The 'other' VIRUS discovered Nov 2019.

https://securelist.com/chrome-0-day-exploit-cve-2019-13720-used-in-operation-wizardopium/94866/

>>9579245

>>9579245

>>9579245

>>9579245

'>>

If the browser version checks out, the script starts performing a number of AJAX requests to the

attacker’s controlled server

(behindcorona[.]com)

where a path name points to the argument that is passed to the script (xxxxxxx.php). '