Analysis Report https://coronavirus.app/

Overview

General Information

Sample URL:	https://coronavirus.app/
Analysis ID:	384313
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.143.157:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.143.157:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49743 version: TLS 1.2

Source: msapplication.xml0.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x3b097cd0,0x01d72cfe</date><accdate>0x3b097cd0,0x01d72cfe</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x3b097cd0,0x01d72cfe</date><accdate>0x3b097cd0,0x01d72cfe</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x3b0e4187,0x01d72cfe</date><accdate>0x3b0e4187,0x01d72cfe</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x3b0e4187,0x01d72cfe</date><accdate>0x3b0e4187,0x01d72cfe</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x3b0e4187,0x01d72cfe</date><accdate>0x3b0e4187,0x01d72cfe</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.2.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x3b0e4187,0x01d72cfe</date><accdate>0x3b0e4187,0x01d72cfe</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: coronavirus.app

Source: shp[1].js.3.dr	String found in binary or memory: http://article.gmane.org/gmane.comp.gis.proj-4.devel/6039
Source: charts[1].js.3.dr	String found in binary or memory: http://chartjs.org/
Source: shp[1].js.3.dr	String found in binary or memory: http://feross.org
Source: shp[1].js.3.dr	String found in binary or memory: http://fits.gsfc.nasa.gov/fitsbits/saf.93/saf.9302
Source: font-awesome.min[1].css.3.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.3.dr	String found in binary or memory: http://fontawesome.io/license
Source: shp[1].js.3.dr	String found in binary or memory: http://jsperf.com/arraybuffer-to-string-apply-performance/2
Source: shp[1].js.3.dr	String found in binary or memory: http://jsperf.com/converting-a-uint8array-to-a-string/2
Source: leaflet[1].js.3.dr	String found in binary or memory: http://leafletjs.com
Source: shp[1].js.3.dr	String found in binary or memory: http://mathworld.wolfram.com/GnomonicProjection.html
Source: shp[1].js.3.dr	String found in binary or memory: http://seclists.org/fulldisclosure/2009/Sep/394
Source: shp[1].js.3.dr	String found in binary or memory: http://stackoverflow.com/a/22747272/680742
Source: shp[1].js.3.dr	String found in binary or memory: http://stuk.github.io/jszip/documentation/howto/read_zip.html
Source: shp[1].js.3.dr	String found in binary or memory: http://unix.stackexchange.com/questions/14705/the-zip-formats-external-file-attribute
Source: msapplication.xml.2.dr	String found in binary or memory: http://www.amazon.com/
Source: shp[1].js.3.dr	String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/52/13.html
Source: shp[1].js.3.dr	String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/65/16.html
Source: shp[1].js.3.dr	String found in binary or memory: http://www.delorie.com/djgpp/doc/rbinter/it/66/16.html
Source: shp[1].js.3.dr	String found in binary or memory: http://www.ecma-international.org/publications/files/ECMA-ST/ECMA-262.pdf
Source: msapplication.xml1.2.dr	String found in binary or memory: http://www.google.com/
Source: shp[1].js.3.dr	String found in binary or memory: http://www.info-zip.org/FAQ.html#backslashes
Source: shp[1].js.3.dr	String found in binary or memory: http://www.linz.govt.nz/docs/miscellaneous/nz-map-definition.pdf
Source: shp[1].js.3.dr	String found in binary or memory: http://www.linz.govt.nz/docs/miscellaneous/nzmg.pdf
Source: msapplication.xml2.2.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.2.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.2.dr	String found in binary or memory: http://www.reddit.com/
Source: shp[1].js.3.dr	String found in binary or memory: http://www.swisstopo.admin.ch/internet/swisstopo/fr/home/topics/survey/sys/refsys/switzerland.parsys
Source: msapplication.xml5.2.dr	String found in binary or memory: http://www.twitter.com/
Source: shp[1].js.3.dr	String found in binary or memory: http://www.webtoolkit.info/
Source: msapplication.xml6.2.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.2.dr	String found in binary or memory: http://www.youtube.com/
Source: shp[1].js.3.dr	String found in binary or memory: http://zlib.net/manual.html#Advanced
Source: shp[1].js.3.dr	String found in binary or memory: http://zlib.net/manual.html#Advanced)
Source: js[1].js.3.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: js[1].js.3.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: js[1].js.3.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.3.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: shp[1].js.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=695438.
Source: leaflet[1].css.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=888319
Source: js[1].js.3.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Source: shp[1].js.3.dr	String found in binary or memory: https://codereview.chromium.org/121173009/
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/css/feather/feather.css
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/css/styles.css?v=286
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/16.png
Source: WJ1N5J7Y.htm.3.dr, imagestore.dat.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/192.png
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/32.png
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/96.png
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/browserconfig.xml
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/favicon.ico
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/safari-pinned-tab.svg
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/img/logo/social.jpg?v=1
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/js/app.js?v=286
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/js/charts.js
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus-92ebd.web.app/assets/js/moment.min.js
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://coronavirus.app
Source: ~DFB9E23C2F13E97041.TMP.2.dr	String found in binary or memory: https://coronavirus.app/
Source: {654F0C49-98F1-11EB-90E4-ECF4BB862DED}.dat.2.dr	String found in binary or memory: https://coronavirus.app/Root
Source: shp[1].js.3.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript/Reference/Operators/Bitwise_Operators
Source: shp[1].js.3.dr	String found in binary or memory: https://encoding.spec.whatwg.org/
Source: shp[1].js.3.dr	String found in binary or memory: https://encoding.spec.whatwg.org/encodings.json
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:300
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: css[1].css.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/OSGeo/proj.4/blob/master/src/PJ_qsc.c
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/OSGeo/proj.4/blob/master/src/PJ_robin.c
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/beatgammit/base64-js/issues/42
Source: charts[1].js.3.dr	String found in binary or memory: https://github.com/chartjs/Chart.js/blob/master/LICENSE.md
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/feross/buffer/pull/97
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/google/closure-compiler/issues/247
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/mbloch/mapshaper-proj/blob/master/src/projections/etmerc.js
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/mbloch/mapshaper-proj/blob/master/src/projections/tmerc.js
Source: shp[1].js.3.dr	String found in binary or memory: https://github.com/nodeca/pako/
Source: shp[1].js.3.dr	String found in binary or memory: https://heycam.github.io/webidl/#dfn-obtain-unicode
Source: js[1].js.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: js[1].js.3.dr	String found in binary or memory: https://pagead2.googlesyndication.com/
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://progressier.com/client/script.js?id=VAP1dMEmm5ag8v6vNcVy
Source: analytics[1].js.3.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.3.dr	String found in binary or memory: https://tagassistant.google.com/
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://unpkg.com/leaflet
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://unpkg.com/shpjs
Source: js[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: js[1].js.3.dr	String found in binary or memory: https://www.google.com
Source: js[1].js.3.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: WJ1N5J7Y.htm.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-156994128-2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.195:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.123.175:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.143.157:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.143.157:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.3:49743 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/30@7/5

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFB7559CADAEAD4517.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3948 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3948 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.65.195	coronavirus-92ebd.web.app	United States	54113	FASTLYUS	false
74.125.143.157	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.1.195	progressier.com	United States	54113	FASTLYUS	false
104.16.123.175	unpkg.com	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
stats.l.doubleclick.net	74.125.143.157	true
cdnjs.cloudflare.com	104.16.18.94	true
progressier.com	151.101.1.195	true
unpkg.com	104.16.123.175	true
coronavirus-92ebd.web.app	151.101.65.195	true
coronavirus.app	151.101.1.195	true
stats.g.doubleclick.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://coronavirus.app/	false		unknown

ID:	384313
Product:	CloudBasic
Start time:	22:06:06
Start date:	08.04.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{654F0C47-98F1-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	03E069D7E1B26AFFF415B718E6109EBE	0C0EB50F2779921C75BF4BD20574BC9759880D83	A05D7F6DF1912B8D58E50393629B1FD9D85FD68181EF660E570211088E693AC9
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{654F0C49-98F1-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	7B58EBC2E6D61CD1B7B308447C9C5195	85F206D0A47334FF69FD80BD472E3718F3BF8559	ADAF844BEFE6AA3A84063472E638F6663F54F90B8ACEC790F13E1663FE5DDC0F
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{654F0C4A-98F1-11EB-90E4-ECF4BB862DED}.dat	Microsoft Word Document	A6D1D777688D9517B2C9378153C41271	CCF2C82593B07D7D713C9194338DF8A3C88B923C	A75438C91AE993C6E2637B86A25E167F8F08B12D18D7BBB17498104C2B2191FC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	D21C6ACAA1CF3C25651CF88EF7667686	89C0B9D0EA394AE4878EB61A3C968171F895BD11	2B012E475A4062203A116AFF8BEF55CC94376DA38C9063140871D6BC91620A41
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	337CF05F237F9A5A13559FEEDF254AA1	81FAA61FDBCB9F79D7D35E770215136EFDEA5F54	F64B1E9D71D361E1C1F03E4735B42861AE4510CACF0BEA6DB10DA0AEBDDED66E
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	03D9E13064BD6EB9086F321A55B4CB00	25D3F7120BC7DF342448DA5ACCA17987F9F68057	0D214855CC695079AA5EEE3951BA32D6F2D26B6DB0F8768273F2855D37FF18C7
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	EFB575613DDA2722DD34A816BF299D48	4E09F67609DE64C22A624A583246D291F9496CA7	6999016C496D32408914060814DD307F396BA8C0541B5F619AEC5FD0305C7519
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	2030FC6C6103C5723691EDC581CEF1C1	E831BF8A4EE819239E7A4BEDDB084724A96C3D22	3C0D1461F98F25B220DDE49A40546710F3DAF1140C1C4931E21350B964D00905
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	73344D1DAB13D93D4087552C4CFCBBE5	C8F38974FB6AB372F781BAC97D9611A3D74C35DF	B0EC497E43A847B71E5DA2D9099EC6D0449BF8B6E335739D102D28431505B4FB
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	FA9EE4E6C3409CE7224738A929D1CC50	9A363EB1B6DBC16CE861325A8397A210CCF08DD5	FB7785E44CEFE126965FC608609F31B42B29E142053C530657958B098C07C6B5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	A010196B2031CBDF35C74E2A81F9AF9A	7EE1E35CB7C403836465157A6E73D868E1B9CA63	83041A9DF282C441EF48239DE248268B3F90F604A8C43A3C44277FDB477D65F5
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators	A9AA766D96F6E63EDA3A1DD86C473981	49F0F8804712788C3E98158BF8043CACDC6E9093	93735E98479C75D9A96D3774C3EE0440799B4E85481BE87A64B4B3558C161A48
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat	data	2F32F621A3B7A89FB87E92FDB65006F9	E828ABCDE88EBB1CB1A9D20FCC44B924ED136D5B	54D57A0CD4CA59A9501A60FABA47616C525FFBB47822C085C49D050B939B538A
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\app[1].js	UTF-8 Unicode text, with very long lines, with no line terminators	BB884F260DFAA444D0DB613F36DD095D	B65388352FE294E6713A0173F2CED712138F792B	2E93FE68B63D5981580272CECE2E1D41ED283A8EFDA018FEE624240D65AD7885
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\charts[1].js	ASCII text, with very long lines	97FC24605AC8278C6097B48AE533BF8A	2EBF370E640006FFF8A7CEA1E4349872903C6D8C	A1282D1420A61D644F43F2664783A86775E47B53F0E2FE74BA1EA92DCBBE7C87
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\font-awesome.min[1].css	ASCII text, with very long lines	269550530CC127B6AA5A35925A7DE6CE	512C7D79033E3028A9BE61B540CF1A6870C896F8	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\moment.min[1].js	ASCII text, with very long lines	AEB7908241D9F6D5A45E504CC4F2EC15	32FDF6730BE34538E09378EC6CC55229D9A70151	D618D4869738E0DC22360F0EC0CBB6433257843F24723FAC240DDA0906685238
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\styles[1].css	UTF-8 Unicode text, with very long lines, with CRLF line terminators	326838E30952FFA9914685CA1C4E6EFF	0BBD60266A7B5CEF6003F2EDBC43675EF00A638E	0B11F05054389928577A5258AE135989B02047099C75B7EDABB3F4C08FB15463
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\192[1].png	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced	EFCC128C82BC04D8B952EFFB10B4A7F5	3B7076A851A918EA0228D5A76A375ED5569F6961	8A78F537514CF1C0E3786BBD5BA5E3186A02D8E9D54032081A957229289A14EA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\css[1].css	ASCII text	D505419ED67D383667F8AA83C9E35F5F	7B203D1F0320A3941E1A525F35237CF8761AAA3A	2E717074CC5B23A4EC8C5D446BC20B1BC6B2EB325B791E08B6B3FD8BE1B64DA6
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\feather[1].css	ASCII text	B52203D69BA471A014E7541D9A5A146E	1642B5E0C506DF49E9C58C81D09266CBF2F24E11	BE1A2361E9DF9EAE7346130C4324C53543BA8FF7BCE97279DD6E4C313D33F664
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\js[1].js	ASCII text, with very long lines	D70E18A3F0440E2C27683ECC1B0DA59E	12E931F09444509608F9CCB01153385753733FF6	B8BBA600054E4BF328C2A7E38B7C2CAC53E137722323761792493DE332E18668
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\leaflet[1].css	ASCII text, with CRLF line terminators	6B7939304E1BC55FAC601AABFFCC528D	78D1949026F76E10977BAB05B743D2A540A8E255	4873060989924F8E92A321A0A38611FFD0252B5BDFDDF7FCE00ABDC8AE2176A3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\leaflet[1].js	ASCII text, with very long lines	21F4844183D578536E5CD3CD4EC844E1	1C9A3AB56B953B7A3FBB8966F3E22BC70C48C8C9	7CDA11AF090FD86B983DB352266309382C9F441D8384F41ED2B19383346CCACA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\WJ1N5J7Y.htm	HTML document, UTF-8 Unicode text, with very long lines	20789B1C6B15BF4136597C1A7439B330	EE59416E770F2C4E9D3407D167BB9984B2777AB7	114D47BF05161FA85466F2E8F9B58A9356FDBE7D7F49FA030B77B1014F7BFB92
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\analytics[1].js	ASCII text, with very long lines	0A4E309B5F2D7439B4F8876B19F37FC7	7AC30F933A2B889EDBE5D3449F4EC90049B0E2A9	F79723478F4C48501CD49AC52B81D6244A6562B9D3F08CE8AB208A8B8878D4C4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\shp[1].js	UTF-8 Unicode text, with very long lines	162FCC9048D0591800A8E3FFDAB400ED	B813C47855D7750D58C2B8DC7D6CA3F9AB1F3B11	B0BF709A938EBF85F367C335410275CE43186E837FF391F20B4E5048AD74C854
C:\Users\user\AppData\Local\Temp\~DF510A034B3DB552CD.TMP	data	A092B5789ADFAD078C9EB04D3BFB9D14	9332724A1E1359719CEA12F0E06609B926F377E9	FE86731112706DA720B7353CCD44870EAF0897B95E58E383D1C92B1D69CDE496
C:\Users\user\AppData\Local\Temp\~DFB7559CADAEAD4517.TMP	data	7063C2DB3D42CD552A23BFF3B17FF2B5	03445809929799546339E5A7DF2D4D56A922220C	6E25AFD825B452147274E2CC6F70E8FE6739FDF423EA4EBD2D885F035058788E
C:\Users\user\AppData\Local\Temp\~DFB9E23C2F13E97041.TMP	data	88BDA266229433BA7E4B2B97017C0AA6	1AB25FB0D4EB5C9FE7A4C0FA3F80D022EA1239F9	AD2783BC452FAA5F75ED8AD814729CB2D6CC9371616CB084DF7DAAD645AEBC56

Analysis Report https://coronavirus.app/

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Networking:

System Summary:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs