Play interactive tour

Edit tour

Analysis Report http://covid19-explorer.org

Overview

General Information

Sample URL:	http://covid19-explorer.org
Analysis ID:	376194
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Allocates a big amount of memory (probably used for heap spraying)

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely the sample will exhibit less behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Startup

System is w10x64

iexplore.exe (PID: 3120 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5556 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3120 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49707 version: TLS 1.2

Source: iexplore.exe

Memory has grown: Private usage: 0MB later: 127MB

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: covid19-explorer.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: covid19-explorer.orgConnection: Keep-Alive

Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: <button id="facebook_share" type="button" class="btn btn-default action-button" onclick="window.open('https://www.facebook.com/sharer/sharer.php?u=http://covid19-explorer.org')"> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6bd38270,0x01d721fc</date><accdate>0x6bd38270,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6bd38270,0x01d721fc</date><accdate>0x6bd38270,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6bdaa988,0x01d721fc</date><accdate>0x6bdaa988,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6bdaa988,0x01d721fc</date><accdate>0x6bdaa988,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: covid19-explorer.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 25 Mar 2021 20:56:15 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, Keep-AliveAccept-Ranges: bytesVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 857Keep-Alive: timeout=5Content-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 55 df 8f e3 34 10 7e ef 5f 31 e7 13 82 93 9a 6d 92 6d 77 4b 36 a9 84 80 83 93 d0 71 12 f0 c0 a3 9b 4c 1a b3 ae 1d 6c a7 3f ee c4 ff ce d8 4e b6 ed 71 0f 68 a5 75 3c 9e f9 e6 9b cf 33 6e f9 ea 87 5f bf ff fd cf 0f 3f 42 e7 f6 72 33 2b a7 05 79 43 8b 13 4e e2 e6 ad 90 08 ef b5 83 b7 7a 50 4d b9 88 d6 59 b9 47 c7 29 ce f5 09 fe 3d 88 43 c5 6a ad 1c 2a 97 b8 73 8f 0c c6 5d c5 1c 9e dc c2 03 3f 41 dd 71 63 d1 55 83 6b 93 35 83 09 44 f1 3d 56 ec 20 f0 d8 6b e3 ae 42 8f a2 71 5d d5 e0 41 d4 98 84 cd 1c 84 12 4e 70 99 d8 9a 4b ac b2 bb 94 11 8c 75 67 22 e9 13 8f f9 6a 6b c9 be d5 cd 19 3e cd 00 b6 bc 7e de 19 cf 3f a9 b5 d4 a6 80 d7 88 f8 34 fb 67 16 7c e6 d0 65 73 e8 83 6b 4b c9 93 96 ef 85 3c 17 c0 7e 46 79 40 27 6a 0e ef 71 40 36 07 f6 1b ee 34 c2 1f ef e8 3b 7c ce e1 c5 67 0e df 19 a2 46 4e bf 0c b5 68 38 fc 64 b8 6a 7c 94 e5 ca 26 16 8d 68 9f a6 14 47 14 bb ce 15 a0 b4 d9 73 e9 cd 7b 6e 76 42 15 90 fa 4d cf 9b 46 a8 dd b8 f3 35 25 5c 8a 1d 1d d7 24 0d 9a c0 fd ce 2b c5 85 42 13 a8 47 80 44 62 4b b8 c0 07 a7 2f b0 89 89 e9 3e 37 3b dd 17 90 3d 3e f6 a7 68 3c 45 9d c9 96 3d a6 d1 38 52 99 10 b2 d5 ad 39 a6 8b 56 cf c9 e8 63 b1 c5 56 1b 92 26 6c 78 eb 46 82 8d b0 bd e4 a4 ab e3 5b 89 1e 64 bc 6a 52 1a d8 54 92 4c f6 4d f2 10 02 46 2e ab f4 ab 9b c3 7e b0 5d 72 ff df 9a f3 55 f4 eb b2 cb 55 5a f1 11 0b 58 ae 23 e9 1b e9 ef d3 f4 46 77 fa cb a9 66 2f b9 4f 26 69 0a 3e c7 c9 b3 2f e0 e4 d7 38 c9 56 3b a7 f7 45 80 0a 40 fd 15 d1 98 25 9b 8e 78 38 9a 5a f2 3e 5f e7 f8 f0 72 df 0d d6 da 70 27 b4 f2 5d a2 42 bb 96 8b d0 ea d4 f2 8b 38 a4 b3 d2 37 30 ed 1b 71 80 5a 72 6b e3 20 c6 ae 08 38 b1 61 18 88 a6 62 68 8c 36 34 19 00 a5 3d ec a0 0b 15 54 2c 4b 53 16 c5 8e df de 81 5c 7a 2d cf 3b ad a0 d7 42 39 02 5e a5 f3 7c 45 dd 32 5f a7 b0 ce e9 3f 03 eb 8c 7e c6 44 52 ba bf c8 ab 62 61 ca bc 9d 68 56 ac 15 52 16 81 7c 74 2c 5e b7 ed 9a 93 5e 63 5c bc 60 7a 0b 16 63 4a cf 18 4e 15 5b e6 0c ce 15 7b 5c 32 f0 18 15 1b 03 d9 f5 80 56 ec 32 58 ec fa 4e 2a f6 ed 8b ab bf 38 8f d7 9f d8 e6 15 3d 5f 94 20 d4 bf 20 01 e8 e3 5a 38 ea d6 a9 f4 1b 39 43 d3 65 f9 78 76 7b ba 27 a5 13 41 92 47 b1 8f dc 28 9a 0a b6 29 6d cf d5 e4 34 9c 82 47 5c 68 90 91 9e b9 0d 31 20 17 5a 08 6d 42 26 ec 2e 8b 4f ae a2 27 b7 f5 62 c2 37 cb 74 09 e1 e6 de d0 b5 67 23 c3 29 ec f2 f1 7f 2b 79 80 9b 39 ba 94 d5 4f 8e be f5 d9 e6 5d 0b 67 3d 80 eb 84 7a 86 63 c7 9d df 7e 6d 10 a4 d6 cf 54 24 d1 33 60 3b 3d c8 06 b6 48 cd e4 47 be a7 58 8b 61 b0 79 ed 28 18 c1 0a 87 a0 8f d4 90 77 e5 a2 ff 32 fd 71 a1 75 ec e7 45 fc 2d fa 17 8e 62 90 ec a3 06 00 00 Data Ascii: U4~_1mmwK6qLl?Nqhu<3n_?Br3+yCNzPMYG)=Cj*

Source: ~DF8B7BF7AF18EDBAD0.TMP.1.dr, excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://covid19-explorer.org/
Source: {91642A52-8DEF-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://covid19-explorer.org/Root
Source: ~DF8B7BF7AF18EDBAD0.TMP.1.dr	String found in binary or memory: http://covid19-explorer.org/Z
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://covid19-explorer.org/methodology/
Source: {91642A52-8DEF-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: http://covid19-explorer.org/r.org/Root
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://faculty.umb.edu/liam.revell/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: sockjs-0.3.min[1].js.2.dr	String found in binary or memory: http://sockjs.org
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: http://www.aidanlister.com/2014/03/persisting-the-tab-state-in-bootstrap/
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: selectize.bootstrap3[1].css.2.dr, TeX-AMS-MML_HTMLorMML[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: TeX-AMS-MML_HTMLorMML[1].js.2.dr	String found in binary or memory: http://www.mathjax.org
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://consultqd.clevelandclinic.org/the-weekend-effect-and-covid-19-mortality/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://covid19-explorer.org
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://covid19-explorer.org/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://covid19-explorer.org/methodology/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/Case-Surveillance/United-States-COVID-19-Cases-and-Deaths-by-State-o/9mfq-cb36
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Provisional-COVID-19-Death-Counts-by-Sex-Age-and-W/vsak-wrfu
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Weekly-Counts-of-Deaths-by-State-and-Select-Causes/3yf8-kanr
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Weekly-Counts-of-Deaths-by-State-and-Select-Causes/muzy-jte6
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://data.cdc.gov/NCHS/Weekly-counts-of-deaths-by-jurisdiction-and-age-gr/y5bj-9g5w
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/d41586-020-03132-4
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/d41586-020-03141-3
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/s41467-020-18272-4
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1038/s41467-020-19509-y
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1101/2020.04.18.20070912
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1101/2021.02.15.21251782
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://doi.org/10.1136/bmj.m4509
Source: fa-brands-400[1].eot.2.dr, v4-shims.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com
Source: v4-shims.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: fa-brands-400[1].eot.2.dr, fa-regular-400[1].eot.2.dr, fa-solid-900[1].eot.2.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: ion.rangeSlider[1].css.2.dr	String found in binary or memory: https://github.com/IonDen
Source: ion.rangeSlider[1].css.2.dr	String found in binary or memory: https://github.com/guybowden
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://github.com/liamrevell/covid19.Explorer/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://github.com/scottjehl/Respond/blob/master/LICENSE-MIT
Source: selectize.min[1].js.2.dr	String found in binary or memory: https://github.com/selectize/selectize.js
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://mathjax.rstudio.com/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML
Source: ~DF8B7BF7AF18EDBAD0.TMP.1.dr, 6UCIMJHW.htm.2.dr	String found in binary or memory: https://phytools.shinyapps.io/excess-mortality-explorer/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://shiny.rstudio.com/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=Check%20out%20this%20cool%20COVID-19%20app:&url=http://cov
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://wonder.cdc.gov/population-projections-2014-2060.html
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/library/covid19/092220_covidupdate.html
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/nchs/index.htm
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/nchs/nvss/vsrr/covid19/tech_notes.htm
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.census.gov/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.census.gov/data/datasets/time-series/demo/popest/2010s-state-total.html
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.mlive.com/public-interest/2020/12/covid-19-numbers-in-michigan-and-ohio-rose-in-lockstep
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.r-project.org/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.worldometers.info/coronavirus/country/australia/
Source: excess-mortality-explorer[1].htm.2.dr	String found in binary or memory: https://www.worldometers.info/world-population/us-population/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.4.17.40:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.230.114.89:443 -> 192.168.2.3:49707 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/47@4/4

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF7BCFAD982F369F5C.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3120 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3120 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: sockjs-0.3.min[1].js.2.dr

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Extra Window Memory Injection1	Process Injection1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Extra Window Memory Injection1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer3	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://covid19-explorer.org	0%	Virustotal		Browse
http://covid19-explorer.org	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
covid19-explorer.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://sockjs.org	0%	Virustotal		Browse
http://sockjs.org	0%	Avira URL Cloud	safe
https://fontawesome.comhttps://fontawesome.comFont	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://www.aidanlister.com/2014/03/persisting-the-tab-state-in-bootstrap/	0%	Avira URL Cloud	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
phytools.shinyapps.io	52.4.17.40	true	false		high
mathjax.rstudio.com	54.230.114.89	true	false		high
covid19-explorer.org	148.72.88.30	true	false	0%, Virustotal, Browse	unknown
favicon.ico	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://doi.org/10.1136/bmj.m4509	excess-mortality-explorer[1].htm.2.dr	false		high
https://doi.org/10.1038/s41467-020-19509-y	excess-mortality-explorer[1].htm.2.dr	false		high
http://sockjs.org	sockjs-0.3.min[1].js.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.amazon.com/	msapplication.xml.1.dr	false		high
https://data.cdc.gov/NCHS/Weekly-counts-of-deaths-by-jurisdiction-and-age-gr/y5bj-9g5w	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.cdc.gov/	excess-mortality-explorer[1].htm.2.dr	false		high
http://www.twitter.com/	msapplication.xml5.1.dr	false		high
https://fontawesome.comhttps://fontawesome.comFont	fa-brands-400[1].eot.2.dr, fa-regular-400[1].eot.2.dr, fa-solid-900[1].eot.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?text=Check%20out%20this%20cool%20COVID-19%20app:&url=http://cov	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.census.gov/data/datasets/time-series/demo/popest/2010s-state-total.html	excess-mortality-explorer[1].htm.2.dr	false		high
https://fontawesome.com/license/free	v4-shims.min[1].css.2.dr	false		high
https://github.com/selectize/selectize.js	selectize.min[1].js.2.dr	false		high
https://www.mlive.com/public-interest/2020/12/covid-19-numbers-in-michigan-and-ohio-rose-in-lockstep	excess-mortality-explorer[1].htm.2.dr	false		high
https://fontawesome.com	fa-brands-400[1].eot.2.dr, v4-shims.min[1].css.2.dr	false		high
https://doi.org/10.1101/2020.04.18.20070912	excess-mortality-explorer[1].htm.2.dr	false		high
http://faculty.umb.edu/liam.revell/	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.r-project.org/	excess-mortality-explorer[1].htm.2.dr	false		high
https://data.cdc.gov/NCHS/Weekly-Counts-of-Deaths-by-State-and-Select-Causes/muzy-jte6	excess-mortality-explorer[1].htm.2.dr	false		high
http://getbootstrap.com)	excess-mortality-explorer[1].htm.2.dr	false	Avira URL Cloud: safe	low
https://consultqd.clevelandclinic.org/the-weekend-effect-and-covid-19-mortality/	excess-mortality-explorer[1].htm.2.dr	false		high
http://www.reddit.com/	msapplication.xml4.1.dr	false		high
https://data.cdc.gov/Case-Surveillance/United-States-COVID-19-Cases-and-Deaths-by-State-o/9mfq-cb36	excess-mortality-explorer[1].htm.2.dr	false		high
https://mathjax.rstudio.com/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.cdc.gov/nchs/index.htm	excess-mortality-explorer[1].htm.2.dr	false		high
https://doi.org/10.1038/s41467-020-18272-4	excess-mortality-explorer[1].htm.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	selectize.bootstrap3[1].css.2.dr, TeX-AMS-MML_HTMLorMML[1].js.2.dr	false		high
http://www.nytimes.com/	msapplication.xml3.1.dr	false		high
https://github.com/IonDen	ion.rangeSlider[1].css.2.dr	false		high
http://www.mathjax.org	TeX-AMS-MML_HTMLorMML[1].js.2.dr	false		high
https://github.com/scottjehl/Respond/blob/master/LICENSE-MIT	excess-mortality-explorer[1].htm.2.dr	false		high
https://github.com/guybowden	ion.rangeSlider[1].css.2.dr	false		high
https://www.worldometers.info/world-population/us-population/	excess-mortality-explorer[1].htm.2.dr	false		high
https://getbootstrap.com/)	bootstrap.min[1].js.2.dr	false		high
https://www.census.gov/	excess-mortality-explorer[1].htm.2.dr	false		high
https://data.cdc.gov/NCHS/Provisional-COVID-19-Death-Counts-by-Sex-Age-and-W/vsak-wrfu	excess-mortality-explorer[1].htm.2.dr	false		high
https://doi.org/10.1101/2021.02.15.21251782	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.cdc.gov/nchs/nvss/vsrr/covid19/tech_notes.htm	excess-mortality-explorer[1].htm.2.dr	false		high
http://www.aidanlister.com/2014/03/persisting-the-tab-state-in-bootstrap/	excess-mortality-explorer[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://doi.org/10.1038/d41586-020-03141-3	excess-mortality-explorer[1].htm.2.dr	false		high
http://www.youtube.com/	msapplication.xml7.1.dr	false		high
https://wonder.cdc.gov/population-projections-2014-2060.html	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.cdc.gov/library/covid19/092220_covidupdate.html	excess-mortality-explorer[1].htm.2.dr	false		high
https://shiny.rstudio.com/	excess-mortality-explorer[1].htm.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	bootstrap.min[1].css.2.dr	false		high
http://www.wikipedia.com/	msapplication.xml6.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.live.com/	msapplication.xml2.1.dr	false		high
https://doi.org/10.1038/d41586-020-03132-4	excess-mortality-explorer[1].htm.2.dr	false		high
https://www.worldometers.info/coronavirus/country/australia/	excess-mortality-explorer[1].htm.2.dr	false		high
https://data.cdc.gov/NCHS/Weekly-Counts-of-Deaths-by-State-and-Select-Causes/3yf8-kanr	excess-mortality-explorer[1].htm.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
148.72.88.30	covid19-explorer.org	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
52.4.17.40	phytools.shinyapps.io	United States	14618	AMAZON-AESUS	false
54.230.114.89	mathjax.rstudio.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	376194
Start date:	25.03.2021
Start time:	21:55:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 21s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	http://covid19-explorer.org
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@3/47@4/4
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.193.48, 13.88.21.125, 23.60.220.29, 40.88.32.150, 13.64.90.137, 104.42.151.234, 95.100.54.203, 152.199.19.161, 20.50.102.62, 93.184.221.240 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, wu.azureedge.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ie9comview.vo.msecnd.net, wu.ec.azureedge.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus15.cloudapp.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\Y9XQXJWN\phytools.shinyapps[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	low
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{91642A50-8DEF-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8562954606754327
Encrypted:	false
SSDEEP:	96:r8ZrZj2LW0xjt0xmf0xC1M0G0o0yf0jsX:r8ZrZj2LWejtemfeC1MpHHfosX
MD5:	479552104829A801F451642FF78FE331
SHA1:	D977CF508268300BF7EA35FF5CAABE1E5B946055
SHA-256:	36C771F7E3F6F712001F530AF655B41C114788950980EAB7C792C6A45C2179A7
SHA-512:	3345624AE00C8FC994610378687CA769C84A4AD51B13AD53AB03D3732EE66AA35DD9C1EFAD0213D4FD1CE49B2F6CD467F2459B9D7A5002012295AB87BF5783B8
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{91642A52-8DEF-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	37952
Entropy (8bit):	2.2763718715362464
Encrypted:	false
SSDEEP:	384:r1ZrPmogNo1iimFJJIsJ4ykMoNimFJJIXJ4ykMoq:/MP
MD5:	8D0114EDEE253C35D35CF591D192C90A
SHA1:	58DD5B2EF859B7D998A8A1927307E8DDB961FE17
SHA-256:	94DFDE56DDBF9B8D4084B3D1BF8A030378136B3ECCA92C7749B479C1C31AF1EC
SHA-512:	85E44DE40CF29A8A6F81AA4945500E7C302BFC8C61DEAD1B6E50FE26482246FFCD4FF2721FA528E8B1D60FB434EA08531B1508B67D21021192F552174C72338B
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9BF966F4-8DEF-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5664854969572086
Encrypted:	false
SSDEEP:	48:IwrGcprPGwpa8G4pQgGrapbS7GQpKKG7HpRN7TGIpG:rxZ5Qc6+BS1AlTNxA
MD5:	93EF737C04ACC09CA69C2E70CED5D286
SHA1:	B4048F3A10E6B9867B57BEF7F0B63D4B9862F3BA
SHA-256:	690B990E5FB210BADEEC2D5CEE4AAECF940220F06189EBAB69D907DEC155B08F
SHA-512:	34D4ABD23561B50AAFD0A37816CC3842B86B5B9417D00233B44A30D8B8A790E39EBBC411729D89123B809EBC5F038C86E6AACFFDE24C132C92872C44553BB25D
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1261875916789625
Encrypted:	false
SSDEEP:	12:TMHdNMNxOE3ZaERsZAnWimI002EtM3MHdNMNxOE3ZaERsZAnWimI00ObVbkEtMb:2d6NxOgZWZASZHKd6NxOgZWZASZ76b
MD5:	023C379D7A79B09C2FF7275E7A7498DA
SHA1:	7B9B8F3BDD988754A1CBB2DAD2FDE61E9A644A23
SHA-256:	8F7E687A6030811C17D5CD6711CD35A3CE7F683DBA4B4D9B0C37F2D09BC123DF
SHA-512:	8E8E3613B5513543AFFA1B04BED0DDD46C5E885981803DA1EEB4259B70A090DDC0CFD2909DCA5A248E784C6CF96514D8B3B1D38DBD4FBCE362BE75B78F95E89B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.085747114230266
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kxXeZaER0XeZAnWimI002EtM3MHdNMNxe2kxXeZaER0XeZAnWimI0/:2d6NxrrZBZASZHKd6NxrrZBZASZ7Aa7b
MD5:	DC3FEE6268DF7F2D51E5D3AFDEB0474F
SHA1:	E8AC19239F4DEFE2213D9B7099C809E649F04C6A
SHA-256:	4B77C9EEF865AA38B9B8A76B5DDE669ECE9B7F492CC5EC00163BA8D1A0DC8F58
SHA-512:	23026F1B27B4D7F00E3266542C5710DB7C3047D41CF4C59CA4C0AF41B0CE1C51417ED14DDACAF9EBD8F6E5705FDAB35378FF2EC5F0BA78295E096955C5C443B8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x6bd1200c,0x01d721fc</date><accdate>0x6bd1200c,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x6bd1200c,0x01d721fc</date><accdate>0x6bd1200c,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.1446214782086255
Encrypted:	false
SSDEEP:	12:TMHdNMNxvL3ZaERsZAnWimI002EtM3MHdNMNxvL3ZaERsZAnWimI00ObmZEtMb:2d6NxvzZWZASZHKd6NxvzZWZASZ7mb
MD5:	A7A1F19B987E0A42E7AB8A3299F2A2C0
SHA1:	9D2B9E318E8B4CA1083737EFBDCB7CDD4F6C6777
SHA-256:	41C8890CE50CFC55D098640BC9292FCC1ACDC83171D254486188523E4E6880C1
SHA-512:	64334E24AA6569078919F9A4421B749027022CA3CE5088FB3B2A2918F61F714B63FC673D6F33ACB0459BB58BF496EF339C29011B623FC4EC11D558DCC6BFBC73
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.115538361533859
Encrypted:	false
SSDEEP:	12:TMHdNMNxi1uZaERwuZAnWimI002EtM3MHdNMNxi1uZaERwuZAnWimI00Obd5EtMb:2d6NxauZ2uZASZHKd6NxauZ2uZASZ7J/
MD5:	91785B3CC2013E8E9381894BF1E16336
SHA1:	3180BFA98C7073F10C8DF88D5E230CC48834BFCB
SHA-256:	B9B469C0208E6651A497F881BD68A42242AE8C69E82DD8FAABF386D3BD7759BC
SHA-512:	594B8058399DBA2168B78C69842E9BCDE23568D6B91FF8D4B8EA8A8BBA94C8662B502F88C5B2BAB3FE8025C97D86D695C3DA58337946AB8441569429DF7FE6DB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x6bd5e4c3,0x01d721fc</date><accdate>0x6bd5e4c3,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x6bd5e4c3,0x01d721fc</date><accdate>0x6bd5e4c3,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.132709748200387
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwhNJZaERkNJZAnWimI002EtM3MHdNMNxhGwhNJZaERkNJZAnWimI0y:2d6NxQmJZ8JZASZHKd6NxQmJZ8JZASZy
MD5:	083A846875BA3D466226452919B66A23
SHA1:	50CD00FAF732D1033E61BB187933B1D91E7DAA9D
SHA-256:	5574CB1C415EC08CC7F2B2BB0A46B57F37ACFF3930052014D87578B43FBBD95A
SHA-512:	6CC742A099AA8AD52C3FA0609E6F16D50F7B1CA6351382C0D47C9506160A37C4C4A507D9E89E38AB3A71D587F4B86E004C3CA8ECAD8DEEEF380DFA565D10BC86
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6bdaa988,0x01d721fc</date><accdate>0x6bdaa988,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x6bdaa988,0x01d721fc</date><accdate>0x6bdaa988,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.127072489093481
Encrypted:	false
SSDEEP:	12:TMHdNMNx0n3ZaERsZAnWimI002EtM3MHdNMNx0n3ZaERsZAnWimI00ObxEtMb:2d6Nx03ZWZASZHKd6Nx03ZWZASZ7nb
MD5:	EDAF44D4E283EDA9585DFA014B3B86AC
SHA1:	5FBD9B83D958CBC8E7C9E50A501226BF0A734325
SHA-256:	67290699D6E14ECDEA034BA7FF4D608CDE539162784C8EA537F560902DEF6815
SHA-512:	96A94B5A582A75E222E67C8ADF82904F7B9B2A5F45D3A564C43C307DF7F149C42A08589A8F18BC970A2AF9514AB1E9279CAD379AB4A131392B7491D79F35E6FA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x6bd84728,0x01d721fc</date><accdate>0x6bd84728,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.140128398329581
Encrypted:	false
SSDEEP:	12:TMHdNMNxx1uZaERwuZAnWimI002EtM3MHdNMNxx1uZaERwuZAnWimI00Ob6Kq5Es:2d6NxvuZ2uZASZHKd6NxvuZ2uZASZ7ob
MD5:	62384AF721AF6AA7505D56F4FD172B49
SHA1:	94A0A82459AE6634FC365E6587DD8C3B7EE238C9
SHA-256:	967CB2F10360E0F9B36799DD18FF02B8C017A53F57E7D5E83635B0E465064FDE
SHA-512:	DFC5ACEC34CF278BA62A11281EE34BC28BFB471794E391E83505ADFA3B09302AD21CC0056A029F64601FCB6EC7B232CA6CB6D6C47BF35D20FCCC0C3F17F7D2CB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x6bd5e4c3,0x01d721fc</date><accdate>0x6bd5e4c3,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x6bd5e4c3,0x01d721fc</date><accdate>0x6bd5e4c3,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.116110963516611
Encrypted:	false
SSDEEP:	12:TMHdNMNxcxWZaER6WZAnWimI002EtM3MHdNMNxcxWZaER6WZAnWimI00ObVEtMb:2d6NxGWZoWZASZHKd6NxGWZoWZASZ7Db
MD5:	B220EA1B74BE2A2FE7FEC67376B40608
SHA1:	AF7C6DD570A67652F57F615B9F815D0E34D32F94
SHA-256:	EE02CF619ADB53ED022112297F029344C6BB9E88D1C3537FD644B624624AFD47
SHA-512:	DF339C1283B4A833323968B8DBC31ACD826530CA555618DEB407BCD334190AED597565D473215F86862D8A7CC8B1322A9DE7E6F557610078A5F5523F409F73AC
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6bd38270,0x01d721fc</date><accdate>0x6bd38270,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x6bd38270,0x01d721fc</date><accdate>0x6bd38270,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.10116136397028
Encrypted:	false
SSDEEP:	12:TMHdNMNxfn1uZaERwuZAnWimI002EtM3MHdNMNxfn1uZaERwuZAnWimI00Obe5Es:2d6NxduZ2uZASZHKd6NxduZ2uZASZ7i/
MD5:	312A79D9EBA24A867688BDA46E9670B8
SHA1:	BBAD08EEEF93D0F370A16D69A0FA51C2D641DB8F
SHA-256:	7FDD96764956CF3D081607A5ABDABE2717677BF5C4D0575DFDDEE8D8C3678F43
SHA-512:	7C4BC98B8DC51654BBF91919D947E0B6C63DB4E417E21A8529FDB7F3F4CF609A1DED54236FD202DD4FF54A595FC82C46DDAC440D1636DF0BE065533D9C22B57E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x6bd5e4c3,0x01d721fc</date><accdate>0x6bd5e4c3,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x6bd5e4c3,0x01d721fc</date><accdate>0x6bd5e4c3,0x01d721fc</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\TeX-AMS-MML_HTMLorMML[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	244250
Entropy (8bit):	5.5965191265915895
Encrypted:	false
SSDEEP:	3072:hqqxVEzQ//ZgzYwePV7Wu48F0QUrtOBMtRqXgOhFFzka1aEE4WREsj5rPoDtEV4u:oOVxKWFNoOBfw/VH8tEVpvim
MD5:	544F69A31055E5AAE4C4F1606C38F947
SHA1:	95BF665AA24EFD6FC0534665A109C1E936FE9872
SHA-256:	E7F6012ECB5ED7654B2D8E6B7E77F8FBE2706B0746D4A356A9D6D026287DEA12
SHA-512:	88741AFD87E0051E22A856E079CD54030C791EE5B01F4966550214DA9728E08935F0A88813F998C5851A686B69806590372AB0D851646364BA6FFDB5B6D8A187
Malicious:	false
Reputation:	low
IE Cache URL:	https://mathjax.rstudio.com/2.7.2/config/TeX-AMS-MML_HTMLorMML.js?V=2.7.2
Preview:	/. /MathJax/config/TeX-AMS-MML_HTMLorMML.js. * . * Copyright (c) 2010-2017 The MathJax Consortium. . Part of the MathJax library.. * See http://www.mathjax.org for details.. * . * Licensed under the Apache License, Version 2.0;. * you may not use this file except in compliance with the License.. . http://www.apache.org/licenses/LICENSE-2.0. */..MathJax.Hub.Config({delayJaxRegistration: true});..MathJax.Ajax.Preloading(. "[MathJax]/jax/input/TeX/config.js",. "[MathJax]/jax/input/MathML/config.js",. "[MathJax]/jax/output/HTML-CSS/config.js",. "[MathJax]/jax/output/NativeMML/config.js",. "[MathJax]/jax/output/PreviewHTML/config.js",. "[MathJax]/config/MMLorHTML.js",. "[MathJax]/extensions/tex2jax.js",. "[MathJax]/extensions/mml2jax.js",. "[MathJax]/extensions/MathEvents.js",. "[MathJax]/extensions/MathZoom.js",. "[MathJax]/extensions/MathMenu.js",. "[MathJax]/jax/element/mml/jax.js",. "[MathJax]/extensions/toMathML.js",. "[MathJax]/extensions/TeX/noError

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\shinyapps[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	40
Entropy (8bit):	4.177567157116928
Encrypted:	false
SSDEEP:	3:JWPNTDCJs:+NXf
MD5:	934060D19DBDCA5AB4A887236264E253
SHA1:	7905BDBC8ADF127AA7DB0ED1E41E91C5C50CC96C
SHA-256:	989CD652042EABFB7B7638C43E38168112DF34AE7DC62445E8EFC42E4920BF96
SHA-512:	A9934153DB96BD94EDAAC7B059C77D3CBE09DD68BFE7514F541807F068EDADCD41DB0463EAE1CF4702BD9526A10F0311B204A323F53B1723665C87B57A724B08
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/__static__/frontend/css/shinyapps.css
Preview:	.shiny-server-account{visibility:hidden}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\MathJax[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	63244
Entropy (8bit):	5.463693210626184
Encrypted:	false
SSDEEP:	1536:2JGjj0ebL/4r1l15MIt8SaXiWalhPbcpbZLWPrAO8EpKw6kzJc+OLN/Ifbj1dI35:2JGT4r1FBt8S2dZK0+pzXzJVOLN/IfW
MD5:	359B9C63CB3BA43384B2995E5699A63F
SHA1:	8B72E446CB6E9C7CD5B249D9122355668DCF0A2C
SHA-256:	7C2B61DE9D81E1C64CCE5AFB3858B39A8E5191D2401C9E2F387A44EC568D711F
SHA-512:	A28647766FC97C3DF35271E3674F531F3AA944C2125FA6C493768E0F2D4A038B73BA4D8F18800B7A453997EE230C49963F0AA8CEE425E65ACC1F07EBB9899E9C
Malicious:	false
Reputation:	low
IE Cache URL:	https://mathjax.rstudio.com/2.7.2/MathJax.js?config=TeX-AMS-MML_HTMLorMML
Preview:	/. /MathJax.js. . Copyright (c) 2009-2017 The MathJax Consortium. . Licensed under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License.. * You may obtain a copy of the License at. . http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS,. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. * See the License for the specific language governing permissions and. * limitations under the License.. */..if(document.getElementById&&document.childNodes&&document.createElement){if(!(window.MathJax&&MathJax.Hub)){if(window.MathJax){window.MathJax={AuthorConfig:window.MathJax}}else{window.MathJax={}}MathJax.isPacked=true;MathJax.version="2.7.2";MathJax.fileversion="2.7.2";MathJax.cdnVersion="2.7.2";MathJax.cdnFileVersions={};(function(d){var b=window[d];if(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fa-regular-400[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Font Awesome 5 Free Regular family
Category:	downloaded
Size (bytes):	34390
Entropy (8bit):	6.319197647841965
Encrypted:	false
SSDEEP:	384:iNILLtPRwpXUazLuDULbN1TH/u9k4jx3I+89AyI6WcRwkDcQUd:iGLJPXy6DO7/uFx29uc5DcQUd
MD5:	261D666B0147C6C5CDA07265F98B8F8C
SHA1:	6299F0E32575F73D8D897F87CE899827F99E20FE
SHA-256:	01F4416F5DB59E2DD6B6FBD9DC32336D99DB18F7EB623A49F584D04AFD279473
SHA-512:	9DB95A9FA6BF3899D6DD419EAB879B2B18C6D166913AA51CCB9B4D2C0D0BAA4A531B666CCE51F6CE99BD88861B4C33DF804179233DB439D8F86CE2A584E7577F
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/font-awesome-5.13.0/webfonts/fa-regular-400.eot?
Preview:	V...,.............................LP...........................V..................6.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .R.e.g.u.l.a.r.....R.e.g.u.l.a.r...L.3.3.1...0.0.8. .(.F.o.n.t. .A.w.e.s.o.m.e. .v.e.r.s.i.o.n.:. .5...1.3...0.)...6.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .R.e.g.u.l.a.r................PFFTM..:Q........GDEF.*..........OS/2A.S....X...`cmap...........gasp............glyfD..... ..n.head..V........6hhea.5.........$hmtx...t.......Tloca...F.......6maxp.......8... name;.....w....[post.iA...}<.........K..V..._.<...........(....../.................................................................................@.................L.f...G.L.f....................................PfEd...............T.........:..... ...................@...........................@...............@...................@.......@...@.......@...@...................................`...............................@...................@....................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\fa-solid-900[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Font Awesome 5 Free Solid family
Category:	downloaded
Size (bytes):	202902
Entropy (8bit):	6.343856116404981
Encrypted:	false
SSDEEP:	3072:I+t+A5t4nIbTOMjZUpyL175vPmazQXYIbbVaaKL/XbihFle5PZm34ehAMQ6nk:pt+AsnmqFpA7FmMQIIbbQxX+hFo5WUMQ
MD5:	A0369EA57EB6D3843D6474C035111F29
SHA1:	5BE5944A17E8B32589A12FDC2B8A8570C9081DB4
SHA-256:	32501727BB23FC77615B1EC76B5F298EC22198C0F3D6A3E7D6FE4AC3CF315DB9
SHA-512:	FA38F5A543384762B98DE5A2AC50A506652522AB5052FFD533CDE8CB0789A281CA9693CA1EAC381A63A01DD318986351BE315E53811333C2F5158D7EA322BFC0
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/font-awesome-5.13.0/webfonts/fa-solid-900.eot?
Preview:	....x.............................LP........................).a...................2.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .S.o.l.i.d.....S.o.l.i.d...L.3.3.1...0.0.8. .(.F.o.n.t. .A.w.e.s.o.m.e. .v.e.r.s.i.o.n.:. .5...1.3...0.)...2.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .S.o.l.i.d................PFFTM..:Q...\....GDEF.*.....<....OS/2C.V....X...`cmap.f ....P....gasp.......4....glyf%.\...-....Xhead.'V........6hhea.C.&.......$hmtx.P..........loca......(....maxp.H.S...8... name%."........+post.......H..0......K...a.)_.<...........(....../...............................................................P. ...............@.................L.f...G.L.f....................................PfEd.....v.........T.........:..... ...............................@...........................`.......................@.......@.......@...................................@...........................................@...@...................................@...............`...@.....@..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\all.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	58578
Entropy (8bit):	4.718650194585032
Encrypted:	false
SSDEEP:	768:FEC319PiyLNq4/xMoAUHJ2kEBR/MMQyYJrXjBrth5Qzl:FEkPxLE4/6mHQpBCfdj9tMB
MD5:	76CB46C10B6C0293433B371BAE2414B2
SHA1:	0038DC97C79451578B7BD48AF60BA62282B4082B
SHA-256:	876D023D9D10C97941B80C3B03E2A5B94631FF7A4AF9CEE5604A6A2D39718D84
SHA-512:	2FB31670AEC534F73036A9CB759ABCEA54C760B750A996B3E58700804FB97271A6970F094F4DD0076FA8C4BD74D14781E9197364B531086492E3FFBE98D65DC7
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/font-awesome-5.13.0/css/all.min.css
Preview:	/!. Font Awesome Free 5.13.0 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa,.fab,.fad,.fal,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:inline-block;font-style:normal;font-variant:normal;text-rendering:auto;line-height:1}.fa-lg{font-size:1.33333em;line-height:.75em;vertical-align:-.0667em}.fa-xs{font-size:.75em}.fa-sm{font-size:.875em}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:2.5em;padding-left:0}.fa-ul>li{position:relative}.fa-li{left:-2em;position:absolute;text-align:center;width:2em;line-height:inherit}.fa-border{border:.08em solid #eee;border-radius:.1em;padding:.2em .25em .15em}.fa-pu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-accessibility.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1531
Entropy (8bit):	4.988984278069927
Encrypted:	false
SSDEEP:	24:+XE5wUwiEwjUwU7sP5ZD+rKerhxZX57orxkuMEQulse6oU:tzasqx55srxlMEplsEU
MD5:	57B544398FFFEB9F4EB942F2CE7C6E09
SHA1:	499908245BE72042C64BABC932E978DD43AFCD9B
SHA-256:	CB60EC1A51BE84DCC9C9FBE6AF25B67BBFA4FDE4D86D8DADFC277834B381DA2E
SHA-512:	B1D638C1CBA7B94204B4AB2ADE14CAEDAC8A30E4C2E71C5A4888F5659EB8A06EA037194654859F608964D6162D6DE853D3A7CC9AFA897D5322F7249BD494159F
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/bootstrap/accessibility/css/bootstrap-accessibility.min.css
Preview:	.btn:focus{outline:none 2px #000}.btn:focus-visible{outline:auto 2px #000}div.active:focus{outline:none 1px #000}div.active:focus-visible{outline:auto 1px #000}a:focus{outline:none 1px #000}a:focus-visible{outline:auto 1px #000}.close:hover,.close:focus{outline:none 1px #000}.close:focus-visible{outline:auto 1px #000}.nav>li>a:hover,.nav>li>a:focus{outline:none 1px #000}.nav>li>a:focus-visible{outline:auto 1px #000}.carousel-indicators li,.carousel-indicators li.active{height:18px;width:18px;border-width:2px;position:relative;box-shadow:0px 0px 0px 1px #808080}.carousel-indicators.active li{background-color:rgba(100,149,253,0.6)}.carousel-indicators.active li.active{background-color:white}.carousel-tablist-highlight{display:block;position:absolute;outline:2px solid transparent;background-color:transparent;box-shadow:0px 0px 0px 1px transparent}.carousel-tablist-highlight.focus{outline:2px solid #6495ED;background-color:rgba(0,0,0,0.4)}a.carousel-control:focus{outline:2px solid #6495ED;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-accessibility.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	12789
Entropy (8bit):	5.128735561018244
Encrypted:	false
SSDEEP:	192:9yFLgq29pr+xSa1RJb1V3JABzqMjQ2yujJjnD1XGZGw0DKRaTA8meBNJ4+n9iig:9yWq29p8SIxABzqMjgeBrg
MD5:	E10E34E3584B24FF7432C46182855A37
SHA1:	47FEA953B15B3703F0E0BBE0F78B6B026426C869
SHA-256:	5A81853E5DA3C04D1D06C9EE0FBDDE274C5FDE59C88E8F3B81BB6CFCAC873B01
SHA-512:	1F926A7016920E9C556BC52967C26EE56E2912D9B70DA49822745DCEE90108E2BAE693D1A29CC25A4BADD27169BA6DC6B5C74638AF9B9733DF0D0044B4874D53
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/bootstrap/accessibility/js/bootstrap-accessibility.min.js
Preview:	parcelRequire=function(e,r,t,n){var i,o="function"==typeof parcelRequire&&parcelRequire,u="function"==typeof require&&require;function f(t,n){if(!r[t]){if(!e[t]){var i="function"==typeof parcelRequire&&parcelRequire;if(!n&&i)return i(t,!0);if(o)return o(t,!0);if(u&&"string"==typeof t)return u(t);var c=new Error("Cannot find module '"+t+"'");throw c.code="MODULE_NOT_FOUND",c}p.resolve=function(r){return e[t][1][r]\|\|r},p.cache={};var l=r[t]=new f.Module(t);e[t][0].call(l.exports,p,l,l.exports,this)}return r[t].exports;function p(e){return f(p.resolve(e))}}f.isParcelRequire=!0,f.Module=function(e){this.id=e,this.bundle=f,this.exports={}},f.modules=e,f.cache=r,f.parent=o,f.register=function(r,t){e[r]=[function(e,r){r.exports=t},{}]};for(var c=0;c<t.length;c++)try{f(t[c])}catch(e){i\|\|(i=e)}if(t.length){var l=f(t[t.length-1]);"object"==typeof exports&&"undefined"!=typeof module?module.exports=l:"function"==typeof define&&define.amd?define(function(){return l}):n&&(this[n]=l)}if(parcelRequire

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-datepicker.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	80800
Entropy (8bit):	5.896906177031034
Encrypted:	false
SSDEEP:	1536:sm7RB/XyTTZpLdLqxS53FxwkXt7S5zhHBGb08sclD3XCtJ:nSTZpLd13FxwDeD3k
MD5:	6EAEDED4F97DF44D364BFFFB3C32E8CB
SHA1:	6EF8B03BE83F52B5AFBEF55E1ACB9861BD0FE0AB
SHA-256:	5285258B3CFC46781D9100E3564014CF706544D36430E111B4967FA0DCF948C4
SHA-512:	13544A3F9A5EC15C4C41B1EF8E8AF162CEC5AA55839F8EC613195B2FA51A256FB69EDA80DA2B757FF9AF769ED3A8478B79817035C866FAA576611A8BBF944BAC
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/datepicker/js/bootstrap-datepicker.min.js
Preview:	!function(e){"function"==typeof define&&define.amd?define(["jquery"],e):"object"==typeof exports?e(require("jquery")):e(jQuery)}(function(M,D){function v(){return new Date(Date.UTC.apply(Date,arguments))}function w(){var e=new Date;return v(e.getFullYear(),e.getMonth(),e.getDate())}function i(e,t){return e.getUTCFullYear()===t.getUTCFullYear()&&e.getUTCMonth()===t.getUTCMonth()&&e.getUTCDate()===t.getUTCDate()}function e(e,t){return function(){return t!==D&&M.fn.datepicker.deprecated(t),this[e].apply(this,arguments)}}function T(e,t){M.data(e,"datepicker",this),this._events=[],this._secondaryEvents=[],this._process_options(t),this.dates=new a,this.viewDate=this.o.defaultViewDate,this.focusDate=null,this.element=M(e),this.isInput=this.element.is("input"),this.inputField=this.isInput?this.element:this.element.find("input"),this.component=!!this.element.hasClass("date")&&this.element.find(".add-on, .input-group-addon, .input-group-append, .input-group-prepend, .btn"),this.component&&0===th

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap-datepicker3.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	21013
Entropy (8bit):	4.653970537328908
Encrypted:	false
SSDEEP:	192:zftZX71IYgFVyTp8cTN96cvzcsXQIieHUjaPfgp94b2DgxD1FoeqvOqs5e:Dq0RHLcEQ9g1b2yobs5e
MD5:	008EA2A443A98505E7CD25577AE84BA3
SHA1:	B0AEC72164EE07609FBC9C25375FD6FB39D5172F
SHA-256:	85E4193F500642647681F64788A1322E8A8348E2AAE5E9E361E893B06C1663D6
SHA-512:	D53C5B4270C42E79AA315AB32AB1666BA36625CD982FB483130285FE7DBE4F039B70C98782A008CFD76AF3D4BBC4C93B55B349DEE7FDB076F2B383F1998168FC
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/datepicker/css/bootstrap-datepicker3.min.css
Preview:	.datepicker{border-radius:.25rem;direction:ltr}.datepicker-inline{width:220px}.datepicker-rtl{direction:rtl}.datepicker-rtl.dropdown-menu{left:auto}.datepicker-rtl table tr td span{float:right}.datepicker-dropdown{top:0;left:0;padding:4px}.datepicker-dropdown:before{content:'';display:inline-block;border-left:7px solid transparent;border-right:7px solid transparent;border-bottom:7px solid rgba(0,0,0,0.15);border-top:0;border-bottom-color:rgba(0,0,0,0.2);position:absolute}.datepicker-dropdown:after{content:'';display:inline-block;border-left:6px solid transparent;border-right:6px solid transparent;border-bottom:6px solid #fff;border-top:0;position:absolute}.datepicker-dropdown.datepicker-orient-left:before{left:6px}.datepicker-dropdown.datepicker-orient-left:after{left:7px}.datepicker-dropdown.datepicker-orient-right:before{right:6px}.datepicker-dropdown.datepicker-orient-right:after{right:7px}.datepicker-dropdown.datepicker-orient-bottom:before{top:-7px}.datepicker-dropdown.datepicker-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	121457
Entropy (8bit):	5.096596153838351
Encrypted:	false
SSDEEP:	768:rf7Gxw/Tc/hOWlJ+UtVIuiHlqAmQI4X8OAdXFxbv8KIf2BdU+JdOMx1iVvH1FS:sw/YGGIuiHlqAmO8l1bNXdOqT
MD5:	7F89537EAF606BFF49F5CC1A7C24DBCA
SHA1:	B0972FDCCE82FD583D4C2CCC3F2E3DF7404A19D0
SHA-256:	6D92DFC1700FD38CD130AD818E23BC8AEF697F815B2EA5FACE2B5DFAD22F2E11
SHA-512:	0E8A7FBD6DE23AD6B27AB95802A0A0915AF6693AF612BC304D83AF445529CE5D95842309CA3405D10F538D45C8A3A261B8CFF78B4BD512DD9EFFB4109A71D0AB
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/bootstrap/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;-moz-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	39680
Entropy (8bit):	5.134609532741171
Encrypted:	false
SSDEEP:	768:up/wtev6UwUx0eWN3MebE9rQuFfU8Vt0azWcsi1m3K0rmq5YW:NorXfURXiUrmq5YW
MD5:	2F34B630FFE30BA2FF2B91E3F3C322A1
SHA1:	B16FD8226BD6BFB08E568F1B1D0A21D60247CEFB
SHA-256:	9EE2FCFF6709E4D0D24B09CA0FC56AADE12B4961ED9C43FD13B03248BFB57AFE
SHA-512:	A014E9ACC78D10A0A7A9FBAA29DEAC6EF17398542D9574B77B40BF446155D210FA43384757E3837DA41B025998EBFAB4B9B6F094033F9C226392B800DF068BCE
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/bootstrap/js/bootstrap.min.js
Preview:	/!. Bootstrap v3.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 Twitter, Inc.. * Licensed under the MIT license. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");!function(t){"use strict";var e=jQuery.fn.jquery.split(" ")[0].split(".");if(e[0]<2&&e[1]<9\|\|1==e[0]&&9==e[1]&&e[2]<1\|\|3<e[0])throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 4")}(),function(n){"use strict";n.fn.emulateTransitionEnd=function(t){var e=!1,i=this;n(this).one("bsTransitionEnd",function(){e=!0});return setTimeout(function(){e\|\|n(i).trigger(n.support.transition.end)},t),this},n(function(){n.support.transition=function o(){var t=document.createElement("bootstrap"),e={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var i in e)if(t.style[i]!==undefined)return{end:e[i]};return!1}(),n.support.transition&&(n.event.specia

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\excess-mortality-explorer[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	2716072
Entropy (8bit):	6.1427207756738165
Encrypted:	false
SSDEEP:	24576:G4aXCdbyPoTTfECzyHirX17Dt8yQvvFebq88HyfFnMbEZBJZzXKjyKkctxbgWs9j:G50+sx7X1ZuNl4ZbZzXKRtky03X
MD5:	C9F9CB561BF9192A90D43012465633B2
SHA1:	9607A88B0BEC8B45014483BC75F2EB15268AEA19
SHA-256:	2B0156CB7821F4BDE6556B648E9B7483A79363222850E8F22DD4E87CD4AB555D
SHA-512:	ECFDBBAAEE6CC53B111B1B9C9271EE4B99EDC6FF968E154E5D64FCE4A770121FDE0CBD80B150F15BAD6B879D2A5260AF6FE7514E070A4E51316C2938874558BA
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/
Preview:	<!DOCTYPE html>.<html>.<head>.<base href="_w_da79c242/">. <script type="text/javascript">.(function() {. var workerId = '_w_da79c242';. // remove base href if worker ID is in url. if (window.location.href.indexOf(workerId) > 0) {. document.querySelector('base').removeAttribute('href');. }.})();.</script>.. <script type="text/javascript">. var __connect = {. shinyPre101: false. }. </script>. . <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <script type="application/shiny-singletons"></script>. <script type="application/html-dependencies">jquery[3.5.1];shiny-css[1.6.0];shiny-javascript[1.6.0];ionrangeslider-javascript[2.3.1];strftime[0.9.2];ionrangeslider-css[2.3.1];font-awesome[5.13.0];selectize[0.12.4];bootstrap-datepicker-js[1.9.0];bootstrap-datepicker-css[1.9.0];bootstrap[3.4.1]</script>.<script src="shared/jquery.min.js"></script>.<link href="shared/shiny.min.css" rel="stylesheet" />.<script src="shared/shiny.min.js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\iframeResizer.contentWindow.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	13908
Entropy (8bit):	5.27794844094953
Encrypted:	false
SSDEEP:	192:z4GbOpAkz77CQcwYCws4uol/BBoSoSbGbDl0HIV16wB9CN3uKQw40LndsChRrXzO:sAOp/HScDlqwB9CN3uKD4wzzrXdhBWH
MD5:	D840E34B94ED7AD2AC5D2D6E7E9A8678
SHA1:	40248F5541E0DE44C6F44F4CADC9970AF358D983
SHA-256:	63B5085014A66AF8D0D56AFB98BB13F69A4C4F21C3C0E2CC63B30FE8C75A49D9
SHA-512:	CA84FE83A39C9DB33FA536D8E6763EF3388CCF0005C19ACF9097DD32E57745DD64E24A43E404EBF80A5B81158CE762532AEC4BA522857ADEC694BBB0BCAC6A5E
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/__static__/components/iframe-resizer/js/iframeResizer.contentWindow.min.js
Preview:	/! iFrame Resizer (iframeSizer.contentWindow.min.js) - v3.5.5 - 2016-06-16. Desc: Include this file in any page being loaded into an iframe. * to force the iframe to resize to the content size.. * Requires: iframeResizer.min.js on host page.. * Copyright: (c) 2016 David J. Bradshaw - dave@bradshaw.net. * License: MIT. */..!function(a,b){"use strict";function c(b,c,d){"addEventListener"in a?b.addEventListener(c,d,!1):"attachEvent"in a&&b.attachEvent("on"+c,d)}function d(b,c,d){"removeEventListener"in a?b.removeEventListener(c,d,!1):"detachEvent"in a&&b.detachEvent("on"+c,d)}function e(a){return a.charAt(0).toUpperCase()+a.slice(1)}function f(a){var b,c,d,e=null,f=0,g=function(){f=Ha(),e=null,d=a.apply(b,c),e\|\|(b=c=null)};return function(){var h=Ha();f\|\|(f=h);var i=ya-(h-f);return b=this,c=arguments,0>=i\|\|i>ya?(e&&(clearTimeout(e),e=null),f=h,d=a.apply(b,c),e\|\|(b=c=null)):e\|\|(e=setTimeout(g,i)),d}}function g(a){return na+"["+pa+"] "+a}function h(b){ma&&"object"==typeof a.co

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ion.rangeSlider.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	41036
Entropy (8bit):	5.028343828855693
Encrypted:	false
SSDEEP:	384:MTozWoYXHpTm21+y3y2yVTRp7Fy2yI7RgVMu9FeeDyjHyZCyYKQPmc0UxoE8:MTEl2bixtRKxI7RgVMZTOTYP0Uxs
MD5:	679FE9D3F4D39A67C65C3CC6FCA57F01
SHA1:	468D43FEA0C0C742105B30E40FD513BD9BA915FE
SHA-256:	086AEFBC27154D449B6B5556806C38AEA466997F43FCCB9FBD2FD5FC847CDDFB
SHA-512:	5F87048F393CCE09AB2A6D6773D3064EDDC583427DE73FAC1E0536DFDD0F0C404A6C48DDDF0C25413C3FDA24FC33790DBEBB04EB4157F51A4F843C30C47D5A63
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/ionrangeslider/js/ion.rangeSlider.min.js
Preview:	!function(i){"undefined"!=typeof jQuery&&jQuery\|\|"function"!=typeof define\|\|!define.amd?"undefined"!=typeof jQuery&&jQuery\|\|"object"!=typeof exports?i(jQuery,document,window,navigator):i(require("jquery"),document,window,navigator):define(["jquery"],function(t){return i(t,document,window,navigator)})}(function(r,n,a,t,c){"use strict";var i,s=0,o=(i=t.userAgent,t=/msie\s\d+/i,0<i.search(t)&&t.exec(i).toString().split(" ")[1]<9&&(r("html").addClass("lt-ie9"),!0));Function.prototype.bind\|\|(Function.prototype.bind=function(s){var o=this,e=[].slice;if("function"!=typeof o)throw new TypeError;var h=e.call(arguments,1),r=function(){if(this instanceof r){var t=function(){};t.prototype=o.prototype;var i=new t,t=o.apply(i,h.concat(e.call(arguments)));return Object(t)===t?t:i}return o.apply(s,h.concat(e.call(arguments)))};return r}),Array.prototype.indexOf\|\|(Array.prototype.indexOf=function(t,i){var s;if(null==this)throw new TypeError('"this" is null or not defined');var o=Object(this),e=o.length

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\ion.rangeSlider[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text
Category:	downloaded
Size (bytes):	4402
Entropy (8bit):	4.911680333491752
Encrypted:	false
SSDEEP:	96:RJ1HJaC5GVZJk5PoUA5WpoYYECTbq8pQU4EKF4oy:XVnsVhIpZCTeokFRy
MD5:	E21484C7FCB0F3C3E6CED25464D2C3DD
SHA1:	FC25A7719C5F4C8728B5F24CDA342288C0701439
SHA-256:	E1B92B4247EF49C7F5FD8514F30D14936C1A511644EAF9C939ED6853359F2E09
SHA-512:	40E03652EBFBD8C4EAAF4F03B98F566E05ADB5742143F3C236B09B6182B9102CC0F185D697621C5A0B7CE92D32230CE466E238D47515F02BCE10613345341280
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/ionrangeslider/css/ion.rangeSlider.css
Preview:	@charset "UTF-8";./* 'shiny' skin for Ion.RangeSlider, largely based on the 'big' skin, but with smaller dimensions, grayscale grid text, and without gradients.. RStudio, Inc, 2014.. Denis Ineshin, 2014 https://github.com/IonDen.. guybowden, 2014 https://github.com/guybowden.*/..irs {. position: relative;. display: block;. -webkit-touch-callout: none;. -webkit-user-select: none;. -khtml-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 12px;. font-family: Arial, sans-serif;.}...irs-line {. position: relative;. display: block;. overflow: hidden;. outline: none !important;.}...irs-bar {. position: absolute;. display: block;. left: 0;. width: 0;.}...irs-shadow {. position: absolute;. display: none;. left: 0;. width: 0;.}...irs-handle {. position: absolute;. display: block;. box-sizing: border-box;. cursor: pointer;. z-index: 1;.}...irs-handle.type_last {. z-index: 2;.}...irs-min, .irs-max {. position: abso

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/jquery.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\rstudio-connect[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1599
Entropy (8bit):	4.829507753193078
Encrypted:	false
SSDEEP:	48:AJ6FoyBMUi/utTzb3sH3x9kvvus/b4geZFqZ:8VF/MTXsH3x9kv2s/bI8
MD5:	510D4D39F16E2E16952DF500DA335ED8
SHA1:	7EABA700F3BE68007AB9232EED251CE487E1CECA
SHA-256:	A42AAD34D80A8E7A89FDF48B2E7C57F304E2BA40199BA3496A91F22B61C0B018
SHA-512:	31792BD8593E1685FEB2F65C41D14B09781A09CBE6BFC390E341F6DC22B851ABE4A46365E3975783AFBD21F93D1392B7AAA23D76BD0C3D35525774E410B8B066
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/__assets__/rstudio-connect.css
Preview:	/*. Note that this CSS is shared by both the variant parameters form and shiny apps!. */...shiny-server-account {. display: none;. position: absolute;. top: 0;. right: 0;. width: auto;. height: auto;. background-color: #E0E0E0;. padding: 3px 8px;. font-size: 12px;.}..shiny-server-account a {. display: inline-block;. margin-left: 3px;.}..shiny-server-expired {. position: fixed;. display: block;. top: 0;. left: 0;. right: 0;. height: auto;. background-color: #E11;. color: white;. font-weight: bold;. text-shadow: #333 1px 1px 1px;. text-align: center;. padding: 8px;.}.body.ss-reconnecting {. background: none;. opacity: 1;.}..body.disconnected {. background: none;. opacity: 1;.}..#ss-connect-dialog {. opacity: 1 !important;. padding: 1em;. position: fixed;. bottom: 50px;. left: -30px;. padding-left: 45px;. padding-right: 18px;. width: 300px;. height: auto;. z-index: 99999;. background-color: #404040;. color: white;. border-radius: 3px;. font-size

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\selectize-plugin-a11y.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2448
Entropy (8bit):	5.068218983766078
Encrypted:	false
SSDEEP:	48:DdZYbwTNYsXM8R7/ZfV4uVcY0T8pB1abjT/zR2SGAJcr9yq2HcM2b84dV0:D4bANYsXDBfCVBTA+3l3J7FHcM2o02
MD5:	CC5A445B4BA126CFE38A051C726EE617
SHA1:	ADA81ADA8F0C759E1EEB360FD4263181DB2966CA
SHA-256:	CD66B240690EFF4037679311FFBDE1C935CA459972A4CFFB2155F602D55CA37F
SHA-512:	8C198A1E210799ED5A422145EFBCBA7F51F0DBED1DA483C5D4297CEB8A3E0B9360E8CC73ADA957E36E0203D3CFA249A7E0E0C8F095833C6B3CDD728A3B7954FA
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/selectize/accessibility/js/selectize-plugin-a11y.min.js
Preview:	Selectize.define("selectize-plugin-a11y",function(t){var e,s,a=this;void 0===a.accessibility&&(a.accessibility={}),a.accessibility.helpers={randomId:function(t){for(var e="",i=t\|\|10,s="abcdefghijklmnopqrstuvwxyz0123456789",a=s.length,o=0;o<i;o++)e+=s[Math.floor(a*Math.random())];return e}},a.accessibility.liveRegion={$region:"",speak:function(t){var e=$("<div></div>");e.text(t),this.$region.html(e)},domListener:function(){var t=new MutationObserver(function(t){t.forEach(function(t){t=$(t.target);if(t.hasClass("items"))if(t.hasClass("dropdown-active")){a.$control_input.attr("aria-expanded","true");var e=a.$dropdown_content[0].children;for(i=0;i<e.length;i++){var s=e[i].attributes;s.role\|\|e[i].setAttribute("role","option"),s.id\|\|e[i].setAttribute("id",a.accessibility.helpers.randomId())}}else a.$control_input.attr("aria-expanded","false"),a.$control_input.removeAttr("aria-activedescendant");else t.hasClass("active")&&t.attr("data-value")&&(a.$control_input.attr("aria-activedescendant",t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\selectize.bootstrap3[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text
Category:	downloaded
Size (bytes):	10766
Entropy (8bit):	5.010121232046981
Encrypted:	false
SSDEEP:	96:e6K4y/vHncK8yXYvTHC7QW8dmCFXtV2VnBabQUkOMH/x+PgeaHI+I+ITNUA:MhvH6yXYbu8dp2DS3s/oY7Hfu
MD5:	AC38AD19469B8C594246E3F433A9AD53
SHA1:	6F62EF6618660D468B132E69536BF39927610C5B
SHA-256:	BDDF9493D0779E432833F59C6CF33B2668D7883E5A46F8148519CA409569FE13
SHA-512:	F5F690CE83AB9925AE5A893959A7E22A537C79E789D257F6F622F957B909F399498F4118750A6F2300AC53843AA4538A769F03215839C8834FF5808ECAC6CAE7
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/selectize/css/selectize.bootstrap3.css
Preview:	/*. selectize.bootstrap3.css (v0.12.4) - Bootstrap 3 Theme. * Copyright (c) 2013.2015 Brian Reavis & contributors. . Licensed under the Apache License, Version 2.0 (the "License"); you may not use this. * file except in compliance with the License. You may obtain a copy of the License at:. * http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software distributed under. * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF. * ANY KIND, either express or implied. See the License for the specific language. * governing permissions and limitations under the License.. . @author Brian Reavis <brian@thirdroute.com>. */..selectize-control.plugin-drag_drop.multi > .selectize-input > div.ui-sortable-placeholder {. visibility: visible !important;. background: #f2f2f2 !important;. background: rgba(0, 0, 0, 0.06) !important;. border: 0 none !important;. -webkit-box-shadow: inset 0 0 12px 4px #fff

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\selectize.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	45139
Entropy (8bit):	5.440934464478155
Encrypted:	false
SSDEEP:	768:yuQn6U0yjDRLpAmfx2tsCh9vX2o6tHRCBurCCXRbszoU3IzROZYW1zArLDjN0R86:yu6EyBLm/rDCTUnV
MD5:	5949BA84AC0FD20B5585AE06E2398B97
SHA1:	C27D068867C3DCF2CE09A658C7A24D8216EE5298
SHA-256:	1F206264524032FC4E859A1639CE4B58859A37581C162F0B8D2EF905917869F8
SHA-512:	91A2E5127B32736F65328F67F3AFF3228019ECF8666BD1E034D21FA7AA970331EADD62974F1142C444E21ECC5F6118886B9C09057084D9CBBC2ED2FFFD071D35
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/selectize/js/selectize.min.js
Preview:	/! selectize.js - v0.12.4 \| https://github.com/selectize/selectize.js \| Apache License (v2) /.!function(a,b){"function"==typeof define&&define.amd?define("sifter",b):"object"==typeof exports?module.exports=b():a.Sifter=b()}(this,function(){var a=function(a,b){this.items=a,this.settings=b\|\|{diacritics:!0}};a.prototype.tokenize=function(a){if(a=e(String(a\|\|"").toLowerCase()),!a\|\|!a.length)return[];var b,c,d,g,i=[],j=a.split(/ +/);for(b=0,c=j.length;b<c;b++){if(d=f(j[b]),this.settings.diacritics)for(g in h)h.hasOwnProperty(g)&&(d=d.replace(new RegExp(g,"g"),h[g]));i.push({string:j[b],regex:new RegExp(d,"i")})}return i},a.prototype.iterator=function(a,b){var c;c=g(a)?Array.prototype.forEach\|\|function(a){for(var b=0,c=this.length;b<c;b++)a(this[b],b,this)}:function(a){for(var b in this)this.hasOwnProperty(b)&&a(this[b],b,this)},c.apply(a,[b])},a.prototype.getScoreFunction=function(a,b){var c,e,f,g,h;c=this,a=c.prepareSearch(a,b),f=a.tokens,e=a.options.fields,g=f.length,h=a.options.nesting

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shiny-server-client.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with escape sequences
Category:	downloaded
Size (bytes):	81187
Entropy (8bit):	5.177574375333793
Encrypted:	false
SSDEEP:	768:27dIPw1DgmOGdN1UBVblXpYAuMvoXf0bROPxaShAVesVg2ciweP/tldaYnVm2rXa:CKXmmAAupfUROPxaYuViie2rXobjfV
MD5:	4F87F96FD7039723A3CA76223721457E
SHA1:	B0118DED71299FDE1D72EBEC4129A72692C4D024
SHA-256:	708736DC3077BB8431744D90CA9ED0DBD19E6B1AA2905C99E0D51DDF7AB08B4F
SHA-512:	A5D7217CE9946D65932FCA473D7F4AE1F3C1B3E55717E603631F1A777CE7FF066A8F0B21DFBDC3C5FBC7D71AB070496C18E6C8819378D7CACA443C7B2CFF876D
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/__assets__/shiny-server-client.min.js
Preview:	(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n\|\|r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){"use strict";var message_utils=require("./message-utils");module.exports=MessageBuffer;function MessageBuffer(){this._messages=[];this._startIndex=0;this._messageId=0}MessageBuffer.prototype.write=function(msg){msg=message_utils.formatId(this._messageId++)+"#"+msg;this._messages.push(msg);return msg};MessageBuffer.prototype.handleACK=function(msg){var ackId=message_utils.parseACK(msg);if(ackId===null){return-1}return this.discard(ackId)};MessageBuffer.prototype.discard=function(nextId){var keepIdx=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shiny.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5927
Entropy (8bit):	4.970315892193942
Encrypted:	false
SSDEEP:	96:bK0rC2p94pbSpwnp26p7EsVcbPRuignyJsE1JPSiH9yL37:bhrC2P4pSOnIwibPRuiVJdyidyL37
MD5:	6234CBBD909DA4C9C7DB605E051879DA
SHA1:	E2CF938EE3886ED1E77218D3FF16703EB80315CC
SHA-256:	093B6EA79904D8C71A885CF598BE41DF13DAC0F37A9EE2F3E2C999A8D2498989
SHA-512:	7CF06537A3EA04D1CC21E8EC1F2608B28249AC33F419B6784994DEFE64729AFD5EA51503A5E7A33A1DC441A894BF1685C9934F9FBD8A034CD3646CEB99925826
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/shiny.min.css
Preview:	pre.shiny-text-output:empty::before{content:" "}pre.shiny-text-output.noplaceholder:empty{margin:0;padding:0;border-width:0;height:0}pre.shiny-text-output{word-wrap:normal}.shiny-image-output img.shiny-scalable,.shiny-plot-output img.shiny-scalable{max-width:100%;max-height:100%}#shiny-disconnected-overlay{position:fixed;top:0;bottom:0;left:0;right:0;background-color:#999;opacity:0.5;overflow:hidden;z-index:99998;pointer-events:none}.table.shiny-table>thead>tr>th,.table.shiny-table>thead>tr>td,.table.shiny-table>tbody>tr>th,.table.shiny-table>tbody>tr>td,.table.shiny-table>tfoot>tr>th,.table.shiny-table>tfoot>tr>td{padding-right:12px;padding-left:12px}.shiny-table.spacing-xs>thead>tr>th,.shiny-table.spacing-xs>thead>tr>td,.shiny-table.spacing-xs>tbody>tr>th,.shiny-table.spacing-xs>tbody>tr>td,.shiny-table.spacing-xs>tfoot>tr>th,.shiny-table.spacing-xs>tfoot>tr>td{padding-top:3px;padding-bottom:3px}.shiny-table.spacing-s>thead>tr>th,.shiny-table.spacing-s>thead>tr>td,.shiny-table.spacin

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shiny.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	93607
Entropy (8bit):	5.207511729124185
Encrypted:	false
SSDEEP:	1536:ufJiRgVJl5UDojAZI9+1LB0AwcdC+wno8gTq:mnr9+1LBK+oGq
MD5:	8CFCDF84FAB22B43802AEE3B11DFF084
SHA1:	FD6A419463D580E95C71BAD338C93EE1227DB60F
SHA-256:	CBB3E9CA0A65005C629181E3379648B94513117A8752A8508B016E5075F21C4A
SHA-512:	C507910EC62412126269420F09ADDF7934F0B07B3A9F3C1E6160801218F1CF0EF8361F2665EFDEE19832488D44A3E1FFA198C55880F28CFBB90C35412FBC5A86
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/shiny.min.js
Preview:	/! shiny 1.6.0 \| (c) 2012-2021 RStudio, Inc. \| License: GPL-3 \| file LICENSE /.."use strict";function _typeof(e){return(_typeof="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e})(e)}function _defineProperty(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}!function(){var $=jQuery,exports=window.Shiny=window.Shiny\|\|{};exports.version="1.6.0";var origPushState=window.history.pushState;function escapeHTML(e){var t={"&":"&","<":"<",">":">",'"':""","'":"'","/":"/"};return e.replace(/[&<>'"\/]/g,function(e){return t[e]})}function randomId(){return Math.floor(4294967296+64424509440*Math.random()).toString(16)}function strToBool(e){if(e&&e.toLowerCase)switch(e.toLowerCase()){case"true":return!0;case"false":return!1;default:return}}function getStyle(e,t){var n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shinyapps.frame.content[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	284
Entropy (8bit):	4.397072391976073
Encrypted:	false
SSDEEP:	6:ArnF5qXwEQ+mdT84wjuA8yqIcFKC5amdavjWEuCwF/iAv:ArnF5QwRYj6PXdXnR
MD5:	3C17BE5413E55EE145876DF176D5EEFC
SHA1:	4BE8B9620C2AE3240E8519143AFB03C2FD8FF443
SHA-256:	D1FBA73471674224EE3B22EA21F2B6BA6C67593E11600A493D2A51184A3DB08E
SHA-512:	D886F2A347CFA6B3658E766B104DA8E1889894B31B4B38DB17FC339BB87D71219D4BFE9BD5B0CAC5B0796FCE434474E0192E448A0F3F84F19DF8C7F8E3E59AAB
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/__static__/frontend/scripts/shinyapps.frame.content.js
Preview:	function detectFrame() {. try {. return window.self !== window.top && 'parentIFrame' in window;. } catch (e) {. return true;. }.}..function notifyParentFrame(message) {. if ('parentIFrame' in window) {. parentIFrame.sendMessage(message, '*');. }.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\shinyapps[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1385
Entropy (8bit):	4.841449415854367
Encrypted:	false
SSDEEP:	24:qrtCnL7n4MLyNCip3KU/yLyaqLNMLyF26+aGoKFd/d4OzzYQFhiYw6S:qxCnn4MLqCip3K5LJ8MLsyo2UYzYQFhe
MD5:	CEC01ED9FFE3CF03C95E164A1911F274
SHA1:	49EB6E54225E4E080680ECCD6AB4388410423BDE
SHA-256:	6DF262627A4FA54C76F35422F766527CE6355054FE1790EFE52A8A46CF7CB588
SHA-512:	D3CEDCBBD9C717D84A2F7FFF8CC15D79A37999E26181013CE9E615758E941800B946983C91B86B118CB06847896055CFB06C611339EAE509CFB8B1F6A3DE9D29
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/__static__/frontend/scripts/shinyapps.js
Preview:	var settings = getSettings();..function detectIE() {. var ua = window.navigator.userAgent;.. var msie = ua.indexOf('MSIE ');. if (msie > 0) {. // IE 10 or older => return version number. return parseInt(ua.substring(msie + 5, ua.indexOf('.', msie)), 10);. }.. var trident = ua.indexOf('Trident/');. if (trident > 0) {. // IE 11 => return version number. var rv = ua.indexOf('rv:');. return parseInt(ua.substring(rv + 3, ua.indexOf('.', rv)), 10);. }.. var edge = ua.indexOf('Edge/');. if (edge > 0) {. // Edge (IE 12+) => return version number. return parseInt(ua.substring(edge + 5, ua.indexOf('.', edge)), 10);. }.. // other browser. return false;.}..function getSettings() {. var app_url = window.location.pathname;.. // remove trailing slash if any. if (app_url.charAt(app_url.length - 1) == '/'). app_url = app_url.substr(0, app_url.length - 1);.. // get settings url. app_url += '/__settings__/';.. var xhr = $.ajax({. dataType: "j

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sockjs-0.3.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	33887
Entropy (8bit):	5.495958824127657
Encrypted:	false
SSDEEP:	768:mUBprMuSGOG9ase2baW2sZN4AQ3mxtrWSjHPge:moRcse2JvQ3OtrW+P/
MD5:	12627D123FD6D88A09981A30699A729F
SHA1:	DB1A86B4BE889122CDC744C7BA4A417540BCC61A
SHA-256:	B4B6D898C081FEAAF31175668B7A4837CF08EE6480FCE388CBB93FC710646D07
SHA-512:	753BCC8562A7E96607BECC7221F2AC134B0AB3ACB49BC8F8A4998BA21622A87AFA40462508ACD192BFE7C7A75AD7ABB723D71719182B9621EFE907BF3F13022C
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/__assets__/sockjs-0.3.min.js
Preview:	/* SockJS client, version 0.3.4, http://sockjs.org, MIT License..Copyright (c) 2011-2012 VMware, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\strftime-min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5720
Entropy (8bit):	5.465514390713429
Encrypted:	false
SSDEEP:	96:a7f+Tpmt3SL6Bl0qJY2PuEFZAwVESeK42n0EQd0IlmCaswpw5HU/qYrXGBxJUhTA:ygmBl0q62PuEvt+SemnHYDaswm5H2qYQ
MD5:	4FEEDFF422885D51BF57601F8A987D70
SHA1:	EED97B8F354E1507FD51403DBEC990D54E421392
SHA-256:	921174E7050FD77BA7DF2409EEF7FA0A561E53BC46898470538EF54106C1B9F1
SHA-512:	A894356489DDD4731A3DD1E16D82E6C1953439AEB4E260F335E1A63742F8D085086B781A39CE3D9B5F78F9DDE20FA5D12939784A493196D7B8B4F4E7E5504F3F
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/shared/strftime/strftime-min.js
Preview:	(function(){function k(b,a){s[b]\|\|(typeof console!=="undefined"&&typeof console.warn=="function"&&console.warn("[WARNING] "+b+" is deprecated and will be removed in version 1.0. Instead, use `"+a+"`."),s[b]=!0)}function t(b){b.localize=i.localize.bind(i);b.timezone=i.timezone.bind(i);b.utc=i.utc.bind(i)}function r(b,a,e){a&&a.days&&(e=a,a=void 0);e&&k("`"+g+"(format, [date], [locale])`","var s = "+g+".localize(locale); s(format, [date])");return(e?i.localize(e):i)(b,a)}function u(b,a,e){e?k("`"+g+.".strftime(format, [date], [locale])`","var s = "+g+".localize(locale); s(format, [date])"):k("`"+g+".strftime(format, [date])`",g+"(format, [date])");return(e?i.localize(e):i)(b,a)}function p(b,a,e){function g(b,c,h,a){for(var d="",f=null,e=!1,i=b.length,j=!1,o=0;o<i;o++){var n=b.charCodeAt(o);if(e===!0)if(n===45)f="";else if(n===95)f=" ";else if(n===48)f="0";else if(n===58)j&&typeof console!=="undefined"&&typeof console.warn=="function"&&console.warn("[WARNING] detected use of unsupported %

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\v4-shims.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	26702
Entropy (8bit):	4.8300913101556135
Encrypted:	false
SSDEEP:	192:GP6RT1bIl4w0QUmQ10PwKLaAu5CwWavpHo4O6wgLPbJVR8XD7mycP:FRal4w0QK+PwK05eavpmgPPeXD7mycP
MD5:	FB073A92592D70E5AA6E3CCE1CF93A11
SHA1:	B9A847B0E25EC6D3C5A27A97D26B20A9ACF2C1A4
SHA-256:	C0DED025AA80C10D37920521C8DE04536A6145D0E42EB4186C57B412FA50EB45
SHA-512:	0FB0A86BF34910A56D2C257E00C1E115E4FAB6CDF74A02584F5FB572C51184F00902BC9C9FD0E3E5F563232078C78F795D5B694EF7F1D63A25790B9733A37C51
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/font-awesome-5.13.0/css/v4-shims.min.css
Preview:	/!. Font Awesome Free 5.13.0 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). */..fa.fa-glass:before{content:"\f000"}.fa.fa-meetup{font-family:"Font Awesome 5 Brands";font-weight:400}.fa.fa-star-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-star-o:before{content:"\f005"}.fa.fa-close:before,.fa.fa-remove:before{content:"\f00d"}.fa.fa-gear:before{content:"\f013"}.fa.fa-trash-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-trash-o:before{content:"\f2ed"}.fa.fa-file-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-file-o:before{content:"\f15b"}.fa.fa-clock-o{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-clock-o:before{content:"\f017"}.fa.fa-arrow-circle-o-down{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arrow-circle-o-down:before{content:"\f358"}.fa.fa-arrow-circle-o-up{font-family:"Font Awesome 5 Free";font-weight:400}.fa.fa-arr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\6UCIMJHW.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	630336
Entropy (8bit):	6.1157682556566835
Encrypted:	false
SSDEEP:	6144:6OEW8xVdpda98HrfXTXeeactf8aXbqcTrnk04/fsmPZAPYj8d7wbpYR08qGfWDaZ:p8Pj3jRa4w+rdS8qR314ekCECM
MD5:	3A95A2812BB127858D68D6A1CD03B416
SHA1:	8F430EA0BAE0BE3A215C1D0A58D7E9B388B95B08
SHA-256:	9F0500D17B626F663DBCF05A90D0BF7D5BAB5C86C4FD869015190E9507C12B63
SHA-512:	5B7BBA4AAA0DCC10BD7F9F0500F0E356DE107DE4FEEEB8B2B2F090A200FAD47A74D7BFFBB51833472767604B3064D8DBEA4808A5A57815375E4CA1DECBE9C26A
Malicious:	false
Reputation:	low
IE Cache URL:	http://covid19-explorer.org/
Preview:	<!DOCTYPE html>....<html>....<head>....<meta charset="utf-8" />..<meta name="generator" content="pandoc" />..<meta http-equiv="X-UA-Compatible" content="IE=EDGE" />..........<title>U.S. COVID-19 Explorer</title>....<script>// Pandoc 2.9 adds attributes on both header and div. We remove the former (to..// be compatible with the behavior of Pandoc < 2.8)...document.addEventListener('DOMContentLoaded', function(e) {.. var hs = document.querySelectorAll("div.section[class='level'] > :first-child");.. var i, h, a;.. for (i = 0; i < hs.length; i++) {.. h = hs[i];.. if (!/^h[1-6]$/i.test(h.tagName)) continue; // it should be a header h1-h6.. a = h.attributes;.. while (a.length > 0) h.removeAttribute(a[0].name);.. }..});..</script>..<script>/! jQuery v1.11.3 \| (c) 2005, 2015 jQuery Foundation, Inc. \| jquery.org/license */..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQue

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\fa-brands-400[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Font Awesome 5 Brands Regular family
Category:	downloaded
Size (bytes):	133034
Entropy (8bit):	6.268626157644299
Encrypted:	false
SSDEEP:	1536:OHBV2Qt81aJM42HIRc62tZ1a5b4jbi78r92Xdkkkev6KlPThSF36+iIOKsBJ5CEt:6Rt3JMoRc62tZ+8b6I9xevNGiPKkWvLu
MD5:	C1868C9545D2DE1CF8488F1DADD8C9D0
SHA1:	A17DB2A5A355BEFD089BB6E7D53C3D501BF9E827
SHA-256:	811E1577184066108CECA86D5A624A9012303DF5206C5CB0B27D5E3FEDCBA5A3
SHA-512:	C048EB8F7159B61A947E1349A5EBC535949CE97ED1BD8B1D031970DBB28A9B74877FF01168B18930F0341F1198AB3A293A604B4AB66E7B4978C3CCBF8A9CF9E9
Malicious:	false
Reputation:	low
IE Cache URL:	https://phytools.shinyapps.io/excess-mortality-explorer/_w_da79c242/font-awesome-5.13.0/webfonts/fa-brands-400.eot?
Preview:	....x.............................LP..............................................:.F.o.n.t. .A.w.e.s.o.m.e. .5. .B.r.a.n.d.s. .R.e.g.u.l.a.r.....R.e.g.u.l.a.r...L.3.3.1...0.0.8. .(.F.o.n.t. .A.w.e.s.o.m.e. .v.e.r.s.i.o.n.:. .5...1.3...0.)...:.F.o.n.t. .A.w.e.s.o.m.e. .5. .B.r.a.n.d.s. .R.e.g.u.l.a.r................PFFTM..:Q...\....GDEF.*.....<....OS/2B.V....X...`cmap............gasp.......4....glyfkW.@........head..V........6hhea.6.........$hmtxR...........loca...........\|maxp.&.O...8... name............post...n...x.........K......_.<...........(....../...............................................................L.'...............@.................L.f...G.L.f....................................PfEd.....W.........T.........:..... ...................................................................................@...................................@...............@...............p...........@.......................................................................@..... .....@........

C:\Users\user\AppData\Local\Temp\~DF7BCFAD982F369F5C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.47999068772974673
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lo3F9loV9lWUxjr1S:kBqoI+gUxjZS
MD5:	5111129B4BF470578D07B43230D58CB2
SHA1:	9EDB4B044194BC131700255218753CE2CDB540CC
SHA-256:	12D410B28A014465728EA67C15E3354B7C88BE436F7C77BA1345EA1E125BA08B
SHA-512:	23CF10851573335AC5361830A457997D8099E5683A20CB1130CEBE8CF510CABD84BE898569F26FD5D705383D2CC2A83A6544224CE09F4C279FB17355E3D1096F
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8B7BF7AF18EDBAD0.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	47106
Entropy (8bit):	1.0433288564174341
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+iEOnUMcSimFJJIsJ4ykMowimFJJIXJ4ykMo:J9
MD5:	D80436C8B6C16D583EAFFE1393201212
SHA1:	46AAE078B0CC23C59F8F27C24F756596C2CA55EA
SHA-256:	1E5D55A30B364FA6838EE79E5D6A1C3A2053F02691CF0791080E55B3E24D92ED
SHA-512:	53EEA7504EF8C770D248C9647C525BC5AD68B56EF955640ADC9551D7A800CE8268030F9F2CE8DBFF694D55369B87E6935BCDC01184290ED234C83E6AB0667141
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA3C694C5B63C32B7.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.30122830962554187
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laA+4:kBqoxxJhHWSVSEabV
MD5:	DF17500EC61DD839DD275A5F96E5C67F
SHA1:	977E1849B3CDA60CBE14FBA9070F70A0D7FCAC47
SHA-256:	23DCDDE58AEA51184C27ECBBAB45AA67C0A559E71C6182981C3648606ECF05C7
SHA-512:	EE4D78FD15934A61D958537EBFC1174CDC9CAF21DA6FB6733A9BFCA1FB7B8608C9189A6C581D16730CB0EAFD7F85B7667F80C230308950BDEF015042FE67B156
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2021 21:56:06.170392990 CET	49702	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.171022892 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.523885965 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.524066925 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.524928093 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.526443958 CET	80	49702	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.526621103 CET	49702	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.877819061 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.970963955 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.971060991 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.971967936 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.972053051 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.973675966 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.973764896 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:06.975783110 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:06.975858927 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.065865993 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.065965891 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.066000938 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.066049099 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.066314936 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.066361904 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.066560984 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.066621065 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.154083967 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.154216051 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.154422045 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.154483080 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.401454926 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.401567936 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.401592016 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.401622057 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.401993036 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.402040005 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.402291059 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.402340889 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.402348042 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.402389050 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.402389050 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.402429104 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.402461052 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.402514935 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.402534962 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.402580976 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.416759968 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.416819096 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.416857958 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.416897058 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.416918039 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.416954994 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.417011023 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.417061090 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.417104959 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.417119980 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.417152882 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.417262077 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.417308092 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.417320967 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.417360067 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.506479025 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.506511927 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.506525040 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.506536961 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.506647110 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.506685019 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.754707098 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754735947 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754750013 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754762888 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754776955 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754793882 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754813910 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754832029 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754848003 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754864931 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754880905 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754897118 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754914045 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754930019 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754925966 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.754951000 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.754970074 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.755011082 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.755064964 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.767817020 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.767851114 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.767980099 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.768599033 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.768625975 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.768647909 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.768665075 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.768677950 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.768682957 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.768701077 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.768739939 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.768769026 CET	49703	80	192.168.2.3	148.72.88.30
Mar 25, 2021 21:56:07.769186974 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.769211054 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.769256115 CET	80	49703	148.72.88.30	192.168.2.3
Mar 25, 2021 21:56:07.769259930 CET	49703	80	192.168.2.3	148.72.88.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2021 21:55:57.419763088 CET	51281	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:55:57.434339046 CET	53	51281	8.8.8.8	192.168.2.3
Mar 25, 2021 21:55:58.212572098 CET	49199	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:55:58.228148937 CET	53	49199	8.8.8.8	192.168.2.3
Mar 25, 2021 21:55:59.003432989 CET	50620	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:55:59.018573046 CET	53	50620	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:00.046732903 CET	64938	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:00.063802958 CET	53	64938	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:01.078763008 CET	60152	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:01.091445923 CET	53	60152	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:02.211530924 CET	57544	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:02.226466894 CET	53	57544	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:04.915920973 CET	55984	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:04.934849977 CET	53	55984	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:06.102494001 CET	64185	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:06.154190063 CET	53	64185	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:06.922626019 CET	65110	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:06.936721087 CET	53	65110	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:08.572032928 CET	58361	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:08.588984966 CET	53	58361	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:08.942151070 CET	63492	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:08.957611084 CET	53	63492	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:09.312060118 CET	60831	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:09.325628042 CET	53	60831	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:09.972170115 CET	60100	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:09.985415936 CET	53	60100	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:10.609884024 CET	53195	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:10.622750998 CET	53	53195	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:11.405491114 CET	50141	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:11.417584896 CET	53	50141	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:12.206562996 CET	53023	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:12.219402075 CET	53	53023	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:12.844413996 CET	49563	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:12.857966900 CET	53	49563	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:14.992286921 CET	51352	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:15.006875038 CET	53	51352	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:16.458744049 CET	59349	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:16.471752882 CET	53	59349	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:17.506607056 CET	57084	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:17.521276951 CET	53	57084	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:23.741302013 CET	58823	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:23.755289078 CET	53	58823	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:24.279670000 CET	57568	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:24.293071032 CET	53	57568	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:25.301099062 CET	50540	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:25.316399097 CET	53	50540	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:34.205523014 CET	54366	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:34.227823019 CET	53	54366	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:34.925977945 CET	53034	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:34.938851118 CET	53	53034	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:35.624222994 CET	57762	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:35.641756058 CET	53	57762	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:35.935775995 CET	53034	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:35.951148033 CET	53	53034	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:36.636684895 CET	57762	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:36.637844086 CET	55435	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:36.649538040 CET	53	57762	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:36.650345087 CET	53	55435	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:36.948843002 CET	53034	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:36.963879108 CET	53	53034	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:37.652026892 CET	57762	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:37.665585041 CET	53	57762	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:39.224813938 CET	53034	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:39.238904953 CET	53	53034	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:40.163229942 CET	57762	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:40.176327944 CET	53	57762	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:43.230777025 CET	53034	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:43.243693113 CET	53	53034	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:44.190396070 CET	57762	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:44.205864906 CET	53	57762	8.8.8.8	192.168.2.3
Mar 25, 2021 21:56:52.151227951 CET	50713	53	192.168.2.3	8.8.8.8
Mar 25, 2021 21:56:52.170089960 CET	53	50713	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 25, 2021 21:56:06.102494001 CET	192.168.2.3	8.8.8.8	0x7790	Standard query (0)	covid19-explorer.org	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.572032928 CET	192.168.2.3	8.8.8.8	0xca7d	Standard query (0)	phytools.shinyapps.io	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.942151070 CET	192.168.2.3	8.8.8.8	0x18e	Standard query (0)	mathjax.rstudio.com	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:23.741302013 CET	192.168.2.3	8.8.8.8	0xc4ab	Standard query (0)	favicon.ico	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 25, 2021 21:56:06.154190063 CET	8.8.8.8	192.168.2.3	0x7790	No error (0)	covid19-explorer.org		148.72.88.30	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.588984966 CET	8.8.8.8	192.168.2.3	0xca7d	No error (0)	phytools.shinyapps.io		52.4.17.40	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.588984966 CET	8.8.8.8	192.168.2.3	0xca7d	No error (0)	phytools.shinyapps.io		50.16.41.75	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.588984966 CET	8.8.8.8	192.168.2.3	0xca7d	No error (0)	phytools.shinyapps.io		52.3.86.162	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.588984966 CET	8.8.8.8	192.168.2.3	0xca7d	No error (0)	phytools.shinyapps.io		52.73.177.5	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.588984966 CET	8.8.8.8	192.168.2.3	0xca7d	No error (0)	phytools.shinyapps.io		52.70.107.131	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.588984966 CET	8.8.8.8	192.168.2.3	0xca7d	No error (0)	phytools.shinyapps.io		3.233.176.212	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.957611084 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mathjax.rstudio.com		54.230.114.89	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.957611084 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mathjax.rstudio.com		54.230.114.23	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.957611084 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mathjax.rstudio.com		54.230.114.125	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:08.957611084 CET	8.8.8.8	192.168.2.3	0x18e	No error (0)	mathjax.rstudio.com		54.230.114.26	A (IP address)	IN (0x0001)
Mar 25, 2021 21:56:23.755289078 CET	8.8.8.8	192.168.2.3	0xc4ab	Name error (3)	favicon.ico	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

covid19-explorer.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49703	148.72.88.30	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Mar 25, 2021 21:56:06.524928093 CET	177	OUT	GET / HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: covid19-explorer.org Connection: Keep-Alive
Mar 25, 2021 21:56:06.970963955 CET	179	IN	HTTP/1.1 200 OK Date: Thu, 25 Mar 2021 20:56:06 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Fri, 25 Dec 2020 16:03:34 GMT ETag: "b640125-99e40-5b74c1101eb49-gzip" Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Keep-Alive: timeout=5 Transfer-Encoding: chunked Content-Type: text/html Data Raw: 31 66 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dc fd e9 76 ea 4a b2 28 0a ff df 63 ec 77 b0 a9 b5 bd d0 44 36 8d 71 87 97 26 87 de 60 30 a6 b3 8d 3d 5d 35 d4 21 04 02 01 a2 b5 f1 7e f6 1b 91 8d 1a c0 73 d5 3e e7 7c e3 bb e3 ae aa 69 a4 54 f6 19 19 19 11 19 cd 5f c7 f9 7a ae dd 7d 2c 1c f5 e7 23 eb e7 7f fe c7 7f fe c7 5f be 27 5d d6 e8 d3 48 9f cb 47 6a 5f 9e 39 fa 5c 0a 2d e6 bd d3 eb d0 51 f4 27 ff 32 96 47 ba 14 32 f4 b1 3e 93 e7 f6 2c 74 a4 da e3 b9 3e 86 ac 13 79 ac d9 aa 3f 6f 7f 3e 9f 9c ea d3 85 b9 94 42 2f a7 9d cc 69 ce 1e 4d e4 b9 a9 58 ba af 5c b9 20 15 f2 a5 02 2d c8 ff f7 d7 dc 9c 5b fa cf ce 59 eb ec 28 57 7f 2a e7 4f e3 37 47 85 f5 c4 b2 67 fa ec af 28 fd 4a 32 3a ea cc 9c cc 7f 46 a3 47 8f a4 03 47 89 b3 9b 23 59 d3 9c 23 79 3e 9f 99 ca 62 ae 3b 47 f6 f8 48 b1 e7 fd 23 1c a6 3e 3b 82 8c 47 9a b9 3c 3b 7a d6 8f 66 fa c8 5e ea 47 f3 be 7e d4 b3 67 23 f8 1a 9e db ff f9 1f 50 9f a2 43 27 79 87 8f 56 26 94 c7 5c 8a de 97 97 a6 3d 3b b2 7b bc c9 bf a0 d1 6b e1 ec 3f ff 03 5e 16 23 18 d5 19 74 a0 b0 84 87 aa e9 cc 71 ae c2 7f e6 eb b5 1c 1d 72 d5 86 4e 68 7f 8a 47 bd c5 58 9d 9b f6 38 ac 0b 47 9f ff f9 1f 47 47 4b 79 76 d4 77 8e a4 23 b7 9e e9 42 9f 6d 5a ba a5 ab 30 d9 19 cb 0a 87 b0 df 8e 4e ca bd a9 96 ec 38 3f a4 3f 2d 7d a9 5b 7f be 1f fd 3c 4a f5 cc 99 33 3f 55 fb a6 a5 85 84 5b 5e a9 29 1e f5 c5 23 99 bc c3 28 8f c2 26 34 12 bb 3d 32 a1 eb 7d e7 cc d2 c7 c6 bc 0f af 91 08 eb c9 d1 51 1f 72 f4 9d 37 f3 fd 96 be 9b bd a3 f0 71 f4 9f fd b7 f8 e9 e5 fb 1f 51 f3 0c e6 75 1e ee 9f cd 65 e3 01 60 42 10 c8 8a 9a e3 85 7e 7b 74 04 b3 67 ce 8f 9c be bd b0 34 9c 47 99 cf 7c 3f 7e da bf a4 15 ca d8 c0 99 b7 48 ac 9d 15 74 5d 3f 0a cb ac 53 30 a6 98 00 f9 e8 32 65 78 ee b0 fc 16 7b 3f 43 60 a4 83 fc fa cf ff f8 c2 a7 bf a2 0c 1e 7c 90 f1 e3 f8 68 d0 c0 79 3c 5a c6 cf e2 f1 b3 f3 a3 ed 51 58 15 8e 12 b1 d8 85 08 7f e3 17 fc 7b d1 5e 8c 35 19 a7 56 3c 2a 8f d5 33 c8 38 20 2b 70 66 cf 8c a8 65 aa fa d8 d1 8f 7e 44 ff f3 3f 8e dd b5 93 45 45 f8 0c d9 ca 00 d6 24 24 49 f3 cd 44 07 c0 18 d9 da c2 d2 4f 4e be f9 70 a6 af 27 f6 6c ee a4 83 af 92 7c c6 57 3e ad 40 cd c7 31 21 e5 35 24 7c 9a bd f0 b1 97 45 98 f7 67 f6 ea 68 ac af 8e 0a b3 99 3d 0b 87 d8 30 66 b8 e7 66 00 f6 32 40 2d 00 e8 8a 02 af ec 82 15 40 c6 4c 9f 2f 66 b0 2b a0 da af 14 f9 1b 0e c1 e0 f5 9e 39 d6 b5 d0 31 ef 2e 2d 9f a6 3f a9 79 df 74 c4 e0 c8 11 ba 54 e9 ed 5d d4 24 f5 cc c1 29 12 75 78 02 58 50 e5 b9 d8 83 c7 c9 c2 e9 8b 06 3c 40 1d fa ba de 13 fb d2 e7 97 68 4a 00 3a 76 0b 96 73 6c 88 03 78 e9 cb 4e 7d 35 7e 9c d9 13 7d 36 df 88 43 cc 64 49 21 ba 62 21 71 24 05 db 65 fd c7 c1 8f ce 7a 63 a8 dc 9c 93 2f 5f e2 58 8a fe f3 ed 97 f3 6b 51 2c 14 8b bf d6 99 d8 7b 64 bb f3 fe 47 d4 10 6d c8 76 3a 72 4e a3 e2 44 8a 9e 86 df 7e 69 f2 e9 c7 bb 10 35 4c 71 7a b8 31 05 7a dc 99 40 ff 72 b2 a3 87 85 af 5b 6c 59 1a 9d 4d 66 f6 dc c6 09 93 3e 29 b8 a4 2c 11 26 c0 99 cf 16 b8 6d 53 23 d1 61 3b 38 15 0a 89 14 Data Ascii: 1faavJ(cwD6q&`0=]5!~s>\|iT_z},#_']HGj_9\-Q'2G2>,t>y?o>B/iMX\ -[Y(WO7Gg(J2:FGG#Y#y>b;GH#>;G<;zf^G~g#PC'yV&\=;{k?^#tqrNhGX8GGGKyvw#BmZ0N8??-}[<J3?U[^)#(&4=2}Qr7qQue`B~{tg4G\|?~Ht]?S02ex{?C`\|hy<ZQX{^5V<38 +pfe~D?EE$$IDONp'l\|W>@1!5$\|Egh=0ff2@-@L/f+91.-?ytT]$)uxXP<@hJ:vslxN}5~}6CdI!b!q$ezc/_XkQ,{dGmv:rND~i5Lqz1z@r[lYMf>),&mS#a;8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49702	148.72.88.30	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Mar 25, 2021 21:56:15.094152927 CET	2946	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: covid19-explorer.org Connection: Keep-Alive
Mar 25, 2021 21:56:15.449062109 CET	2952	IN	HTTP/1.1 404 Not Found Date: Thu, 25 Mar 2021 20:56:15 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 857 Keep-Alive: timeout=5 Content-Type: text/html Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 55 df 8f e3 34 10 7e ef 5f 31 e7 13 82 93 9a 6d 92 6d 77 4b 36 a9 84 80 83 93 d0 71 12 f0 c0 a3 9b 4c 1a b3 ae 1d 6c a7 3f ee c4 ff ce d8 4e b6 ed 71 0f 68 a5 75 3c 9e f9 e6 9b cf 33 6e f9 ea 87 5f bf ff fd cf 0f 3f 42 e7 f6 72 33 2b a7 05 79 43 8b 13 4e e2 e6 ad 90 08 ef b5 83 b7 7a 50 4d b9 88 d6 59 b9 47 c7 29 ce f5 09 fe 3d 88 43 c5 6a ad 1c 2a 97 b8 73 8f 0c c6 5d c5 1c 9e dc c2 03 3f 41 dd 71 63 d1 55 83 6b 93 35 83 09 44 f1 3d 56 ec 20 f0 d8 6b e3 ae 42 8f a2 71 5d d5 e0 41 d4 98 84 cd 1c 84 12 4e 70 99 d8 9a 4b ac b2 bb 94 11 8c 75 67 22 e9 13 8f f9 6a 6b c9 be d5 cd 19 3e cd 00 b6 bc 7e de 19 cf 3f a9 b5 d4 a6 80 d7 88 f8 34 fb 67 16 7c e6 d0 65 73 e8 83 6b 4b c9 93 96 ef 85 3c 17 c0 7e 46 79 40 27 6a 0e ef 71 40 36 07 f6 1b ee 34 c2 1f ef e8 3b 7c ce e1 c5 67 0e df 19 a2 46 4e bf 0c b5 68 38 fc 64 b8 6a 7c 94 e5 ca 26 16 8d 68 9f a6 14 47 14 bb ce 15 a0 b4 d9 73 e9 cd 7b 6e 76 42 15 90 fa 4d cf 9b 46 a8 dd b8 f3 35 25 5c 8a 1d 1d d7 24 0d 9a c0 fd ce 2b c5 85 42 13 a8 47 80 44 62 4b b8 c0 07 a7 2f b0 89 89 e9 3e 37 3b dd 17 90 3d 3e f6 a7 68 3c 45 9d c9 96 3d a6 d1 38 52 99 10 b2 d5 ad 39 a6 8b 56 cf c9 e8 63 b1 c5 56 1b 92 26 6c 78 eb 46 82 8d b0 bd e4 a4 ab e3 5b 89 1e 64 bc 6a 52 1a d8 54 92 4c f6 4d f2 10 02 46 2e ab f4 ab 9b c3 7e b0 5d 72 ff df 9a f3 55 f4 eb b2 cb 55 5a f1 11 0b 58 ae 23 e9 1b e9 ef d3 f4 46 77 fa cb a9 66 2f b9 4f 26 69 0a 3e c7 c9 b3 2f e0 e4 d7 38 c9 56 3b a7 f7 45 80 0a 40 fd 15 d1 98 25 9b 8e 78 38 9a 5a f2 3e 5f e7 f8 f0 72 df 0d d6 da 70 27 b4 f2 5d a2 42 bb 96 8b d0 ea d4 f2 8b 38 a4 b3 d2 37 30 ed 1b 71 80 5a 72 6b e3 20 c6 ae 08 38 b1 61 18 88 a6 62 68 8c 36 34 19 00 a5 3d ec a0 0b 15 54 2c 4b 53 16 c5 8e df de 81 5c 7a 2d cf 3b ad a0 d7 42 39 02 5e a5 f3 7c 45 dd 32 5f a7 b0 ce e9 3f 03 eb 8c 7e c6 44 52 ba bf c8 ab 62 61 ca bc 9d 68 56 ac 15 52 16 81 7c 74 2c 5e b7 ed 9a 93 5e 63 5c bc 60 7a 0b 16 63 4a cf 18 4e 15 5b e6 0c ce 15 7b 5c 32 f0 18 15 1b 03 d9 f5 80 56 ec 32 58 ec fa 4e 2a f6 ed 8b ab bf 38 8f d7 9f d8 e6 15 3d 5f 94 20 d4 bf 20 01 e8 e3 5a 38 ea d6 a9 f4 1b 39 43 d3 65 f9 78 76 7b ba 27 a5 13 41 92 47 b1 8f dc 28 9a 0a b6 29 6d cf d5 e4 34 9c 82 47 5c 68 90 91 9e b9 0d 31 20 17 5a 08 6d 42 26 ec 2e 8b 4f ae a2 27 b7 f5 62 c2 37 cb 74 09 e1 e6 de d0 b5 67 23 c3 29 ec f2 f1 7f 2b 79 80 9b 39 ba 94 d5 4f 8e be f5 d9 e6 5d 0b 67 3d 80 eb 84 7a 86 63 c7 9d df 7e 6d 10 a4 d6 cf 54 24 d1 33 60 3b 3d c8 06 b6 48 cd e4 47 be a7 58 8b 61 b0 79 ed 28 18 c1 0a 87 a0 8f d4 90 77 e5 a2 ff 32 fd 71 a1 75 ec e7 45 fc 2d fa 17 8e 62 90 ec a3 06 00 00 Data Ascii: U4~_1mmwK6qLl?Nqhu<3n_?Br3+yCNzPMYG)=Cjs]?AqcUk5D=V kBq]ANpKug"jk>~?4g\|eskK<~Fy@'jq@64;\|gFNh8dj\|&hGs{nvBMF5%\$+BGDbK/>7;=>h<E=8R9VcV&lxF[djRTLMF.~]rUUZX#Fwf/O&i>/8V;E@%x8Z>_rp']B870qZrk 8abh64=T,KS\z-;B9^\|E2_?~DRbahVR\|t,^^c\`zcJN[{\2V2XN8=_ Z89Cexv{'AG()m4G\h1 ZmB&.O'b7tg#)+y9O]g=zc~mT$3`;=HGXay(w2quE-b

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 25, 2021 21:56:09.027302980 CET	52.4.17.40	443	192.168.2.3	49706	CN=*.rstudio.cloud CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Jan 14 01:00:00 CET 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Feb 13 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Mar 25, 2021 21:56:09.027587891 CET	52.4.17.40	443	192.168.2.3	49705	CN=*.rstudio.cloud CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Jan 14 01:00:00 CET 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Feb 13 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Mar 25, 2021 21:56:09.046703100 CET	54.230.114.89	443	192.168.2.3	49708	CN=mathjax.rstudio.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Dec 25 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Mon Jan 24 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Mar 25, 2021 21:56:09.050487041 CET	54.230.114.89	443	192.168.2.3	49707	CN=mathjax.rstudio.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Dec 25 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Mon Jan 24 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 3120 Parent PID: 792

General

Start time:	21:56:04
Start date:	25/03/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff663900000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 5556 Parent PID: 3120

General

Start time:	21:56:05
Start date:	25/03/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3120 CREDAT:17410 /prefetch:2
Imagebase:	0x2d0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://covid19-explorer.org

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Malware Analysis System Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 3120 Parent PID: 792

General

Analysis Process: iexplore.exe PID: 5556 Parent PID: 3120

General

Disassembly