top title background image
flash

FuiZSHt8Hx.dll

Status: finished
Submission Time: 2021-05-11 11:46:54 +02:00
Malicious
Trojan
Ursnif

Comments

Tags

  • BRT
  • dll
  • gozi
  • isfb
  • unpacked
  • ursnif

Details

  • Analysis ID:
    410858
  • API (Web) ID:
    778462
  • Analysis Started:
    2021-05-11 11:47:22 +02:00
  • Analysis Finished:
    2021-05-11 11:58:06 +02:00
  • MD5:
    c4c0b19091c6edd5fd46867caf99026d
  • SHA1:
    5b1dbdbab64ebcb665e91d442a847cc3a9552a38
  • SHA256:
    821f1b68c207b41e21b519610931ce46719307d99e3e8aeb397ac720d870b476
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 84
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 33/68
malicious
Score: 21/47
malicious

IPs

IP Country Detection
193.239.84.195
Romania
40.97.164.146
United States
54.247.61.18
United States
Click to see the 23 hidden entries
205.185.208.142
United States
205.185.208.79
United States
52.97.201.2
United States
40.101.83.18
United States
216.18.168.166
United States
151.101.1.44
United States
52.97.201.114
United States
192.229.221.215
United States
52.97.155.114
United States
52.98.152.162
United States
173.194.76.156
United States
64.210.135.70
United States
66.254.114.32
United States
64.210.135.72
United States
52.97.250.194
United States
104.20.184.68
United States
66.254.114.38
United States
172.217.19.101
United States
192.229.221.206
United States
52.98.151.242
United States
66.254.114.238
United States
172.217.16.99
United States
40.97.156.114
United States

Domains

Name IP Detection
horunekulo.website
193.239.85.9
worunekulo.club
193.239.84.195
bmedia.justservingfiles.net
0.0.0.0
Click to see the 45 hidden entries
ht-cdn.trafficjunky.net
0.0.0.0
srtb.msn.com
0.0.0.0
hw-cdn2.adtng.com
0.0.0.0
www.redtube.com
0.0.0.0
img.img-taboola.com
0.0.0.0
eu-adsrv.rtbsuperhub.com
0.0.0.0
stats.g.doubleclick.net
0.0.0.0
web.vortex.data.msn.com
0.0.0.0
vz-cdn.trafficjunky.net
0.0.0.0
ht.redtube.com
0.0.0.0
static.trafficjunky.com
0.0.0.0
FRA-efz.ms-acdc.office.com
52.97.250.194
www.msn.com
0.0.0.0
vz-cdn2.adtng.com
0.0.0.0
ht-cdn2.adtng.com
0.0.0.0
di.rdtcdn.com
0.0.0.0
ci.rdtcdn.com
0.0.0.0
cdn1d-static-shared.phncdn.com
0.0.0.0
outlook.office365.com
0.0.0.0
www.outlook.com
0.0.0.0
ei.rdtcdn.com
0.0.0.0
cvision.media.net
0.0.0.0
tp-rtb-adserver-eu.eu-west-1.elasticbeanstalk.com
54.247.61.18
redtube.com
66.254.114.238
contextual.media.net
184.30.24.22
vip0x04f.ssl.rncdn5.com
205.185.208.79
hubtraffic.com
66.254.114.32
vip0x08e.ssl.rncdn5.com
205.185.208.142
www.google.de
172.217.16.99
ht-cdn.trafficjunky.net.sds.rncdn7.com
64.210.135.70
cs742.wpc.rncdn4.com
192.229.221.215
stats.l.doubleclick.net
173.194.76.156
cs733.wpc.rncdn4.com
192.229.221.206
ht-cdn2.adtng.com.sds.rncdn7.com
64.210.135.70
geolocation.onetrust.com
104.20.184.68
HHN-efz.ms-acdc.office.com
52.98.151.242
gmail.com
172.217.19.101
outlook.com
40.97.156.114
hblg.media.net
184.30.24.22
ei.rdtcdn.com.sds.rncdn7.com
64.210.135.72
a.adtng.com
216.18.168.166
lg3.media.net
184.30.24.22
ads.trafficjunky.net
66.254.114.38
cs2178.wpc.rncdn4.com
152.199.21.187
tls13.taboola.map.fastly.net
151.101.1.44

URLs

Name Detection
https://onedrive.live.com;OneDrive-App
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
https://ci-ph.rdtcdn.com/videos/201912/16/269091021/original/(m=bIa44NVg5p)(mh=s8rk-6t3NOgsVKka)0.we
Click to see the 97 hidden entries
https://cdn.cookielaw.org/vendorlist/googleData.json
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/202011/14/37979511/original/10.webp
https://cv-ph.rdtcdn.com/videos/202006/03/320302721/360P_360K_320302721_fb.mp4?k1o3mOF8OYUJh346bmnal
https://ei.rdtcdn.com/m=eGJF8f/media/videos/201910/14/23039601/original/9.jpg
https://cv-ph.rdtcdn.com/videos/202006/03/320302721/360P_360K_320302721_fb.mp4?yHlrl6BieqoXxVP-gWPW9
https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
http://www.twitter.com/
https://gmail.com/greed/HrSmnFpGUh12/_2FpwPMPFik/bCT3MhW7Qy3fo8/BvutaCWIfwygGzKHyfqWq/gFuvGsw9EwY0E_
https://ei-ph.rdtcdn.com/videos/202006/03/320302721/original/(m=bIa44NVg5p)(mh=Nf5n1aSFTz4R9-Fi)0.we
https://ei-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/005/183/thumb_1103531.webp
https://ei.rdtcdn.com/m=eGJF8f/media/videos/201611/11/1803966/original/15.jpg
https://ei.rdtcdn.com/m=bIa44NVg5p/media/videos/201910/14/23039601/original/9.webp
https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
https://outlook.office365.com/login/greed/6JA2L69_2BCA0Om9/oYDRb7X4mM7CMUV/GzjWTqcdoobhO1aa1Z/P3XTZR
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/201910/14/23039601/original/9.webp
https://jp.redtube.com/
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/201908/02/19844991/original/12.webp
https://ei.rdtcdn.com/m=ejrk8f/media/videos/201709/01/2415238/original/8.jpg
https://gmail.com/greed/lctrLIwgY_2B/TP6odpP7ezu/WCBoLTnqYWdq8j/Q4KzEyzfruaU2o4AYZaBe/eTztEonZ_2FUSm
https://cdn1d-static-shared.phncdn.com/timings-1.0.0.js
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/201904/09/15637471/original/7.webp
https://de.redtube.com/
https://ci.rdtcdn.com/www-static/cdn_files/redtube/images/pc/site_sprite.png?v=c68764eb72df2fd284980
https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656
https://ei.rdtcdn.com/m=eW0Q8f/media/videos/202011/14/37979511/original/10.jpg
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
https://ei.rdtcdn.com/m=eGJF8f/media/videos/202004/09/30295811/original/
http://api.redtube.com/docs
https://ei.rdtcdn.com/m=eah-8f/media/videos/202007/22/34378181/original/8.jpg
https://ei.rdtcdn.com/m=eah-8f/media/videos/201912/11/25734291/original/8.jpg
https://outlook.live.com/calendar
https://ev-ph.rdtcdn.com/videos/202006/03/320302721/360P_360K_320302721_fb.mp4?validfrom=1620722976&
https://ei-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/007/683/thumb_249751.webp
https://ei.rdtcdn.com/m=eW0Q8f/media/videos/202003/13/29344991/original/7.jpg
https://ci-ph.rdtcdn.com/videos/201909/10/247562661/thumbs_20/(m=eah-8f)(mh=Ln5T67NuvMOAuIgt)11.jpg
https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
https://ei.rdtcdn.com/m=bIa44NVg5p/media/videos/201908/02/19844991/original/12.webp
https://dw.rdtcdn.com/media/videos/201909/17/21887251/360P_360K_21887251_fb.mp4
https://dw.rdtcdn.com/media/videos/201906/13/17537901/360P_360K_17537901_fb.mp4
https://ei.rdtcdn.com/m=eW0Q8f/media/videos/202008/08/34924331/original/10.jpg
https://ei-ph.rdtcdn.com/videos/201909/10/247562661/thumbs_20/(m=eW0Q8f)(mh=KdEKWpiDmjWWqhNG)11.jpg
https://ei.rdtcdn.com/m=eGJF8f/media/videos/202011/06/37717371/original/15.jpg
https://ei.rdtcdn.com/www-static/cdn_files/redtube/fonts/rt_font.svg?v=c68764eb72df2fd284980d4794d31
https://cdn.cookielaw.org/vendorlist/iab2Data.json
https://ci.rdtcdn.com/www-static/cdn_files/redtube/images/pc/ads/fallback_pc_top_right.png?v=c68764e
https://www.msn.com/de-ch/homepage/api/pdp/updatepdpdata"
https://ei.rdtcdn.com/www-static/cdn_files/redtube/images/pc/category/amateur_001.jpg
https://ei-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/146/971/thumb_1175541.webp
https://ei.rdtcdn.com/m=bIa44NVg5p/media/videos/202006/17/32796601/original/9.webp
https://outlook.office365.com/login/greed/x8W8BNR9UNCZa/Twkc4UWe/ksrEjoqLIMBWgNaXvBBgZQc/7caPZuKhoQ/
https://ei.rdtcdn.com/m=eah-8f/media/videos/202003/13/29344991/original/7.jpg
https://ei.rdtcdn.com/m=eGJF8f/media/videos/202007/22/34378181/original/
https://ci.rdtcdn.com/www-static/cdn_files/redtube/fonts/rt_font.woff2?v=c68764eb72df2fd284980d4794d
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
https://ei.rdtcdn.com/m=bIaC8JVg5p/media/videos/201611/11/1803966/original/15.webp
https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
https://dw.rdtcdn.com/media/videos/202009/23/36295991/360P_360K_36295991_fb.mp4
https://ci-ph.rdtcdn.com/m=e_rU8f/pics/pornstars/000/006/163/thumb_662761.jpg
https://ew.rdtcdn.com/media/videos/201908/07/20065021/360P_360K_20065021_fb.mp4
https://ei.rdtcdn.com/m=eGJF8f/media/videos/202010/01/36578231/original/
https://ei-ph.rdtcdn.com/videos/202101/07/381285532/original/(m=eGJF8f)(mh=nQb4aCoV6ofRuJNn)
https://www.redtube.com/?page=2
https://ei-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/004/440/thumb_198761.webp
https://ei.rdtcdn.com/m=eW0Q8f/media/videos/202001/09/26886751/original/12.jpg
https://ei.rdtcdn.com/m=bIa44NVg5p/media/videos/201909/25/22238621/original/2.webp
https://ei.rdtcdn.com/m=eah-8f/media/videos/201910/14/23039601/original/9.jpg
https://ci-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/273/431/thumb_961012.webp
https://ew.rdtcdn.com/media/videos/202007/26/34513381/360P_360K_34513381_fb.mp4
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/202006/12/32620671/original/13.webp
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
https://ei.rdtcdn.com/m=ejrk8f/media/videos/201408/19/860611/original/15.jpg
https://ci.rdtcdn.com/www-static/cdn_files/redtube/images/pc/network-bar-sprite.png?v=c68764eb72df2f
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/201909/25/22238621/original/2.webp
https://ei.rdtcdn.com/m=eGJF8f/media/videos/202010/01/36578231/original/3.jpg
https://ei-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/034/811/thumb_414732.webp
https://ei.rdtcdn.com/m=bIa44NVg5p/media/videos/201904/09/15637471/original/7.webp
https://ei-ph.rdtcdn.com/videos/201909/10/247562661/thumbs_20/(m=bIa44NVg5p)(mh=1Yaa01-wZF-nhfcu)11.
https://ei.rdtcdn.com/m=bIijsHVg5p/media/videos/201612/17/1871313/original/15.webp
https://ei.rdtcdn.com/www-static/cdn_files/redtube/images/pc/network-bar-sprite.png?v=c68764eb72df2f
https://ei-ph.rdtcdn.com/m=bIWpYLVg5p/pics/pornstars/000/039/831/thumb_1399282.webp
https://ew.rdtcdn.com/media/videos/202008/12/35041891/360P_360K_35041891_fb.mp4
https://ci-ph.rdtcdn.com/videos/202101/07/381285532/original/(m=bIaMwLVg5p)(mh=tImdT2H7gTO9VWG1)0.we
https://ei.rdtcdn.com/www-static/cdn_files/redtube/fonts/rt_font.woff2?v=c68764eb72df2fd284980d4794d
https://www.etahub.com/trackn?app_id=
https://dw.rdtcdn.com/media/videos/202007/26/34513381/360P_360K_34513381_fb.mp4
https://ei.rdtcdn.com/m=bIaMwLVg5p/media/videos/202006/17/32796601/original/9.webp
https://dw.rdtcdn.com/media/videos/201908/07/20065021/360P_360K_20065021_fb.mp4
https://static.trafficjunky.com/invocation/embeddedads/
https://amzn.to/2TTxhNg
http://worunekulo.club/greed/Q7ECAhkT09Dh5Dxzx5NND/wHPvdjMQo9yvTSIz/72Cz1yfrj9oas3F/mlrlmmXnF4mFMyXsRS/lAfcYLSQz/emv5Y2LTHh0gnSKiYnKd/yiqaLkEsaxUTLIXXXkb/fKBJ2kKvoXtzyu88vwhB6r/sfNLlep0RDB8s/ZFdFWunl/pI1RYpuDgoeDLfkKFeCA_2F/BTJiso9B2W/oRKpS4iwlP_2BxR5_/2FtiB90t/R.gfk
https://ew.rdtcdn.com/media/videos/201909/25/22238621/360P_360K_22238621_fb.mp4
https://ei.rdtcdn.com/m=bIa44NVg5p/media/videos/202011/14/37979511/original/10.webp
https://ci-ph.rdtcdn.com/videos/201909/10/247562661/thumbs_20/(m=bIa44NVg5p)(mh=1Yaa01-wZF-nhfcu)11.
https://dw.rdtcdn.com/media/videos/201910/28/23719311/360P_360K_23719311_fb.mp4
https://ei.rdtcdn.com/m=bIijsHVg5p/media/videos/201412/30/998020/original/15.webp
https://ei.rdtcdn.com/www-static/cdn_files/redtube/images/pc/ads/fallback_pc_top_right.png?v=c68764e

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\http___cdn.taboola.com_libtrc_static_thumbnails_15494c1f83f34b45710c6136bc079606[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\12[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 304x171, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\1018263891[1].gif
GIF image data, version 89a, 950 x 250
#
Click to see the 97 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\video-index[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\rt_utils-1.0.0[1].js
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\rt_font[1].eot
Embedded OpenType (EOT), rt_font family
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\otSDKStub[1].js
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\otBannerSdk[1].js
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\modernizr[1].js
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\medianet[2].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\medianet[1].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\http___cdn.taboola.com_libtrc_static_thumbnails_7d4a1914f83988c0cb22d7e32e5e29d7[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\http___cdn.taboola.com_libtrc_static_thumbnails_45a5849d6cc96ef07d2370f20bfea334[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\12[2].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 304x171, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\favicon[1].png
PNG image data, 192 x 192, 8-bit/color RGBA, interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\default-redtube_logged_out[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\default-redtube[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\de-ch[1].htm
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\auction[1].htm
HTML document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\analytics[1].js
ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\ad7e2b59-d67f-4c69-8b14-45547302a263[1].jpg
[TIFF image data, little-endian, direntries=0], baseline, precision 8, 950x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\a5ea21[1].ico
PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBkwUr[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB6Ma4a[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gzyNY[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB7gRE[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\default-redtube_logged_out[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\default-redtube[1].css
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\de-ch[1].json
UTF-8 Unicode text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\checksync[1].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\ads_batch[2].json
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\ads_batch[1].json
HTML document, ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\TEX0ICSG.htm
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\DTABAP9Y.htm
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBnYSFZ[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBX2afX[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBRUB0d[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBPfCZL[1].png
GIF image data, version 89a, 50 x 50
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gySTO[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1gzKxK[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1gvzoE[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1gBjOT[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1gBirh[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1gALGD[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1cG73h[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1cEP3G[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1aXITZ[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB14hq0P[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB10MkbM[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AA7XCQ3[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9D8593DD-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B8EF0701-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B8EF06FF-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B8EF06FD-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B1478A0B-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AB2EED32-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AB2EED30-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AB2EED2E-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9D8593E1-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9D8593DF-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{9D8593DB-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{95A50410-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8EF8C450-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8EF8C44E-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8EF8C44C-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{879BFBC6-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7FDF5614-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7FDF5612-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{70C8875F-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{70C8875D-B289-11EB-90E6-ECF4BB82F7E0}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\T8DRMTJ1\www.msn[2].xml
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\55a804ab-e5c6-4b97-9319-86263d365d28[1].json
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gqLTH[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gBjEO[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gBiTM[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gBb9f[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gB50w[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gAY0y[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gAV1d[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gANz4[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1gABgY[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB170q7z[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB15AQNm[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\AA6wTdK[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IUHEMSR9\contextual.media[1].xml
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\52-478955-68ddb2ab[1].js
UTF-8 Unicode text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\2d-0e97d4-185735b[1].css
UTF-8 Unicode text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\22DFL4CR.htm
HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\14[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 304x171, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\13[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 304x171, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\po60zt0\imagestore.dat
data
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml
XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
#