Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

2790000.dll

Status: finished
Submission Time: 2021-07-06 14:25:42 +02:00
Malicious
Trojan
Evader
Ursnif

Comments

Tags

  • dll

Details

  • Analysis ID:
    444655
  • API (Web) ID:
    812242
  • Analysis Started:
    2021-07-06 14:28:41 +02:00
  • Analysis Finished:
    2021-07-06 14:44:29 +02:00
  • MD5:
    c40709736c45151601de6db50f379d8b
  • SHA1:
    96fcdac225106f13726477d898a4939ccfcd4781
  • SHA256:
    56b998448c4cd2240edcf0446c8bc7da54f4568ba99d1f3774c43af202aac995
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious

IPs

IP Country Detection
45.90.58.179
 Bulgaria
40.101.136.2
 United States
195.20.250.115
 Germany
Click to see the 15 hidden entries
40.97.116.82
 United States
82.165.229.54
 Germany
82.165.229.59
 Germany
104.20.185.68
 United States
82.165.229.16
 Germany
151.101.1.44
 United States
40.101.137.18
 United States
87.248.118.22
 United Kingdom
52.97.233.34
 United States
40.97.148.226
 United States
40.101.81.146
 United States
52.97.201.50
 United States
82.165.229.87
 Germany
52.97.144.178
 United States
142.250.180.206
 United States

Domains

Name IP Detection
taybhctdyehfhgthp2.xyz
 45.90.58.179
img.img-taboola.com
 0.0.0.0
FRA-efz.ms-acdc.office.com
 52.97.144.178
Click to see the 26 hidden entries
dl.mail.com
 0.0.0.0
cvision.media.net
 0.0.0.0
plus.mail.com
 0.0.0.0
img.ui-portal.de
 0.0.0.0
www.outlook.com
 0.0.0.0
s.uicdn.com
 0.0.0.0
web.vortex.data.msn.com
 0.0.0.0
s.yimg.com
 0.0.0.0
outlook.office365.com
 0.0.0.0
srtb.msn.com
 0.0.0.0
www.msn.com
 0.0.0.0
edge.gycpi.b.yahoodns.net
 87.248.118.22
geolocation.onetrust.com
 104.20.185.68
wa.ui-portal.de
 82.165.229.54
mail.com
 82.165.229.87
plusmailcom.ha-cdn.de
 195.20.250.115
resolver1.opendns.com
 208.67.222.222
lg3.media.net
 23.211.6.95
hblg.media.net
 23.211.6.95
outlook.com
 40.97.116.82
contextual.media.net
 23.211.6.95
www.googleoptimize.com
 142.250.180.206
wa.mail.com
 82.165.229.16
HHN-efz.ms-acdc.office.com
 52.97.201.50
www.mail.com
 82.165.229.59
tls13.taboola.map.fastly.net
 151.101.1.44

URLs

Name Detection
http://taybhctdyehfhgthp2.xyz/jdraw/DA9CpuaF1ChJieGGmxekNIf/_2Bf5dRFGl/6ha6ihRMMP4_2FTPW/uuFq9TAcj8h4/qSnVVL6dcdH/5B0njoQO8HRJ4A/GcUxJA_2B5IFHeGazw9j9/9KKhiR_2FNDslKNn/XvL5Nb3D7Leowhe/18j3DbadW1d4jdR2RZ/_2B6y0eTA/dUCR_2BcVc2Ddna9_2Fk/A65RCh8ja7G/kzkCTcCF/r.crw
http://taybhctdyehfhgthp2.xyz/jdraw/YfhAKSrZ_/2B_2FjO_2BEfGkA859_2/BmcHGy0Exj8cPI6312d/hMFhmCvKYhGzWSE_2F3JZz/aqG_2Fo0JgK7b/IpJP6WZQ/EwJ0P5ojrmoHc7KEeUKS_2F/dr_2FAQUA2/1o9m_2FVWjRUIwasm/FW5sGJpTKtUf/M_2FEcpAeM7/B8jNam9JQ5TnKP/12F_2FHiebPKRmxJQmXnR/gGjhIMF_2FS7t5KV/L.crw
http://taybhctdyehfhgthp2.xyz/jdraw/senUH03QWJY9zy0TGKst3cx/OBC4WplDXH/oqcxDz6cjN7h_2F8d/LfQkFQ_2Fy0T/FAoEVOXxiKp/e5g4BIHVUHnefb/KqKdZd97vSsTK6buJ9MPp/9jx2EzrYaeeWP1ma/erE06KdAoUvLcED/U3KE1nRYvwMMSqnPv9/1aDo6f8tR/MrfKrfcn0yaSbhv8m_2F/z2V0PdyA0_2FVLnznN3/BN9K6zV1nJnb/WmUYG.crw
Click to see the 29 hidden entries
http://taybhctdyehfhgthp2.xyz/jdraw/RLbbZoqov27/RZXl47dw7WS2hD/qIyj2qjQipAh2ErH6xoal/uDkYECdj5jTgffUh/mYJ2XVA9rwPHUy2/QjwrTGMY_2F64PN_2F/YUDgMw7p1/s2t1KKiFVgqn2ZlMG_2B/D9NyHTdv3F0qdbbbGle/lx_2BPHRlHmFCQVN9dlzs4/OJpccJSrSanUR/bzsZAfU_/2BqRTtL2elDx7sY/V.crw
http://taybhctdyehfhgthp2.xyz/jdraw/E8g7ocQa8Jp_2FkJKDIXto/jGrpKFGFm3zEl/pc9Bin_2/BMwThN1Xs8wlqXtLb7cKLtC/SgG36jLoe_/2F65aot9fOJ0PDXBC/hsoWNxn2X_2B/Y6w_2BH_2FO/I1GK6y1TlNcZL2/398IfCwmPSzVTZlSZ3ktc/prVDzQkMHshmRKXt/2UqbNyiak3Vc0V_/2FJ6G0D_2F90GG7ZcC/Q_2FC1PCI/F.crw
http://taybhctdyehfhgthp2.xyz/jdraw/SeHkUEUxsMZP1AhS/3IlboRjollxufxg/k0C1fYozGaNykNILuY/7mbt1CT39/8yuLSdKM2t03HpRX2_2F/fjGqyiYIkzVmY7BL2T3/lJeut6ngXNw7Xsle3Ac_2F/uCeLuklVXJGPS/OHU0EBrz/suKxF4Ft_2BK7qPRfzoyHnN/GhDiNtOZSu/bj6BgaSC_2FhnYL1W/3sMLu_2F/RiRf.crw
http://taybhctdyehfhgthp2.xyz/jdraw/pBKH4QNe_/2BwOCg1mW3gHfkXlroYv/qwMSGdzvy41rio90Pee/xoNO_2FGsX6HBf_2FeDJF5/0Zm4ko6Y_2B7F/5nkQ7CLE/x6UrnmgoKHXkC63igNAKiIM/Lhtzb27hq2/jm8Q2hap4uiXv4gmQ/mKxqFGYK_2BR/j5HJqnO7p7O/6C_2B0biaTD1w9/N2tivlNu2ujN1Xlxq5iZI/v2iFk.crw
http://taybhctdyehfhgthp2.xyz/favicon.ico
http://taybhctdyehfhgthp2.xyz/jdraw/1n_2BflhePO/uMnCopo6qdTrYV/FWhAJA9XLeWgIwqNDciEV/Ma2pywOVrVC7gojv/E6T3hs07V6KYbye/xvW81IAf7IZHKKI_2B/RArbctFfL/2TGsfNIzn81_2FbGpeyH/ukdp1ZDGefO14nBo8EX/nrPB_2FBmNloUapimH_2FE/RWs6DX_2B2Z0G/i8D3YZuF/j1ldvh1CQhgEI/V37EE.crw
http://taybhctdyehfhgthp2.xyz/jdraw/zTjbj3kKOaJ_2FHCn/EBB0ghxmT2zf/tZbW0q1dqvV/yVEV1RDmPsuUHe/9FIX_2FieCFBsfpbW1K38/dHn_2BX1vT0rKAiB/QFi0KmjZl6PH4uf/JNL9yHWEao1Jw7Ayug/0ksp4OzRe/qPXlFslPx8Je_2BMuBBh/SGrx7lyKyPKvXD05bnd/0JGzLedhoE7YtvlNRDW9VB/Smf6dY.crw
http://taybhctdyehfhgthp2.xyz/jdraw/TMw5yrrD58_2F_2BhR/g9tx6WwiG/Y4ETyUqNXMfs0pkiHuVm/dVQuHu9BK38oq2QYF9z/cuTLQ3u7OqALxMIyfbyNQp/gDWpeOrsyYhNN/ao8vL_2F/3dQ2wCKcTWt3EGgjtWuBFvo/JER9x_2Bw_/2FiyK5UBn9x3lTG4i/wyJNOkM0xfPY/bTj1Bitzmn0/D5CG_2FPtjEkzq/cTayMyn_2/F.crw
http://taybhctdyehfhgthp2.xyz/jdraw/zTjbj3kKOaJ_2FHCn/EBB0ghxmT2zf/tZbW0q1dqvV/yVEV1RDmPsuUHe/9
https://s.uicdn.com/mailint/9.1722.0/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://nuget.org/nuget.exe
https://contoso.com/
http://taybhctdyehfhgthp2.xyz/jdraw/YfhAKSrZ_/2B_2FjO_2BEfGkA859_2/BmcHGy0Exj8cPI6312d/hMFhmCvK
http://constitution.org/usdeclar.txt
https://s.uicdn.com/mailint/9.1722.0/assets/potec.core.min.js
http://nuget.org/NuGet.exe
http://taybhctdyehfhgthp2.xyz/jdraw/pBKH4QNe_/2BwOCg1mW3gHfkXlroYv/qwMSGdzvy41rio90Pee/xoNO_2FG
http://taybhctdyehfhgthp2.xyz/jdraw/RLbbZoqov27/RZXl47dw7WS2hD/qIyj2qjQipAh2ErH6xoal/uDkYECdj5j
http://mail.com/jdraw/hRJbHpe2NUnd/Fqb6HJaKW_2/FkOSHsbbOjgHBf/KmDpJnEWchUKTqeK6k0hw/2AQJw6Tfj2Wghg40/cDBy1qgsd1Bh7XA/8XTTdRafkqQVGKHltr/VPRzK_2FJ/vWFbmfMAYjdSfOaB_2Fb/Hhjr_2BzU1ZKuqO0buX/LCyXURXRCX4qhBBiB401RQ/MfqjvWezuBF_2/FVb574obq_/2Bf0.crw
https://github.com/Pester/Pester
http://taybhctdyehfhgthp2.xyz/jdraw/TMw5yrrD58_2F_2BhR/g9tx6WwiG/Y4ETyUqNXMfs0pkiHuVm/dVQuHu9BK
http://https://file://USER.ID%lu.exe/upd
https://contoso.com/Icon
https://contoso.com/License
http://constitution.org/usdeclar.txtC:
https://wa.ui-portal.de/opt-out-transfer/mailcom/
http://www.apache.org/licenses/LICENSE-2.0.html
http://pesterbdd.com/images/Pester.png

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo_mailcom[1].png
 PNG image data, 127 x 33, 8-bit colormap, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AA6wTdK[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\2Bf0[1].htm
 HTML document, ASCII text
 #
Click to see the 97 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\17-361657-68ddb2ab[1].js
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\1618479955223-5050[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 150x150, segment length 16, baseline, precision 8, 622x325, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\v2iFk[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\tracklib.min[1].js
 ASCII text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\r[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\otTCF-ie[1].js
 UTF-8 Unicode text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\otSDKStub[1].js
 ASCII text, with very long lines, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\nDjy98Rr[1].htm
 HTML document, ASCII text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\medianet[1].htm
 HTML document, ASCII text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\main.min[1].js
 HTML document, UTF-8 Unicode text, with very long lines, with NEL line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AAKp8YX[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo_1and1[1].svg
 SVG Scalable Vector Graphics image
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\location[1].js
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_signup[1].png
 PNG image data, 40 x 41, 8-bit colormap, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\iab2Data[1].json
 UTF-8 Unicode text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\http___cdn.taboola.com_libtrc_static_thumbnails_d6d46d338affb3594713ba2d27fe615e[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\http___cdn.taboola.com_libtrc_static_thumbnails_952fa311718bc056fbc712720fda8303[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\http___cdn.taboola.com_libtrc_static_thumbnails_573df68c2f40e432c263344397200356[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\droid-normal[1].woff
 Web Open Font Format, TrueType, length 61804, version 1.0
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\droid-bold[1].woff
 Web Open Font Format, TrueType, length 65364, version 1.0
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\de-ch[1].json
 UTF-8 Unicode text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\core[1].htm
 HTML document, ASCII text
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1fdtSt[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\http___cdn.taboola.com_libtrc_static_thumbnails_d6e4874851a44f50a7f444daabbe2574[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_SKP_1024817754__XfRtGeKb[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\gtm[1].js
 ASCII text, with very long lines
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[2].ico
 MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].ico
 MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\f489d89a-0e50-4a68-82ea-aa78359a514f[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\cf0f64e7-0354-429d-b700-c0cb0384258a[1].jpg
 JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\adservice[1].js
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\WmUYG[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BBi9ul[1].png
 PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BBJrII1[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1glRiB[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\consent-management[1].js
 ASCII text
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1cG73h[1].png
 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1cEP3G[1].png
 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\BB1aXITZ[1].png
 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALPrq8[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALPoy1[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALPlvY[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALPlWt[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALPj1E[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALP6Qd[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AALNXDd[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\AAL9VBh[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1520F844-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FD5CACD7-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FD5CACD5-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F52F6DD4-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F52F6DD2-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F52F6DD0-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{EEC98C0D-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E7BEE5EF-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E7BEE5ED-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E0902923-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D216EB05-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1D846800-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1520F846-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FD5CACD9-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C1EC9B9-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0C1EC9B7-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{042C35A9-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{042C35A7-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{042C35A5-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{042C35A3-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{042C35A1-DE56-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D216EB03-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\www.mail[1].xml
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\contextual.media[1].xml
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.msn[2].xml
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB17XeLr[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cfdbd9[1].png
 PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\a5ea21[1].ico
 PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\V[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\V37EE[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Smf6dY[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\RiRf[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\MAILCOM_content_tablet[1].jpg
 [TIFF image data, little-endian, direntries=0], baseline, precision 8, 768x1024, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\L[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\F[1].htm
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BBY7ARN[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB5kJAC[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB1gEFcn[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BACZYXTY\dl.mail[1].xml
 ASCII text, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\BB10MkbM[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AAuTnto[1].png
 PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AALPq41[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AALPpJm[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AALPpDM[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AALOVXU[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\AALBT5R[1].jpg
 JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\55a804ab-e5c6-4b97-9319-86263d365d28[1].json
 ASCII text, with very long lines, with no line terminators
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\4996b9[1].woff
 Web Open Font Format, TrueType, length 45633, version 1.0
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat
 data
 #
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FD5CACDB-DE55-11EB-90EB-ECF4BBEA1588}.dat
 Microsoft Word Document
 #