Analysis Report http://www.covid19-siparadigm.com

Overview

General Information

Sample URL:	http://www.covid19-siparadigm.com
Analysis ID:	367641
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

HTML title does not match URL

Classification

Signatures

Phishing:

HTML title does not match URL

Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: Title: Log in! does not match URL
Source: https://www.covid19-siparadigm.com/en/forgot_password	HTTP Parser: Title: Forgot password! does not match URL
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: Title: Log in! does not match URL
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: Title: Log in! does not match URL
Source: https://www.covid19-siparadigm.com/en/forgot_password	HTTP Parser: Title: Forgot password! does not match URL
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: Title: Log in! does not match URL

Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="author".. found
Source: https://www.covid19-siparadigm.com/en/forgot_password	HTTP Parser: No <meta name="author".. found
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="author".. found
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="author".. found
Source: https://www.covid19-siparadigm.com/en/forgot_password	HTTP Parser: No <meta name="author".. found
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="author".. found

Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="copyright".. found
Source: https://www.covid19-siparadigm.com/en/forgot_password	HTTP Parser: No <meta name="copyright".. found
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="copyright".. found
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="copyright".. found
Source: https://www.covid19-siparadigm.com/en/forgot_password	HTTP Parser: No <meta name="copyright".. found
Source: https://www.covid19-siparadigm.com/en/login	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 35.155.101.78:443 -> 192.168.2.3:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49713 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.covid19-siparadigm.comConnection: Keep-Alive

Source: login[1].htm.3.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=3692194074184385&ev=PageView equals www.facebook.com (Facebook)
Source: fbevents[1].js0.3.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("signalsFBEventsGetTier");e.exports=function(b,c){c=a(c);c=c==null?"www.facebook.com":"www."+c+".facebook.com";return"https://"+c+"/signals/iwl.js?pixel_id="+b}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}};e.exports=new h(function(d,e){function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=function(){n.removeItem(m),a.close()};e.src=i(c,g.ENDPOINT);b.body&&b.body.appendChild(e)}var o=!1,p=function(a){return!!(e&&e.pixelsByID&&Object.prototype.hasOwnProperty.call(e.pixelsByID,a))};function q(){if(o)return;var b=n.getItem(m);if(!b)return;b=JSON.parse(b);var c=b.pixelID,d=b.graphToken,e=b.sessionStartTime;o=!0;h(c,function(){var b=p(c)?c:null;a.FacebookIWL.init(b,d,e)})}function r(b){if(o)return;h(b,func

Source: unknown

DNS traffic detected: queries for: www.covid19-siparadigm.com

Source: chartjs-plugin-datalabels[1].js.3.dr	String found in binary or memory: http://chartjs.org/
Source: datatables.min[1].js.3.dr	String found in binary or memory: http://datatables.net/tn/
Source: bootstrap-datepicker3.min[1].css.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0)
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: analytics[1].js.3.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: Sortable[1].js.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=505521
Source: forgot_password[1].htm.3.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/select2
Source: login[1].htm.3.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: datatables.min[1].js.3.dr	String found in binary or memory: https://datatables.net/download
Source: datatables.min[1].js.3.dr	String found in binary or memory: https://datatables.net/download/#bs4/dt-1.10.16/af-2.2.2/b-1.5.1/cr-1.4.1/fc-3.2.4/fh-3.1.3/kt-2.3.2
Source: datatables.min[1].js.3.dr	String found in binary or memory: https://datatables.net/tn/11
Source: cropper.min[1].js.3.dr	String found in binary or memory: https://fengyuanchen.github.io/cropperjs
Source: dore.light.blue[1].css.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Cairo:300
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/cairo/v9/SLXGc1nY6HkvalIhTp0.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/cairo/v9/SLXLc1nY6HkvalqKbI6L59A.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/cairo/v9/SLXLc1nY6Hkvalqaa46L59A.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/cairo/v9/SLXLc1nY6Hkvalr-ao6L59A.woff)
Source: fullcalendar.min[1].js.3.dr	String found in binary or memory: https://fullcalendar.io/
Source: bootstrap.min[1].css.3.dr, bootstrap.bundle.min[1].js.3.dr	String found in binary or memory: https://getbootstrap.com/)
Source: owl.carousel.min[1].css.3.dr	String found in binary or memory: https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE
Source: typeahead.bundle[1].js.3.dr	String found in binary or memory: https://github.com/bassjobsen/Bootstrap-3-Typeahead
Source: Chart.bundle.min[1].js.3.dr	String found in binary or memory: https://github.com/chartjs/Chart.js/blob/master/LICENSE.md
Source: chartjs-plugin-datalabels[1].js.3.dr	String found in binary or memory: https://github.com/chartjs/chartjs-plugin-datalabels/blob/master/LICENSE.md
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: bootstrap-notify.min[1].js.3.dr	String found in binary or memory: https://github.com/mouse0270/bootstrap-growl
Source: select2.full.min[1].js.3.dr	String found in binary or memory: https://github.com/select2/select2/blob/master/LICENSE.md
Source: bootstrap.min[1].css.3.dr, bootstrap.bundle.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.bundle.min[1].js.3.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: bootstrap-datepicker3.min[1].css.3.dr	String found in binary or memory: https://github.com/uxsolutions/bootstrap-datepicker)
Source: jquery.validate.min[1].js.3.dr	String found in binary or memory: https://jqueryvalidation.org/
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com/
Source: analytics[1].js.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: ~DF9417F44143076A8B.TMP.1.dr	String found in binary or memory: https://www.covid19-siparadigm.com/en/forgot_password
Source: ~DF9417F44143076A8B.TMP.1.dr	String found in binary or memory: https://www.covid19-siparadigm.com/en/login
Source: {9D8214F7-82F5-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.covid19-siparadigm.com/en/loginRoot
Source: ~DF9417F44143076A8B.TMP.1.dr	String found in binary or memory: https://www.covid19-siparadigm.com/en/loginx
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.covid19-siparadigm.com/favicon.ico
Source: imagestore.dat.3.dr	String found in binary or memory: https://www.covid19-siparadigm.com/favicon.ico~
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://www.google.com
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://www.google.com/travel/flights/click/conversion/
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: googleAnalytics[1].js.3.dr	String found in binary or memory: https://www.googletraveladservices.com/travel/clk/pagead/conversion/

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 35.155.101.78:443 -> 192.168.2.3:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49713 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/75@4/2

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD785E640233A2FFA.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5640 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5640 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.60.216.19	scontent.xx.fbcdn.net	Ireland		32934	FACEBOOKUS	false
35.155.101.78	neovare-alb-285209131.us-west-2.elb.amazonaws.com	United States		16509	AMAZON-02US	false

Contacted Domains

Name	IP	Active
scontent.xx.fbcdn.net	185.60.216.19	true
neovare-alb-285209131.us-west-2.elb.amazonaws.com	35.155.101.78	true
www.covid19-siparadigm.com	unknown	unknown
cdn.jsdelivr.net	unknown	unknown
favicon.ico	unknown	unknown
connect.facebook.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.covid19-siparadigm.com/en/login	false	0%, Virustotal, Browse	unknown
https://www.covid19-siparadigm.com/en/forgot_password	false		unknown
http://www.covid19-siparadigm.com/	false	Avira URL Cloud: safe	unknown

ID:	367641
Product:	CloudBasic
Start time:	21:40:58
Start date:	11.03.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\N40R6UA2\www.covid19-siparadigm[1].xml	ASCII text, with no line terminators	EADEA981BA79C95C3477C7A6A21ECC6C	82F2FD6BF4C61A5B71DC0AE2B093772CD54B811D	FCC789EBD4C233A4E58BF5935417100B1EA1B68925F0704FB0DB3A62DF427001
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9D8214F5-82F5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	CC8534FBC7439FEBBBC0AE5C0CAF06E2	C2CE2AC5112C6C5A51EC5AE41C1F3BDAACE52B9C	FA6F822850C587906866FB795F5100F63439C35DC844FF544242D68D958ECC5E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9D8214F7-82F5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	67E7B5D51B259C740970987945AD747B	ED068F588166F81435D262CD6712B64F8363ECCE	980E58F330123985473F48DB886CE7C8F865A84FDD2ACFEA09900380D1115F3A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A41EBAA7-82F5-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	817CDC78A1F4B11B6BE8BF689A2AEA51	D7E81FA2583DE34BD2D43C31C4ED0D47611DD890	DA05876FFFCEEA11E89DF0AEAEE5D6994CFA947A0142233103BF30859A8D03FE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	BAF30D639FFCBD62418BBD20F21B9128	BD6A8457696FC265EC0794951B0D7F9A50841674	FF09470899B4E853B6230CA9053E621AC750F9BFD077DC4C0E0051C76E67D348
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\3692194074184385[1].js	ASCII text, with very long lines	A13CDF06014F27CB8A596A7B3A8C8091	24531986C6AA1BBD237FD7717CFDF475CDF8F580	72385F177EA21DFF880FA37C1BF601510238950D9BE3A73C75E75DD64B5943BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Chart.bundle.min[1].js	ASCII text, with very long lines	857FC46BDCA5BF534CF9ED111E732A01	81639A5F38C61EDA919D85F55CDDC5BEFEC6946B	5C5DBD081C14D4C58B686127B042E8814E98EAB71CE670A4861C7CF6714C2034
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SIP-LOGO[1].png	PNG image data, 702 x 167, 8-bit/color RGBA, non-interlaced	821922DAB4D2A24FE0D9722386282742	2E1954871A1D563B5B286E95A6741170FA557591	49481C79F5983346A3C32611B4DDD9039E5DE6BAEB1F58B60BFEC1A77759FD5F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SLXLc1nY6Hkvalqaa46L59A[1].woff	Web Open Font Format, TrueType, length 25340, version 1.1	D9E84CE704928B115F837CACE123FFC1	E49D105D32FE5345F3A9B89B74D69B6BBF89FA5B	199BD3EBCB5123A05CABAE0C7C4BBDC7BAD0D2A305ADDFF84CE8F6035871DA85
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SLXLc1nY6Hkvalr-ao6L59A[1].woff	Web Open Font Format, TrueType, length 26576, version 1.1	3387DE207E454BE0F90F13AE0591D061	D4180BCF1744F9B43F01BA94622343A2E1E0BA81	9A34815E87940A5FC5D876CE9F0E428511514BDFA8F56E6EC36178FF88BEB200
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\analytics[1].js	ASCII text, with very long lines	6A10EB2BB5C90414980729F4F96FFBDA	8BBBD5948255549E4B691B614AA3177DEA9AF1B7	0F3BE44690AE9914AE3E47B7752E1BDEA316F09938E9094F99E0DE19CCD8987A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bootstrap-datepicker[1].js	ASCII text	89D1F1801633D18C28A336BC3A2AE883	8B948AEC3C7BC82A99CD8F15D9189AFD0AA2CD32	FEE49230655DFFEF96061B835C40863D214F9E7209A4680C27490B8CBFB383D5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\bootstrap.min[1].css	ASCII text, with very long lines	472076141D2B09EABA3482172B347A04	24A42D87B7B8413EBE7BF30E9BEFFADAE9C163AF	E3680AD7E2D576044BD0EE1EBF998CA36159EAD8D1D970D3613E750B6D7DB550
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dore.script_min[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	E61A5985C7DB31DF5CF9B5BEC9992DED	F2159E8017609A83E3316A022D5A3BD39CC12BBF	9813567A1F8BD7737F06A21B3122210FC1C87E343EB351062192E8E5C50268B3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fbevents[1].js	ASCII text, with very long lines	1DE516A5B6B1C6033B92EE5F5D50C140	9E37DA5D5D789074D1DADD60977A9575A6332DD5	9E7EA2B4BA8E2BCC4A964D6192E4671DC5F6863A1C7E35B52B229A3C1E67A68D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\forgot_password[1].htm	HTML document, ASCII text	5F8DF352C1720CFC2DFB109B76D55864	7017224FDCE108054C9692152E3C5930A318BD1A	692A930BBCF60EA1019A9C7C8551D3E1B9A54394A4CCA4BA8CE4D6E1470F9869
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\iconsminds[1].css	UTF-8 Unicode text	72FE05FE893B64280E9C11B2A17A6982	AE22A191B094ED2CE150016EA476DCBED0DE8CCF	B2FD606B66B0386FB390EB9AD1D94701454B9909D49D889E2C175CA129BAD38A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\main[1].css	ASCII text	02ECB29E1DC91BF9B4D4647D55375B09	14D315C7C416488F0C6E2ED3A6CD649B46D4FC45	35356A63F45B480A2BD7A9975983CBBAAFFC94B5D91D06E827F5B28D24C562CB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\owl.carousel.min[1].js	ASCII text, with very long lines	F416F9031FEF25AE25BA9756E3EB6978	E2A600E433DF72B4CFDE93D7880E3114917A3CBE	A53C43F834B32309B084EA9314DF8307E9C78CEE2202C6E07F216AE4AE5B704D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\progressbar.min[1].js	ASCII text, with very long lines, with no line terminators	EE1A64236303E8B872D40FCD752BC976	E1C68F63673AC151A93B2700BB4607E1760FDBFC	3029F6C73EB2FA7BD400B813A2AA324775CF5C19BECE555D3A962A7A2F3BF332
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\simple-line-icons[1].css	ASCII text, with very long lines	FE133CCCF11BBB98906FD0B48610023B	7AAC45E00F2903E99733A94599AD137A97EE69C3	1E23FBC5DE093F09EBC532A59063410FDBD756719F6B72BAFE0C2DC92768DF91
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\3692194074184385[1].js	ASCII text, with very long lines	A13CDF06014F27CB8A596A7B3A8C8091	24531986C6AA1BBD237FD7717CFDF475CDF8F580	72385F177EA21DFF880FA37C1BF601510238950D9BE3A73C75E75DD64B5943BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\3692194074184385[2].js	ASCII text, with very long lines	A13CDF06014F27CB8A596A7B3A8C8091	24531986C6AA1BBD237FD7717CFDF475CDF8F580	72385F177EA21DFF880FA37C1BF601510238950D9BE3A73C75E75DD64B5943BB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\SLXGc1nY6HkvalIhTp0[1].woff	Web Open Font Format, TrueType, length 25868, version 1.1	2BDFAB9E18459439147F2F81D7E305D9	1E624CA75788BE195E680341671229FD5AFDB9EC	94E63C42B7F69881022790DDF1BD04C38D26E5FA213EFA3E10D1AACCE715B8E2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\SLXLc1nY6HkvalqKbI6L59A[1].woff	Web Open Font Format, TrueType, length 25652, version 1.1	6858C8D271FAB6E8B98CF0AF912A079B	B7DC826AC89F1B37DBB1252355033948633A25FB	A9F327EB39641FC5F73BD2D868C87B38124084C0DF6FAD202685C446107AAA29
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bg2[1].jpg	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 560x740, frames 3	A4A1E64938686F601048DB1FEED42078	FDBA434EC894D068D771C87F329335BE29951922	EDCFF7B76EDA75A99C9E55C8743FC4B477BAB35E7577A244023F4005FC1E0307
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bootstrap-datepicker3.min[1].css	ASCII text, with very long lines	9A3DB8BD91A81212BAA4AC44C241DFAD	C0C6D1E38B1E9277FBB49D894949E0A1B7933F4E	9A52891414B58DB670C03AD90F50293BB6054BA300D570CDDFB8D9F460C50BAE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bootstrap-tagsinput.min[1].js	ASCII text, with very long lines	65BE147263EF1BA6A002AFFB197B2B39	99367D8587DAB68ED78B8A9C2EB1F122E06645E4	4C87907F1E5D9DDB1320719688C7112F6F87321A933D548D188E2A2B9EBE2F63
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\bootstrap.bundle.min[1].js	ASCII text, with very long lines	6C9E58BD75DE51AE8C63CD00802B5DD5	3CB4F090A2CB698EAB3FE2CB7DDBE744A4088264	F0E3F4CDC282DC2223FA74F47F49BF78CF0D5EAD8B667F6C431E390A2ABD1C19
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\custom[1].js	ASCII text	0B16BCE7E5DA229927E945DE752F13D7	292F7B711CB2E746AE37A87F563EF1FC34E1FD9E	488D4C45156AE96E832BCFB04376E21A48404E274B2CBD94FED674A4ADB4CF8A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dore.light.blue[1].css	ASCII text, with very long lines	F015BEB6CA0B059C9E55A13CF607B71F	D2B32B0E535B91D1E5D5BC0E6CC949445D74CE74	044E7151076143A62FAB2A691F83D7DCDD5D909DBF375B887ED5DEBE15B10113
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dropzone.min[1].js	ASCII text, with very long lines	BD1B5BCF093460FEB610EBC1EB06BC9B	48189456EB8B3044EC6A8C712ADC125907DB600D	467C64EA589AD8664B7E47B610AC0A58F8F2D2ADB0096EBA48DD602825EAB8AE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fbevents[1].js	ASCII text, with very long lines	1DE516A5B6B1C6033B92EE5F5D50C140	9E37DA5D5D789074D1DADD60977A9575A6332DD5	9E7EA2B4BA8E2BCC4A964D6192E4671DC5F6863A1C7E35B52B229A3C1E67A68D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fullcalendar.min[1].css	ASCII text, with very long lines	96CDA8D2E47C268081C161134B6EC616	D387250C99A602A2D3FA4A16BB12A5FFACD0BE7A	4EEDC337EE64C2B87397384D50CB8686DDA1EDC47A01180A7187A607DBB94B30
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fullcalendar.min[1].js	data	6C6CAD1AC091EE3C57552592D4C98BA1	8A96464A74BE4E27F0F47F37A64CABC5D0AA0D37	42F84FABE7AF36377C272C52394E4A2F78CF6130FBFA05957AFD4E1FBEB748BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\login[1].htm	HTML document, ASCII text	BCFEF94198F1335B23D33D75F059FCA0	2C848901B36271E1B9134FC9C552CA35B4C61135	6153DADD4AD835814C9A7EB2674EB9E12077856BB37F105476E694094B0607B5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\owl.carousel.min[1].css	ASCII text, with very long lines	B2752A850D44F50036628EEAEF3BFCFA	FBA46353CF90450EF3D362A123F1E7AF3E8C561E	521410E1FC44780061E09ADC980275FB5EA277FD5D9E538454214EC4379FF4BC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\perfect-scrollbar[1].css	troff or preprocessor input, ASCII text	881E99BCA5E7BC7E63FD44D1AFF6F4DA	07EF2B3448F01E3D38B918F5E749E608F7B2DAA0	BCCBB2172EDAC964DB819164EAF09C23749CA656B9B2490A46ABB499AD00E9EA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\select2.full.min[1].js	UTF-8 Unicode text, with very long lines	D53E9F5D63ED6E33DD7C368B85851658	364E381DB0E161BF830AEF37361650FFF0458177	BEE70B9AB8DD7E2F58C23198FF7090EC79DC705492FD7452D4CFF793F1435C9C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\select2.min[1].css	ASCII text, with very long lines	9F54E6414F87E0D14B9E966F19A174F9	AE5735562FAABD1A2D9803BBD7BF4C502B5E4F51	15D6AD4DFDB43D0AFFAD683E70029F97A8F8FC8637A28845009EE0542DCCDF81
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Sortable[1].js	UTF-8 Unicode text	DA8EDAEA9AA40564E0497860AE7313BE	CA14CA33A587D188B1FA44A01E7AD896CBF9F60F	4B065A2D2AEB5AAA97E1D446C680B96C46212215F801B33D2F951B14ED14326F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bg1[1].jpg	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1080, frames 3	A4A39FF6BEA05BA9489FF1ED16927CAC	AFC933ACC54CE6F7C4510F0F09B567CBE18C2317	9B262AF6371AB67443072A1E8E4ABE85A7BCDB370D13AE5E48BA5BC04FA435D6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-float-label.min[1].css	ASCII text	6004A0676F4766F453E9B57871D22C69	B6AACAE90635D91C69EC77E461B75B567F740394	CDBE293C2FCC357A96B0FDF21612B3A099226AE821A5B0D571615EA277649DED
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-tagsinput[1].css	ASCII text	01A1887ADE863EF0E0943FC5440617BE	E28CD86BC71C5CCFB3B7F7306331C67A04346875	F9D29846B772F9C28FE4A0FFE266BF4411A7E7B4650898353AF2731A4B3F1359
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.rtl.only.min[1].css	ASCII text	34FE5B5195DE33B9C1EB48B2F7DB7833	22DD22EDF5C69E4B913F50BF9D8D910A70B480CA	DCE1D13CFA37A401BE7944C0ADCF4C24C20F611B5EBE2121AFE1F083091F58CB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\cropper.min[1].js	ASCII text, with very long lines	97CD7F22E801FB43667D2DD99B5669B5	B159480635DD641AB16B816E74238E61FD1F4387	3BC88C6363A317ADF2BE8E64151965C8ECAE2AD8ABB88F5E2A65F314CC8F41A3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\css[1].css	ASCII text	1568D3C9A5BE898C777B0FB846603DD1	B79B8530B8C4AB156E19C097F8F9B6FB456DE54D	437DF9B897631B714FAD139CD108684832C3B7496447EE3B6D3A2CC00A876A03
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\dataTables.bootstrap4.min[1].css	ASCII text, with very long lines	DA05621C19688241057EA5B1B3852E77	373E1D9AC771636B809A5BF3E542B4BC23AF2D6E	2E9CA44DD8CC9BE8D52E90D68983A41FC6D88A2B616F881A8CC627227823D76F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\favicon[1].ico	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	4CA9983F34F91EFF31C8AA46967F4DBE	560FD22275900356D1B6A64128E24E18098296E8	71CD683F276EB53C04C71033EF8B7BE815853C252A2400BEAF8AA8EBCC3E6CA1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery-3.3.1.min[1].js	ASCII text, with very long lines	A09E13EE94D51C524B7E2A728C7D4039	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery.barrating.min[1].js	ASCII text, with very long lines, with no line terminators	9C1A04CD4A8ABCB9677E9E372F692712	260DD4D4752EB57B8F770F0A1604BB814CB3E7C8	28ECA032AA32DE5D2AD0E3851D957357F1A393DD40B01598B40C11443D853CD9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\scripts[1].js	ASCII text	5B8BAF56A608F2E9D264D84A54DF8FF7	F6D75BB9121A4F1EDF3E70BF8D336B43041536B8	E6F25BC5269C949407D81532AA93885C4D700610F57CADC5BA4E2A4216E1D597
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\select.from.library[1].js	ASCII text	E138C20474C162234B9D9CE6F01690B5	6B735F180F3562A751E70F96382083E1CB3BEEDD	DE33F7F24E9C253164642469230366FBD8595286CCFFA29D641464445EA045B8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\typeahead.bundle[1].js	ASCII text, with very long lines	14E9ABD66295B25D5B1465B2C81B8313	DEDE188EA66748BB6CBA6248E1AFC4358E30EEB9	26B93D8F31EEE7225F121E2CA021994DEDD7ECE99F8CAC6ECB7C62895675E772
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\XSE5RR0Z.htm	HTML document, ASCII text, with CRLF line terminators	4AA7A432BB447F094408F1BD6229C605	1965C4952CC8C082A6307ED67061A57AAB6632FA	34CCDC351DC93DBF30A8630521968421091E3ED19C31A16E32C2EABB55C6A73A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bootstrap-notify.min[1].js	HTML document, ASCII text, with very long lines	35EB2C2185524EECB2B772B667552014	A9EDF0014D98A9CB514C61B34D2A4BABB4A1D4C9	2DB9DE4F5FC27837D4295DF39D94C34CCC336C31D02322F7F7CAD69AE8E338DA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\bootstrap-stars[1].css	ASCII text	EB774A674334E53F37C34CC6C9E74876	8AA2173ADF5F597FC886156FB3C2D4702374BAF2	2BB6AB50269B445424551594377459C34FEA150551778056E6E75413FC37F453
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\chartjs-plugin-datalabels[1].js	ASCII text, with very long lines	E87E5E7879E13B4D94E1C09508DD5D00	C98D2FE55084E172648C8DDD4B949D648386D095	BC43093DCB8C8666F25E661E29B2E0ABCC2334561CD12650EDD4A4C09120AB6C
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\component-custom-switch.min[1].css	ASCII text, with very long lines	DB4E5EC19FB2D76F982FA8222FD62E5E	9510C1189F25A40268CDCFE86DE0229CC9CF5B06	DA354292BA92485D07718219A7367B1625B1ED3D585B6E4916E7DC728D39D5F5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\custom2[1].css	ASCII text	79559E92849750E4404356D466BC047E	833C62B5CDA7734E6C19EEA2BA065236F5E51458	7AB3329DD5505EEAF31533C70A390D4C76D55CCF29855858523CC0CE6D995917
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\custom_temp[1].css	ASCII text	2C3A77EC10482B966B6C46D9DF60F828	587A6E0D502CA2B0ECC65E890F12B841F9EDA0CD	241DA66F5ACAA879E18D55C1C218FEDDD7CF5C856A50BA43CF4D720251CE01C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\datatables.min[1].js	UTF-8 Unicode text, with very long lines	6EF72003834C8A7B64AD7622523B9A5C	BD68DB21D7DE95BC8BBC4B9048D67C76A0363B8C	A7EF0B0553A4CD9FB7692888F2942A73ACF50B20ECC8CBC43E1CB63C519B210F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\datatables.responsive.bootstrap4.min[1].css	ASCII text, with very long lines	7D8EB4F81E79C8CFB1F95C50D9E43BFE	A177FB404C6258A20D2B7E43F23DF0ADA95CCA83	42BA549624C73F034D969840FB0355FB3456565B600D3E84834717540074E212
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\fbevents[1].js	ASCII text, with very long lines	1DE516A5B6B1C6033B92EE5F5D50C140	9E37DA5D5D789074D1DADD60977A9575A6332DD5	9E7EA2B4BA8E2BCC4A964D6192E4671DC5F6863A1C7E35B52B229A3C1E67A68D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\googleAnalytics[1].js	ASCII text, with very long lines	C4F4D04F067F5BCBF84331575F3354D7	425982AC55BCE895A5EAA65DB837D8A009BFCA28	B3A3056391CB654FCCBE3E9D40B57317542EC0EB7EAC0C73D7378B2F5801B890
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\jquery.validate.min[1].js	UTF-8 Unicode text, with very long lines	8A25965D822705F957A243443D219787	0DA4C535B50BDB4DFFA3B5FAE3E999AEEE137CB5	B0F074179D185032B4A2D0E7B1F3476B0626039334A638D47F84EF44990616B2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\login[1].htm	HTML document, ASCII text	BCFEF94198F1335B23D33D75F059FCA0	2C848901B36271E1B9134FC9C552CA35B4C61135	6153DADD4AD835814C9A7EB2674EB9E12077856BB37F105476E694094B0607B5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\moment.min[1].js	ASCII text, with very long lines, with no line terminators	1F0BBCB4AFCD2BE9560F4910C5229760	859F0365C78D8472D8882A96781AEAB35C561E88	F5802E076567159349FA529FA5A43774A413F7F0B48F755495AEFA8476E2545F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\mousetrap.min[1].js	ASCII text, with very long lines	C267E0135826E8B2871A1F3619736C88	20A3FF7D5695B759E561EEA508261D2510A8FE99	7C7CE3B1A8C8830583BE7DEB7F76F52317575F83E822697BEB7FFF29C41A038E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nouislider.min[1].css	ASCII text, with very long lines, with no line terminators	747F2FE367DE3FA7711A0D76A832CBD8	AAF34B3BD290C91B335C80DC684ACC2A9AB7E646	B64629ABE5DDAB83D034D1910CFB47DC6E796AE641E3E921FD103CD006E781AC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nouislider.min[1].js	ASCII text, with very long lines	EEC731F0AFC75DB94584CA89AB39D838	C2601CDCD6D455FA15F8E245E49470166C5439BA	201E76E12BE19DEAA5FA7BF5C1057B38AB1C707361C7C3AFB0699B17A58268CD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\perfect-scrollbar.min[1].js	ASCII text, with very long lines	3D20CACCC3D9ADF7E0509F4390140FE4	050B4BECCA5865C78B48C3BB16A33339ECB33402	9B237657BA86B4F520DCBE7AF367B6B566B07E66385258442FD219A80D58629E
C:\Users\user\AppData\Local\Temp\~DF08F569E9D6AF613D.TMP	data	B80CEBE7A36CF7728D27AD3146D686E7	A29047BF1CC21FEEFA6D8D9DDA4BE0EDB65922D8	EC7C57333C52F47E820D02032548E9BA7AE6A3A624D279DEF25B1B3E0C87C5E8
C:\Users\user\AppData\Local\Temp\~DF9417F44143076A8B.TMP	data	89901460C3471AF5310EEC60EF894EBD	E40AA84C2C2FAB8C968C6E66A82C4688694623FC	CE45B2E1C2DEBC9796F178F7AC39AD5AAA243CCA58217E126ACE00B6D4BECCB5
C:\Users\user\AppData\Local\Temp\~DFD785E640233A2FFA.TMP	data	ED08DF63049DFE4CF6E8E9FD92129B09	85D20AFB98C23AC2556FAB61235798C704EF48FA	CB9D098413C369C4E4EB9E950818DF7888E5959656441CDEF95FD0D0E749A5D6

Analysis Report http://www.covid19-siparadigm.com

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing:

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs