Analysis Report http://covid19-explorer.org

Overview

General Information

Sample URL:	http://covid19-explorer.org
Analysis ID:	376194
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Allocates a big amount of memory (probably used for heap spraying)

Classification

Signatures

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49707 version: TLS 1.2

Software Vulnerabilities:

Allocates a big amount of memory (probably used for heap spraying)

Source: iexplore.exe

Memory has grown: Private usage: 0MB later: 127MB

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: covid19-explorer.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: covid19-explorer.orgConnection: Keep-Alive

Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: <button id="facebook_share" type="button" class="btn btn-default action-button" onclick="window.open('https://www.facebook.com/sharer/sharer.php?u=http://covid19-explorer.org')"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6bd38270,0x01d721fc</date><accdate>0x6bd38270,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6bd38270,0x01d721fc</date><accdate>0x6bd38270,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6bdaa988,0x01d721fc</date><accdate>0x6bdaa988,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6bdaa988,0x01d721fc</date><accdate>0x6bdaa988,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: covid19-explorer.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Mar 2021 20:56:15 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveAccept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 857Keep-Alive: timeout=5Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 55 df 8f e3 34 10 7e ef 5f 31 e7 13 82 93 9a 6d 92 6d 77 4b 36 a9 84 80 83 93 d0 71 12 f0 c0 a3 9b 4c 1a b3 ae 1d 6c a7 3f ee c4 ff ce d8 4e b6 ed 71 0f 68 a5 75 3c 9e f9 e6 9b cf 33 6e f9 ea 87 5f bf ff fd cf 0f 3f 42 e7 f6 72 33 2b a7 05 79 43 8b 13 4e e2 e6 ad 90 08 ef b5 83 b7 7a 50 4d b9 88 d6 59 b9 47 c7 29 ce f5 09 fe 3d 88 43 c5 6a ad 1c 2a 97 b8 73 8f 0c c6 5d c5 1c 9e dc c2 03 3f 41 dd 71 63 d1 55 83 6b 93 35 83 09 44 f1 3d 56 ec 20 f0 d8 6b e3 ae 42 8f a2 71 5d d5 e0 41 d4 98 84 cd 1c 84 12 4e 70 99 d8 9a 4b ac b2 bb 94 11 8c 75 67 22 e9 13 8f f9 6a 6b c9 be d5 cd 19 3e cd 00 b6 bc 7e de 19 cf 3f a9 b5 d4 a6 80 d7 88 f8 34 fb 67 16 7c e6 d0 65 73 e8 83 6b 4b c9 93 96 ef 85 3c 17 c0 7e 46 79 40 27 6a 0e ef 71 40 36 07 f6 1b ee 34 c2 1f ef e8 3b 7c ce e1 c5 67 0e df 19 a2 46 4e bf 0c b5 68 38 fc 64 b8 6a 7c 94 e5 ca 26 16 8d 68 9f a6 14 47 14 bb ce 15 a0 b4 d9 73 e9 cd 7b 6e 76 42 15 90 fa 4d cf 9b 46 a8 dd b8 f3 35 25 5c 8a 1d 1d d7 24 0d 9a c0 fd ce 2b c5 85 42 13 a8 47 80 44 62 4b b8 c0 07 a7 2f b0 89 89 e9 3e 37 3b dd 17 90 3d 3e f6 a7 68 3c 45 9d c9 96 3d a6 d1 38 52 99 10 b2 d5 ad 39 a6 8b 56 cf c9 e8 63 b1 c5 56 1b 92 26 6c 78 eb 46 82 8d b0 bd e4 a4 ab e3 5b 89 1e 64 bc 6a 52 1a d8 54 92 4c f6 4d f2 10 02 46 2e ab f4 ab 9b c3 7e b0 5d 72 ff df 9a f3 55 f4 eb b2 cb 55 5a f1 11 0b 58 ae 23 e9 1b e9 ef d3 f4 46 77 fa cb a9 66 2f b9 4f 26 69 0a 3e c7 c9 b3 2f e0 e4 d7 38 c9 56 3b a7 f7 45 80 0a 40 fd 15 d1 98 25 9b 8e 78 38 9a 5a f2 3e 5f e7 f8 f0 72 df 0d d6 da 70 27 b4 f2 5d a2 42 bb 96 8b d0 ea d4 f2 8b 38 a4 b3 d2 37 30 ed 1b 71 80 5a 72 6b e3 20 c6 ae 08 38 b1 61 18 88 a6 62 68 8c 36 34 19 00 a5 3d ec a0 0b 15 54 2c 4b 53 16 c5 8e df de 81 5c 7a 2d cf 3b ad a0 d7 42 39 02 5e a5 f3 7c 45 dd 32 5f a7 b0 ce e9 3f 03 eb 8c 7e c6 44 52 ba bf c8 ab 62 61 ca bc 9d 68 56 ac 15 52 16 81 7c 74 2c 5e b7 ed 9a 93 5e 63 5c bc 60 7a 0b 16 63 4a cf 18 4e 15 5b e6 0c ce 15 7b 5c 32 f0 18 15 1b 03 d9 f5 80 56 ec 32 58 ec fa 4e 2a f6 ed 8b ab bf 38 8f d7 9f d8 e6 15 3d 5f 94 20 d4 bf 20 01 e8 e3 5a 38 ea d6 a9 f4 1b 39 43 d3 65 f9 78 76 7b ba 27 a5 13 41 92 47 b1 8f dc 28 9a 0a b6 29 6d cf d5 e4 34 9c 82 47 5c 68 90 91 9e b9 0d 31 20 17 5a 08 6d 42 26 ec 2e 8b 4f ae a2 27 b7 f5 62 c2 37 cb 74 09 e1 e6 de d0 b5 67 23 c3 29 ec f2 f1 7f 2b 79 80 9b 39 ba 94 d5 4f 8e be f5 d9 e6 5d 0b 67 3d 80 eb 84 7a 86 63 c7 9d df 7e 6d 10 a4 d6 cf 54 24 d1 33 60 3b 3d c8 06 b6 48 cd e4 47 be a7 58 8b 61 b0 79 ed 28 18 c1 0a 87 a0 8f d4 90 77 e5 a2 ff 32 fd 71 a1 75 ec e7 45 fc 2d fa 17 8e 62 90 ec a3 06 00 00 Data Ascii: U4~_1mmwK6qLl?Nqhu<3n_?Br3+yCNzPMYG)=Cj*

Source: ~DF8B7BF7AF18EDBAD0.TMP.1.dr, excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://covid19-explorer.org/
Source: {91642A52-8DEF-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://covid19-explorer.org/Root
Source: ~DF8B7BF7AF18EDBAD0.TMP.1.dr	String found in binary or memory: http://covid19-explorer.org/Z
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://covid19-explorer.org/methodology/
Source: {91642A52-8DEF-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://covid19-explorer.org/r.org/Root
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://faculty.umb.edu/liam.revell/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: sockjs-0.3.min[1].js.2.dr	String found in binary or memory: http://sockjs.org
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://www.aidanlister.com/2014/03/persisting-the-tab-state-in-bootstrap/
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: selectize.bootstrap3[1].css.2.dr, TeX-AMS-MML_HTMLorMML[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: TeX-AMS-MML_HTMLorMML[1].js.2.dr	String found in binary or memory: http://www.mathjax.org
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://consultqd.clevelandclinic.org/the-weekend-effect-and-covid-19-mortality/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://covid19-explorer.org
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://covid19-explorer.org/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://covid19-explorer.org/methodology/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/Case-Surveillance/United-States-COVID-19-Cases-and-Deaths-by-State-o/9mfq-cb36
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Provisional-COVID-19-Death-Counts-by-Sex-Age-and-W/vsak-wrfu
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Weekly-Counts-of-Deaths-by-State-and-Select-Causes/3yf8-kanr
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Weekly-Counts-of-Deaths-by-State-and-Select-Causes/muzy-jte6
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Weekly-counts-of-deaths-by-jurisdiction-and-age-gr/y5bj-9g5w
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/d41586-020-03132-4
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/d41586-020-03141-3
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/s41467-020-18272-4
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/s41467-020-19509-y
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1101/2020.04.18.20070912
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1101/2021.02.15.21251782
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1136/bmj.m4509
Source: fa-brands-400[1].eot.2.dr, v4-shims.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com
Source: v4-shims.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: fa-brands-400[1].eot.2.dr, fa-regular-400[1].eot.2.dr, fa-solid-900[1].eot.2.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: ion.rangeSlider[1].css.2.dr	String found in binary or memory: https://github.com/IonDen
Source: ion.rangeSlider[1].css.2.dr	String found in binary or memory: https://github.com/guybowden
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://github.com/liamrevell/covid19.Explorer/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://github.com/scottjehl/Respond/blob/master/LICENSE-MIT
Source: selectize.min[1].js.2.dr	String found in binary or memory: https://github.com/selectize/selectize.js
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://mathjax.rstudio.com/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML
Source: ~DF8B7BF7AF18EDBAD0.TMP.1.dr, 6UCIMJHW.htm.2.dr	String found in binary or memory: https://phytools.shinyapps.io/excess-mortality-explorer/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://shiny.rstudio.com/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=Check%20out%20this%20cool%20COVID-19%20app:&url=http://cov
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://wonder.cdc.gov/population-projections-2014-2060.html
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/library/covid19/092220_covidupdate.html
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/nchs/index.htm
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/nchs/nvss/vsrr/covid19/tech_notes.htm
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.census.gov/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.census.gov/data/datasets/time-series/demo/popest/2010s-state-total.html
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.mlive.com/public-interest/2020/12/covid-19-numbers-in-michigan-and-ohio-rose-in-lockstep
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.r-project.org/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.worldometers.info/coronavirus/country/australia/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.worldometers.info/world-population/us-population/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49707 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/47@4/4

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF7BCFAD982F369F5C.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3120 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3120 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: sockjs-0.3.min[1].js.2.dr

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
148.72.88.30	covid19-explorer.org	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
52.4.17.40	phytools.shinyapps.io	United States	14618	AMAZON-AESUS	false
54.230.114.89	mathjax.rstudio.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
phytools.shinyapps.io	52.4.17.40	true
mathjax.rstudio.com	54.230.114.89	true
covid19-explorer.org	148.72.88.30	true
favicon.ico	unknown	unknown

ID:	376194
Product:	CloudBasic
Start time:	21:55:15
Start date:	25.03.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\Y9XQXJWN\phytools.shinyapps[1].xml	ASCII text, with no line terminators	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{91642A50-8DEF-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	479552104829A801F451642FF78FE331	D977CF508268300BF7EA35FF5CAABE1E5B946055	36C771F7E3F6F712001F530AF655B41C114788950980EAB7C792C6A45C2179A7
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{91642A52-8DEF-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	8D0114EDEE253C35D35CF591D192C90A	58DD5B2EF859B7D998A8A1927307E8DDB961FE17	94DFDE56DDBF9B8D4084B3D1BF8A030378136B3ECCA92C7749B479C1C31AF1EC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9BF966F4-8DEF-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	93EF737C04ACC09CA69C2E70CED5D286	B4048F3A10E6B9867B57BEF7F0B63D4B9862F3BA	690B990E5FB210BADEEC2D5CEE4AAECF940220F06189EBAB69D907DEC155B08F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	023C379D7A79B09C2FF7275E7A7498DA	7B9B8F3BDD988754A1CBB2DAD2FDE61E9A644A23	8F7E687A6030811C17D5CD6711CD35A3CE7F683DBA4B4D9B0C37F2D09BC123DF
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	DC3FEE6268DF7F2D51E5D3AFDEB0474F	E8AC19239F4DEFE2213D9B7099C809E649F04C6A	4B77C9EEF865AA38B9B8A76B5DDE669ECE9B7F492CC5EC00163BA8D1A0DC8F58
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	A7A1F19B987E0A42E7AB8A3299F2A2C0	9D2B9E318E8B4CA1083737EFBDCB7CDD4F6C6777	41C8890CE50CFC55D098640BC9292FCC1ACDC83171D254486188523E4E6880C1
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	91785B3CC2013E8E9381894BF1E16336	3180BFA98C7073F10C8DF88D5E230CC48834BFCB	B9B469C0208E6651A497F881BD68A42242AE8C69E82DD8FAABF386D3BD7759BC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	083A846875BA3D466226452919B66A23	50CD00FAF732D1033E61BB187933B1D91E7DAA9D	5574CB1C415EC08CC7F2B2BB0A46B57F37ACFF3930052014D87578B43FBBD95A
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	EDAF44D4E283EDA9585DFA014B3B86AC	5FBD9B83D958CBC8E7C9E50A501226BF0A734325	67290699D6E14ECDEA034BA7FF4D608CDE539162784C8EA537F560902DEF6815
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	62384AF721AF6AA7505D56F4FD172B49	94A0A82459AE6634FC365E6587DD8C3B7EE238C9	967CB2F10360E0F9B36799DD18FF02B8C017A53F57E7D5E83635B0E465064FDE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	B220EA1B74BE2A2FE7FEC67376B40608	AF7C6DD570A67652F57F615B9F815D0E34D32F94	EE02CF619ADB53ED022112297F029344C6BB9E88D1C3537FD644B624624AFD47
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	312A79D9EBA24A867688BDA46E9670B8	BBAD08EEEF93D0F370A16D69A0FA51C2D641DB8F	7FDD96764956CF3D081607A5ABDABE2717677BF5C4D0575DFDDEE8D8C3678F43
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\TeX-AMS-MML_HTMLorMML[1].js	ASCII text, with very long lines	544F69A31055E5AAE4C4F1606C38F947	95BF665AA24EFD6FC0534665A109C1E936FE9872	E7F6012ECB5ED7654B2D8E6B7E77F8FBE2706B0746D4A356A9D6D026287DEA12
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\shinyapps[1].css	ASCII text, with no line terminators	934060D19DBDCA5AB4A887236264E253	7905BDBC8ADF127AA7DB0ED1E41E91C5C50CC96C	989CD652042EABFB7B7638C43E38168112DF34AE7DC62445E8EFC42E4920BF96
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\MathJax[1].js	ASCII text, with very long lines	359B9C63CB3BA43384B2995E5699A63F	8B72E446CB6E9C7CD5B249D9122355668DCF0A2C	7C2B61DE9D81E1C64CCE5AFB3858B39A8E5191D2401C9E2F387A44EC568D711F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fa-regular-400[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Regular family	261D666B0147C6C5CDA07265F98B8F8C	6299F0E32575F73D8D897F87CE899827F99E20FE	01F4416F5DB59E2DD6B6FBD9DC32336D99DB18F7EB623A49F584D04AFD279473
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fa-solid-900[1].eot	Embedded OpenType (EOT), Font Awesome 5 Free Solid family	A0369EA57EB6D3843D6474C035111F29	5BE5944A17E8B32589A12FDC2B8A8570C9081DB4	32501727BB23FC77615B1EC76B5F298EC22198C0F3D6A3E7D6FE4AC3CF315DB9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\all.min[1].css	ASCII text, with very long lines	76CB46C10B6C0293433B371BAE2414B2	0038DC97C79451578B7BD48AF60BA62282B4082B	876D023D9D10C97941B80C3B03E2A5B94631FF7A4AF9CEE5604A6A2D39718D84
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-accessibility.min[1].css	ASCII text, with very long lines	57B544398FFFEB9F4EB942F2CE7C6E09	499908245BE72042C64BABC932E978DD43AFCD9B	CB60EC1A51BE84DCC9C9FBE6AF25B67BBFA4FDE4D86D8DADFC277834B381DA2E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-accessibility.min[1].js	ASCII text, with very long lines	E10E34E3584B24FF7432C46182855A37	47FEA953B15B3703F0E0BBE0F78B6B026426C869	5A81853E5DA3C04D1D06C9EE0FBDDE274C5FDE59C88E8F3B81BB6CFCAC873B01
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-datepicker.min[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	6EAEDED4F97DF44D364BFFFB3C32E8CB	6EF8B03BE83F52B5AFBEF55E1ACB9861BD0FE0AB	5285258B3CFC46781D9100E3564014CF706544D36430E111B4967FA0DCF948C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-datepicker3.min[1].css	ASCII text, with very long lines	008EA2A443A98505E7CD25577AE84BA3	B0AEC72164EE07609FBC9C25375FD6FB39D5172F	85E4193F500642647681F64788A1322E8A8348E2AAE5E9E361E893B06C1663D6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.min[1].css	ASCII text, with very long lines	7F89537EAF606BFF49F5CC1A7C24DBCA	B0972FDCCE82FD583D4C2CCC3F2E3DF7404A19D0	6D92DFC1700FD38CD130AD818E23BC8AEF697F815B2EA5FACE2B5DFAD22F2E11
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.min[1].js	ASCII text, with very long lines	2F34B630FFE30BA2FF2B91E3F3C322A1	B16FD8226BD6BFB08E568F1B1D0A21D60247CEFB	9EE2FCFF6709E4D0D24B09CA0FC56AADE12B4961ED9C43FD13B03248BFB57AFE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\excess-mortality-explorer[1].htm	HTML document, UTF-8 Unicode text, with very long lines	C9F9CB561BF9192A90D43012465633B2	9607A88B0BEC8B45014483BC75F2EB15268AEA19	2B0156CB7821F4BDE6556B648E9B7483A79363222850E8F22DD4E87CD4AB555D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\iframeResizer.contentWindow.min[1].js	ASCII text, with very long lines	D840E34B94ED7AD2AC5D2D6E7E9A8678	40248F5541E0DE44C6F44F4CADC9970AF358D983	63B5085014A66AF8D0D56AFB98BB13F69A4C4F21C3C0E2CC63B30FE8C75A49D9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ion.rangeSlider.min[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	679FE9D3F4D39A67C65C3CC6FCA57F01	468D43FEA0C0C742105B30E40FD513BD9BA915FE	086AEFBC27154D449B6B5556806C38AEA466997F43FCCB9FBD2FD5FC847CDDFB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ion.rangeSlider[1].css	UTF-8 Unicode text	E21484C7FCB0F3C3E6CED25464D2C3DD	FC25A7719C5F4C8728B5F24CDA342288C0701439	E1B92B4247EF49C7F5FD8514F30D14936C1A511644EAF9C939ED6853359F2E09
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery.min[1].js	ASCII text, with very long lines	DC5E7F18C8D36AC1D3D4753A87C98D0A	C8E1C8B386DC5B7A9184C763C88D19A346EB3342	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\rstudio-connect[1].css	ASCII text	510D4D39F16E2E16952DF500DA335ED8	7EABA700F3BE68007AB9232EED251CE487E1CECA	A42AAD34D80A8E7A89FDF48B2E7C57F304E2BA40199BA3496A91F22B61C0B018
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\selectize-plugin-a11y.min[1].js	ASCII text, with very long lines, with no line terminators	CC5A445B4BA126CFE38A051C726EE617	ADA81ADA8F0C759E1EEB360FD4263181DB2966CA	CD66B240690EFF4037679311FFBDE1C935CA459972A4CFFB2155F602D55CA37F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\selectize.bootstrap3[1].css	UTF-8 Unicode text	AC38AD19469B8C594246E3F433A9AD53	6F62EF6618660D468B132E69536BF39927610C5B	BDDF9493D0779E432833F59C6CF33B2668D7883E5A46F8148519CA409569FE13
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\selectize.min[1].js	UTF-8 Unicode text, with very long lines	5949BA84AC0FD20B5585AE06E2398B97	C27D068867C3DCF2CE09A658C7A24D8216EE5298	1F206264524032FC4E859A1639CE4B58859A37581C162F0B8D2EF905917869F8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shiny-server-client.min[1].js	ASCII text, with very long lines, with escape sequences	4F87F96FD7039723A3CA76223721457E	B0118DED71299FDE1D72EBEC4129A72692C4D024	708736DC3077BB8431744D90CA9ED0DBD19E6B1AA2905C99E0D51DDF7AB08B4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shiny.min[1].css	ASCII text, with very long lines	6234CBBD909DA4C9C7DB605E051879DA	E2CF938EE3886ED1E77218D3FF16703EB80315CC	093B6EA79904D8C71A885CF598BE41DF13DAC0F37A9EE2F3E2C999A8D2498989
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shiny.min[1].js	ASCII text, with very long lines	8CFCDF84FAB22B43802AEE3B11DFF084	FD6A419463D580E95C71BAD338C93EE1227DB60F	CBB3E9CA0A65005C629181E3379648B94513117A8752A8508B016E5075F21C4A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shinyapps.frame.content[1].js	ASCII text	3C17BE5413E55EE145876DF176D5EEFC	4BE8B9620C2AE3240E8519143AFB03C2FD8FF443	D1FBA73471674224EE3B22EA21F2B6BA6C67593E11600A493D2A51184A3DB08E
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shinyapps[1].js	ASCII text	CEC01ED9FFE3CF03C95E164A1911F274	49EB6E54225E4E080680ECCD6AB4388410423BDE	6DF262627A4FA54C76F35422F766527CE6355054FE1790EFE52A8A46CF7CB588
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sockjs-0.3.min[1].js	ASCII text, with very long lines	12627D123FD6D88A09981A30699A729F	DB1A86B4BE889122CDC744C7BA4A417540BCC61A	B4B6D898C081FEAAF31175668B7A4837CF08EE6480FCE388CBB93FC710646D07
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\strftime-min[1].js	ASCII text, with very long lines	4FEEDFF422885D51BF57601F8A987D70	EED97B8F354E1507FD51403DBEC990D54E421392	921174E7050FD77BA7DF2409EEF7FA0A561E53BC46898470538EF54106C1B9F1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\v4-shims.min[1].css	ASCII text, with very long lines	FB073A92592D70E5AA6E3CCE1CF93A11	B9A847B0E25EC6D3C5A27A97D26B20A9ACF2C1A4	C0DED025AA80C10D37920521C8DE04536A6145D0E42EB4186C57B412FA50EB45
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6UCIMJHW.htm	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators	3A95A2812BB127858D68D6A1CD03B416	8F430EA0BAE0BE3A215C1D0A58D7E9B388B95B08	9F0500D17B626F663DBCF05A90D0BF7D5BAB5C86C4FD869015190E9507C12B63
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\fa-brands-400[1].eot	Embedded OpenType (EOT), Font Awesome 5 Brands Regular family	C1868C9545D2DE1CF8488F1DADD8C9D0	A17DB2A5A355BEFD089BB6E7D53C3D501BF9E827	811E1577184066108CECA86D5A624A9012303DF5206C5CB0B27D5E3FEDCBA5A3
C:\Users\user\AppData\Local\Temp\~DF7BCFAD982F369F5C.TMP	data	5111129B4BF470578D07B43230D58CB2	9EDB4B044194BC131700255218753CE2CDB540CC	12D410B28A014465728EA67C15E3354B7C88BE436F7C77BA1345EA1E125BA08B
C:\Users\user\AppData\Local\Temp\~DF8B7BF7AF18EDBAD0.TMP	data	D80436C8B6C16D583EAFFE1393201212	46AAE078B0CC23C59F8F27C24F756596C2CA55EA	1E5D55A30B364FA6838EE79E5D6A1C3A2053F02691CF0791080E55B3E24D92ED
C:\Users\user\AppData\Local\Temp\~DFA3C694C5B63C32B7.TMP	data	DF17500EC61DD839DD275A5F96E5C67F	977E1849B3CDA60CBE14FBA9070F70A0D7FCAC47	23DCDDE58AEA51184C27ECBBAB45AA67C0A559E71C6182981C3648606ECF05C7

Analysis Report http://covid19-explorer.org

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Malware Analysis System Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains