....post..bn.......apreph..........................................................G.................@...........m.\|...d. .$.&..........................Lx.._.<..........u......2.'. ...&.M.................X.......X...K...X...^...,............................UKWN.@. ...m.\|...m.. .............. .........(.R..DFLT..latn....................case.$frac..locl.................................n.0.................u.v.t.s.w.x.y.z.{.\|.............................................>.@.^.`.c.x...\.].............Y...................(.................s.t...z.z...l.r.............}.....h.h...k.k...s.\|.................l.z.s.t.m.n.o.p.q.r.l.z.s.t.m.n.o.p.q.r...........s.\|.................A.B.C.D.........................................`.@... .~...1.7.>.H.~.......................... . . . " & 0 :

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1005
Entropy (8bit):	4.972946926549971
Encrypted:	false
SSDEEP:
MD5:	C9E428AC4E909909B097E28D68602308
SHA1:	0CF9F7A7ED93F3A0041031845DAEE77637A63759
SHA-256:	FBDE5D0D18C357713357567817FE4C24E81CCD25C7E49CE3AFDF8E647B1D695A
SHA-512:	2F32739A2FD82DEB84539818C64BA6CA1F7ED7B3B97EEC8F549A129EA5368C10A726E9AA8375D3174ABD34C4EC59C9CEA37C4531999FADE32D82FF3A7E50368E
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/jquery/validation/jquery.validation.css
Preview:	.password-meter {...position:relative;...display: none;..}...password-meter-message {...text-align: right;...font-weight: bold;...color: #676767;...padding-top: .5em;..}...password-meter-bg, .password-meter-bar {...height: 4px;..}...password-meter-bg {...top: 8px;...background: #e0e0e0;..}.....password-meter-message-very-weak {...color: #aa0033;..}...password-meter-message-weak {...color: #f5ac00;..}...password-meter-message-good {...color: #6699cc;..}...password-meter-message-strong {...color: #00BC00;..}...password-meter-message-very-strong {...color: #008000;..}.....password-meter-bg .password-meter-very-weak {...background: #aa0033;...width: 20%;..}...password-meter-bg .password-meter-weak {...background: #f5ac00;...width: 40%;..}...password-meter-bg .password-meter-good {...background: #6699cc;...width: 60%;..}...password-meter-bg .password-meter-strong {...background: #00BC00;...width: 80%;..}.....password-meter-bg .password-meter-very-strong {...background: #008000;...width: 100

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	490
Entropy (8bit):	4.862832122480288
Encrypted:	false
SSDEEP:
MD5:	F8AD6B575DE1F1F3987B1AA998864A7D
SHA1:	7DBDAA4993A0AEE1BF7A85AE62E8D399ED678CF0
SHA-256:	C6F980DBE9377B6C6D98A5BF30DEBA34572180DF01F5853B3E1BEDACC7331918
SHA-512:	C8C3FAFABC6FCAD5C2F478835E39E4A963180C240C48BA77B35DCB4EBCA241F746DCF136E4CF2FC530A05F7055DD5B2E811E9E332308F436F9BE45060A58F097
Malicious:	false
Reputation:	unknown
URL:	https://enea.ubuy.cineca.it/PortaleAppalti/resources/static/css/showlets/language_choose.css
Preview:	.language_choose ul {...margin: 0;...padding: 0;..}.....language_choose ul li {...border-right: 1px solid #0f4780;...display: inline;...list-style-type: none;...margin: 0;...padding: 0 0.5em;...color: #0f4780;...text-transform: uppercase;..}.....language_choose ul li a:link, .language_choose ul li a:visited {...color: #0f4780;...text-decoration: none;..}.....language_choose ul li a:hover, .language_choose ul li a:active, .language_choose ul li a:focus {...text-decoration: underline;..}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65446), with CRLF line terminators
Category:	dropped
Size (bytes):	87535
Entropy (8bit):	5.262801903047628
Encrypted:	false
SSDEEP:
MD5:	C9A1B0AA0167C8A4DF724D18D06814A8
SHA1:	F3F468CCF735476C87E3B49E274EB3752A884607
SHA-256:	7AA6B0E08F48A0F95D8DF7EA89E4CBFE1EF3D1E8C0F7373F7F25EDFB4E4A325E
SHA-512:	05352A89084C3B747C375EEA2107B9B3C660FFB5989D48F10EE30E4ACF917DB21FA7CE56F9B385DE0FCFD0873C4C4E9D96C48F2F38E26D5CD5DD28ED792C3E06
Malicious:	false
Reputation:	unknown
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /..!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remov

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 113

Chrome Cache Entry: 115

Chrome Cache Entry: 117

Chrome Cache Entry: 119

Chrome Cache Entry: 123

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 134

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 99

Windows Analysis Report
https://enea.ubuy.cineca.it/PortaleAppalti/it/recover.wp?token=69c93b869b8419c83146b1bac1a381cc5b6f8ddd&e=ef878189&h=fc6c4cdd&f=n&p=y