top title background image
flash

YfDl.dll

Status: finished
Submission Time: 2021-08-01 15:00:27 +02:00
Malicious
Trojan
Evader
Ursnif

Comments

Tags

Details

  • Analysis ID:
    457500
  • API (Web) ID:
    825088
  • Analysis Started:
    2021-08-01 15:00:27 +02:00
  • Analysis Finished:
    2021-08-01 15:16:05 +02:00
  • MD5:
    499200f6a8e223c057c6e16701740721
  • SHA1:
    ef46f9c62b94715b750173074c51100285ff6fe9
  • SHA256:
    d7e64f8e65ce586ce2f0a857810b2a23f85140bf5e52e5a824f09787fb2bf45e
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 80
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 46/67
malicious
Score: 18/35
malicious
Score: 19/28

IPs

IP Country Detection
198.54.117.217
United States
104.26.3.70
United States
162.255.119.73
United States
Click to see the 5 hidden entries
195.110.59.2
Lithuania
216.58.215.230
United States
151.101.1.44
United States
104.26.7.139
United States
104.20.184.68
United States

Domains

Name IP Detection
ad-delivery.net
104.26.3.70
cvision.media.net
0.0.0.0
www.alliancer.bar
0.0.0.0
Click to see the 17 hidden entries
web.vortex.data.msn.com
0.0.0.0
www.allianceline.bar
0.0.0.0
img.img-taboola.com
0.0.0.0
srtb.msn.com
0.0.0.0
ad.doubleclick.net
0.0.0.0
www.msn.com
0.0.0.0
alliances.bar
195.110.59.2
contextual.media.net
23.211.6.95
geolocation.onetrust.com
104.20.184.68
btloader.com
104.26.7.139
lg3.media.net
23.211.6.95
parkingpage.namecheap.com
198.54.117.210
allianceline.bar
162.255.119.73
hblg.media.net
23.211.6.95
tls13.taboola.map.fastly.net
151.101.1.44
dart.l.doubleclick.net
216.58.215.230
alliancer.bar
162.255.119.245

URLs

Name Detection
http://alliances.bar/jdraw/AZ9j6FN_2FTyei6/Zf0uCNl_2FdnsseDLQ/aAlru6mfg/_2BxJ18hXN8l3o6HRZtg/iMkRHAWOXQH7Sonii2y/ZUDDqy42horX1ipsJquAAp/PE_2BV88LYzPh/_2BwspqN/QHL0gRAjrGmh0Ze8EXmvwJx/w8RwH_2Fv_/2FEesIeaXL2YGMyBr/PGDsr7HWeSeF/e3J46D1VO9zlgcp/85Zp5.crw
http://alliances.bar/jdraw/TAmAcu8EQ5dbq_2FLn/jmsAPZU0N/O3d42v1YOxC8LCsNcUdI/hBRtAVsuP0wmqk3iAnH/V7a2yIwEeWGhi2w2781UJd/XfMuL5OGMx46D/tX7UDvFf/Y_2BiaZRVpr3DW0jCRNM81D/ubtn4Y0mDo/Zf69CqE_2FlQ0hZy6/_2B_2BpRSoEQ/klrzoZkO8B_/2BwdYmhPaHQxFS/cUtgYxD_2/F.crw
http://alliances.bar/jdraw/KzfCuU1nYQ/2jKJWMeBiltqUkBZk/bJHRs3aRSUlv/cI63tiCHI_2/F5uaZGCIn42HAA/37yNTKIJLuVjIBN3j61BH/f_2F7jKyVaT3WSHP/Idyt_2BFxwVV7Ez/wF0a5CSrL3svyQDzt7/z5kTlRVsI/o_2BijKkihsvPwp7ObK8/nGfEqkF_2BV9O_2BYHe/y7YIFWRDvDFDsnXQU1dk4w/ugyqJTKGN21dPtrvVHSLW/X.crw
Click to see the 97 hidden entries
http://www.alliancer.bar/jdraw/T1Oye5dXOyO7X2/W2Jf88M5e37Kz6KOh7AdL/wY5JZWvpnXF42vVg/l7s4mKoV_2FqPNE/dhTHk84TOdHYwxXQ3F/ZDAxuudp3/D1Qs8omUsHmDB_2FVyG9/fdORbAiNcjwPXWrQQ0O/25Y_2BweBhA69miE0hz3Mk/RqfVs38U7EbR6/7NRpQCUV/WpJhqepI5X3UmOUCA7tjaJ_/2FPWDLDzx0/6EjYsFZMbGs/q1m.crw
http://alliances.bar/jdraw/_2Fgi_2F0q9mbLIMOTyI/MSZHR0hHa_2BmeQiSR3/W8oggZpI5myExagD6_2BTj/ey2UGr7NbceZG/WQBy5MHE/7qXKpRH7zu077im_2F1dGJV/DbKkDe7jsz/yWoZjzp1UojMkJrXW/XsiPUNe_2BZ8/DIfEiNMAFM1/A0a2dGIo685cVI/iUyIhZAYyWsoPEjMSHZWX/6iyEp102eL/_2F_2FrX.crw
http://allianceline.bar/jdraw/4trhqHpiyJW/gPL61gbH3V3gm2/GiN8WmuvnoRNfvQO06HHD/TolcFVz_2FK8ZYP2/IZQ72utUu8FkRq_/2F067OV_2FLlPUB9yd/i0sqdLKlL/TufDKlZhewFrgjSOjZoV/kw8l6gL0iujBb8tryKS/RGvMacSQhLHBDOTrqNLG4m/uP_2BKAulmZfa/zQq7CHkj/_2F1r9d83Jng_2Fktvq5Alz/Ls6WH3GEdzGxn/iTBX.crw
http://allianceline.bar/jdraw/cryAR_2BXe/tfZsZbCTIFSKEc_2F/fRFkFMDrwQ2J/nrfzPEYzAHe/Wx7an4ijbM8zE_/2FhpezUV4yO_2FfukN7U6/uBGYkZ4E31D33UZI/2HgOfw9U8TtlGcU/RO3AW2pv4UBCdojWiG/XAiw8U4II/LFIW7fzb6NeZ11ktdY_2/BmSX_2BpD6QEHKNSkw3/GsrABMXgDqbSFWjB/BiqFiS.crw
http://allianceline.bar/jdraw/eNEjgfypiWX/qzBN0pjHkXaIJy/uSQAHTqmu7LUbuntarKiK/xwqbRspQk1D8qp6M/HWl7bj_2FWhMbP8/Uujd82PrM7mxT3Qzg0/MWYHS6cay/F6rvctGR9QcGUIn_2BcA/FoElIX9k6apV8hveoXo/zNk4xAZcRLb7MRvJXwEutR/loIAT32m6_2BY/8Nz5PjSgzU6nn7nO/fTwM.crw
http://allianceline.bar/jdraw/dLL7q72MwgF/_2BKoRFjbhgJAS/vzNzOQYcs22fS9PZmGiqk/ImBn4ZbMkjp0c79n/fXFEqaYEWVKY_2F/_2FJyGoOXr4VTVC0eg/LUPZCf_2B/C1_2BlEDEf8ijbPT3XDP/4GbLjdNj_2Ft1xIX937/olnPKLY6LOBYxvJBmWK5iG/ofDL9uajZoReh/gnTfiCz_/2FJnM9VsOUm_2FxBFWygfHA/WN_2FWTfKr/cGyLVu_2BuD/D0vz.crw
http://alliances.bar/jdraw/PjuRunwYj4Bhvxk9T/FkaG6F1W0LAq/7ctDH_2F3Sg/7ugfKJqoxNQwsg/2ypZ1ap9U9TAmPNK3Mj4E/1tkWj6xiOwNb06Ci/nMiIDTqZjqNR3Sl/Be2FTUJy9LUIgqGDgy/uKg22hRQ4/Py3DVyO8YWF3rk9X3HQr/yNaCoWiag_2BmQ7jPMJ/8l4YPxQA8wBHHEka2W3QS6/U7.crw
https://cdn.cookielaw.org/vendorlist/googleData.json
https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
http://alliances.bar/jdraw/KzfCuU1nYQ/2jKJWMeBiltqUkBZk/bJHRs3aRSUlv/cI63tiCHI_2/F5uaZGCIn42HAA/37yN
https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
http://alliances.bar/jdraw/b812tUOw/5vOcsr2Qa7HjSQYaeUGfQDe/A8EgAMSWJM/_2FFmfetjQhRMnISV/eMe6aV6DLPB
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
http://alliances.bar/jdraw/_2Fgi_2F0q9mbLIMOTyI/MSZHR0hHa_2BmeQiSR3/W8oggZpI5myExagD6_2BTj/ey2UGr7Nb
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
https://onedrive.live.com;OneDrive-App
http://www.hotmail.msn.com/pii/ReadOutlookEmail/
https://twitter.com/
http://allianceline.bar/jdraw/eNEjgfypiWX/qzBN0pjHkXaIJy/uSQAHTqmu7LUbuntarKiK/xwqbRspQk1D8qp6M/HWl7
https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
https://www.skype.com/de/download-skype
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
http://alliancer.bar/jdraw/8hMkfU_2BkV2Ho4GURNxe/X8MBAAmtf27latmq/SxWCuMHAvCWenY2/OeooX6vNMX17Ym3H7Q
https://www.skype.com/de
https://onedrive.live.com/?qt=mru;OneDrive-App
https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
https://www.msn.com/de-ch/news/other/mann-wird-auf-autobahn-von-auto-erfasst-und-schwer-verletzt/ar-
http://popup.taboola.com/german
https://onedrive.live.com/about/en/download/
https://www.bidstack.com/privacy-policy/
https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html
https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
http://alliances.bar/jdraw/
https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
http://alliances.bar/jdraw/Rb3_2FHxtxhMSM8zm/gYEt3B3r9PE_/2FfL3q236io/GFNEH8CEcSGt3Q/Xgu6vIh5KIqx2S1
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
https://outlook.com/
https://www.msn.com/de-ch/?ocid=iehp
https://onedrive.live.com/?qt=mru;Aktuelle
https://cdn.cookielaw.org/vendorlist/iab2Data.json
http://alliances.bar/jdraw/_2FrlUhAClUiRyd8MwHtotk/I15TfspZAu/z01In076RAgynlo0F/aYBbR51uD1ML/uqQjbpx
https://cdn.cookielaw.org/vendorlist/iabData.json
http://alliances.bar
https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/stopp-sie-fahren-mir-gleich-%c3%bcber-den-fuss-sch
http://alliancer.bar/jdraw/T1Oye5dXOyO7X2/W2Jf88M5e37Kz6KOh7AdL/wY5JZWvpnXF42vVg/l7s4mKoV_2FqPNE/dhT
https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
https://amzn.to/2TTxhNg
https://onedrive.live.com/?qt=allmyphotos;Aktuelle
https://www.msn.com/de-ch/nachrichten/regional
https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
http://alliances.bar/jdraw/PjuRunwYj4Bhvxk9T/FkaG6F1W0LAq/7ctDH_2F3Sg/7ugfKJqoxNQwsg/2ypZ1ap9U9TAmPN
https://www.skype.com/
http://allianceline.bar
http://alliancer.bar/jdraw/6t2TJPVp8r4_2Fuvh2KKhY/8YV_2B_2BRJ82/6nGE2eYA/7HHAwpkhVWuf8lW4yXxIq9d/P3s
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/geld-f%c3%bcr-mich-bedeutete-nicht-geld-f%c3%bcr-d
https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
https://outlook.live.com/mail/deeplink/compose;Kalender
http://ogp.me/ns/fb#
https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
http://allianceline.bar/jdraw/_2FYs4QtMw9_2FVqLpLk2/u2LhzC7LFlqce_2B/EJ5CkL6CyTor06H/h9Yb_2BSjV6Rt1S
https://onedrive.live.com;Fotos
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
http://allianceline.bar/jdraw/dLL7q72MwgF/_2BKoRFjbhgJAS/vzNzOQYcs22fS9PZmGiqk/ImBn4ZbMkjp0c79n/fXFE
https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24952290
https://www.msn.com/de-ch/nachrichten/coronareisen
https://contextual.media.net/medianet.php?cid=8CU157172
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24545562&epi=de-ch
http://searchads.msn.net/.cfm?&&kp=1&
http://alliances.bar/jdraw/i1UnGotMRZpYX5QI846/jmFIJI_2FNDz7pkL8TrBB5/fMotNSc0eJn6p/utqPXHuH/Wff27J_
http://ogp.me/ns#
http://alliances.bar/jdraw/AZ9j6FN_2FTyei6/Zf0uCNl_2FdnsseDLQ/aAlru6mfg/_2BxJ18hXN8l3o6HRZtg/iMkRHAW
https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin
http://allianceline.bar/jdraw/cryAR_2BXe/tfZsZbCTIFSKEc_2F/fRFkFMDrwQ2J/nrfzPEYzAHe/Wx7an4ijbM8zE_/2
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa
https://twitter.com/i/notifications;Ich
https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
http://alliancer.bar/jdraw/6t2TJPVp8r4_2Fuvh2KKhY/8YV_2B_2BRJ82/6nGE2eYA/7HHAwpkhVWufpkhVWuf8lW4yXxI
https://www.msn.com/de-ch
https://www.msn.com/de-ch/nachrichten/vermischtes/1-august-feiern-im-kanton-z%c3%bcrich-steigt-auf-d
https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
https://www.msn.com/de-ch/news/other/lenker-31-verliert-auf-a3-kontrolle-%c3%bcber-sein-auto-und-ras
https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
https://www.msn.com/de-ch/
http://allianceline.bar/jdraw/4trhqHpiyJW/gPL61gbH3V3gm2/GiN8WmuvnoRNfvQO06HHD/TolcFVz_2FK8ZYP2/IZQ7
https://client-s.gateway.messenger.live.com

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NewErrorPageTemplate[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\http___cdn.taboola.com_libtrc_static_thumbnails_99e5c79b1689b75f0f0c1e3d399c6deb[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\http___cdn.taboola.com_libtrc_static_thumbnails_26b7c43e8735f7408c60e41fb7e91ecd[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
Click to see the 97 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\httpErrorPagesScripts[2]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\httpErrorPagesScripts[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[2]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[2]
PNG image data, 15 x 15, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\down[1]
PNG image data, 15 x 15, 8-bit colormap, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dnserror[2]
HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\dnserror[1]
HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\adb3478e-c94c-4cdb-9882-fa384ccec861[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\NewErrorPageTemplate[2]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\http___cdn.taboola.com_libtrc_static_thumbnails_d6d46d338affb3594713ba2d27fe615e[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBX2afX[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBVuddh[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBUZVvV[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BBRUB0d[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB6Ma4a[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB1cEP3G[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB15AQNm[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BB10MkbM[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAuTnto[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMjuzS[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMKt8K[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKLyZ[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\checksync[1].htm
HTML document, ASCII text, with very long lines
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\a5ea21[1].ico
PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[2]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1]
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBZ3zrM[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BBPfCZL[1].png
GIF image data, version 89a, 50 x 50
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1ftEY0[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BB1dCSOZ[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAzb5EX[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMqFmF[1].png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKjKP[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKgYD[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMKqfT[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKJAA[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKEJB[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKDQv[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMKD6i[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMJ7BJ[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAMGG6z[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\AAM8s6t[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\4996b9[1].woff
Web Open Font Format, TrueType, length 45633, version 1.0
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\log[1].gif
GIF image data, version 89a, 1 x 1
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\jquery-2.1.1.min[1].js
ASCII text, with very long lines, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\https___console.brax-cdn.com_creatives_b9476698-227d-4478-b354-042472d9181c_59b51455-21ce-4d46-9f4f-9f6d1b718da4_756c7118509673334289d5dc86f79662[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{19D46F30-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC37-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC35-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC33-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC31-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC2F-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC2D-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC2B-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC2A-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC27-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1FE27CB9-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1FE27CB7-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1FE27CB5-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{27D0DC38-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{19D46F2E-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{19D46F2C-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{19D46F2A-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{11855475-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{11855473-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{11855471-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{07B78123-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{07B78121-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{01B84D62-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{01B84D60-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\Y7FEA6TK\contextual.media[1].xml
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4205BD41-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMKkTf[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMKJNj[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMJyjX[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMJU5k[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMJPjh[1].jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\AAMEUCC[1].png
PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\7cedbf13-ebf9-416a-817e-7df06701ed63[1].jpg
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17-361657-68ddb2ab[1].js
ASCII text, with very long lines, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat
data
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4205BD46-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4205BD44-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4205BD42-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\A9VUXYF1\www.msn[1].xml
ASCII text, with no line terminators
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3BB8EFEA-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{351E9074-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{351E9072-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{351E9070-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{351E906E-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{351E906C-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{351E906A-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F1D94DE-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F1D94DD-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F1D94DA-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2F1D94D8-F314-11EB-90E4-ECF4BB862DED}.dat
Microsoft Word Document
#