Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
http://7lyonline.com/app/feedclick?p=YaNzDr1n8wuMCeH3yeI7_ccZeaeGPnD7yDcN_3ivXIa1ZubyCpAa3MNnA02fFaz8aOuYKJrsTGs1F2mXCl-YVw3jO6VAG9VkBDEK4mzoj_t_qW7ZJPi1e9N5huazfoKx6ICBOkPhmI5elBP0p5ETqgvC4-_dGy4yjqvCmbuyuSMioQEKiPfavdX6-9kT7sye03mG5rN-grEMtCRRqzsm2g
|
URL
|
initial url
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0D3E5F8A-A19F-11EB-90E4-ECF4BB862DED}.dat
|
Microsoft Word Document
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0D3E5F8C-A19F-11EB-90E4-ECF4BB862DED}.dat
|
Microsoft Word Document
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{13E24B38-A19F-11EB-90E4-ECF4BB862DED}.dat
|
Microsoft Word Document
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1]
|
UTF-8 Unicode (with BOM) text, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\NewErrorPageTemplate[1]
|
UTF-8 Unicode (with BOM) text, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\httpErrorPagesScripts[1]
|
UTF-8 Unicode (with BOM) text, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\dnserror[1]
|
HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\down[1]
|
PNG image data, 15 x 15, 8-bit colormap, non-interlaced
|
downloaded
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DF3E8B2475FB85CB4F.TMP
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DF8CE724674FDD1AE6.TMP
|
data
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Temp\~DFB28D409A66DF3C47.TMP
|
data
|
dropped
|
|
There are 2 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\internet explorer\iexplore.exe
|
'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
|
|
|
|
C:\Program Files (x86)\Internet Explorer\iexplore.exe
|
'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4792 CREDAT:17410 /prefetch:2
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://7lyonline.com/app/feedclick?p=YaNzDr1n8wuMCeH3yeI7_ccZeaeGPnD7yDcN_3ivXIa1ZubyCpAa3MNnA02fFaz
|
unknown
|
|
|
|
http://7lyonline.com/app/feedclick?p=YaNzDr1n8wuMCeH3yeI7_ccZeaeGPnD7yDcN_3ivXIa1ZubyCpAa3MNnA02fFaz8aOuYKJrsTGs1F2mXCl-YVw3jO6VAG9VkBDEK4mzoj_t_qW7ZJPi1e9N5huazfoKx6ICBOkPhmI5elBP0p5ETqgvC4-_dGy4yjqvCmbuyuSMioQEKiPfavdX6-9kT7sye03mG5rN-grEMtCRRqzsm2g
|
23.82.9.96
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
iwanttoberecycled.org
|
98.124.199.118
|
|
|
|
7lyonline.com
|
23.82.9.96
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
98.124.199.118
|
iwanttoberecycled.org
|
United States
|
|
|
|
23.82.9.96
|
7lyonline.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
C:\Program Files\internet explorer\iexplore.exe
|
{0D3E5F8A-A19F-11EB-90E4-ECF4BB862DED}
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
AdminActive
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Blocked
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Blocked
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Count
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
LoadTimeArray
|
|
|
|
C:\Program Files\internet explorer\iexplore.exe
|
Time
|
|
There are 10 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1193466C000
|
unkown
|
page read and write
|
|
|
|
11934700000
|
unkown
|
page read and write
|
|
|
|
7FF5A8083000
|
unkown
|
page readonly
|
|
|
|
17A336E0000
|
unkown
|
page readonly
|
|
|
|
59B78FF000
|
unkown
|
page read and write
|
|
|
|
7FF51A907000
|
unkown
|
page readonly
|
|
|
|
7FF597947000
|
unkown
|
page readonly
|
|
|
|
17A33A00000
|
unkown
|
page readonly
|
|
|
|
7FF597AB6000
|
unkown
|
page readonly
|
|
|
|
7FF597A46000
|
unkown
|
page readonly
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
17A3384E000
|
unkown
|
page read and write
|
|
|
|
7FF51A9FE000
|
unkown
|
page readonly
|
|
|
|
119360C0000
|
unkown
|
page read and write
|
|
|
|
17A34002000
|
unkown
|
page read and write
|
|
|
|
7FF5A881E000
|
unkown
|
page readonly
|
|
|
|
3834FE000
|
unkown
|
page read and write
|
|
|
|
7FF5A885C000
|
unkown
|
page readonly
|
|
|
|
11934669000
|
unkown
|
page read and write
|
|
|
|
7FF597B39000
|
unkown
|
page readonly
|
|
|
|
17A33E80000
|
unkown
|
page readonly
|
|
|
|
1193466C000
|
unkown
|
page read and write
|
|
|
|
7FF597943000
|
unkown
|
page readonly
|
|
|
|
17A33851000
|
unkown
|
page read and write
|
|
|
|
7FF5A882F000
|
unkown
|
page readonly
|
|
|
|
7FF51AA64000
|
unkown
|
page readonly
|
|
|
|
17A337D0000
|
unkown
|
page read and write
|
|
|
|
38357E000
|
unkown
|
page read and write
|
|
|
|
7FF597A89000
|
unkown
|
page readonly
|
|
|
|
7FF51A5D0000
|
unkown
|
page readonly
|
|
|
|
17A33813000
|
unkown
|
page read and write
|
|
|
|
7FF5A880A000
|
unkown
|
page readonly
|
|
|
|
17A33908000
|
unkown
|
page read and write
|
|
|
|
11934570000
|
heap private
|
page read and write
|
|
|
|
7FF51AABE000
|
unkown
|
page readonly
|
|
|
|
7FF51A901000
|
unkown
|
page readonly
|
|
|
|
7FF5A88E9000
|
unkown
|
page readonly
|
|
|
|
1B9E0AD0000
|
unkown
|
page readonly
|
|
|
|
37A45FF000
|
unkown
|
page read and write
|
|
|
|
37A415F000
|
unkown
|
page read and write
|
|
|
|
7FF597A5A000
|
unkown
|
page readonly
|
|
|
|
11934613000
|
unkown
|
page read and write
|
|
|
|
7FF5A87F6000
|
unkown
|
page readonly
|
|
|
|
7FF597A4A000
|
unkown
|
page readonly
|
|
|
|
1B9E0856000
|
unkown
|
page read and write
|
|
|
|
7FF51AA4C000
|
unkown
|
page readonly
|
|
|
|
17A33891000
|
unkown
|
page read and write
|
|
|
|
7FF597AD4000
|
unkown
|
page readonly
|
|
|
|
7FF597A7F000
|
unkown
|
page readonly
|
|
|
|
7FF5A88E1000
|
unkown
|
page readonly
|
|
|
|
1193466A000
|
unkown
|
page read and write
|
|
|
|
7FF597A0C000
|
unkown
|
page readonly
|
|
|
|
7FF597800000
|
unkown
|
page readonly
|
|
|
|
7FF597AD7000
|
unkown
|
page readonly
|
|
|
|
7FF51AA55000
|
unkown
|
page readonly
|
|
|
|
1B9E07C0000
|
unkown
|
page readonly
|
|
|
|
7FF5977A3000
|
unkown
|
page readonly
|
|
|
|
7FF5972D3000
|
unkown
|
page readonly
|
|
|
|
11934713000
|
unkown
|
page read and write
|
|
|
|
7FF5A8557000
|
unkown
|
page readonly
|
|
|
|
1B9E0802000
|
unkown
|
page read and write
|
|
|
|
7FF51AA46000
|
unkown
|
page readonly
|
|
|
|
17A33900000
|
unkown
|
page read and write
|
|
|
|
59B7B7B000
|
unkown
|
page read and write
|
|
|
|
7FF5A8544000
|
unkown
|
page readonly
|
|
|
|
7FF51AA2D000
|
unkown
|
page readonly
|
|
|
|
119348D0000
|
unkown
|
page write copy
|
|
|
|
11934920000
|
unkown
|
page readonly
|
|
|
|
7FF5A86D8000
|
unkown
|
page readonly
|
|
|
|
119361C0000
|
unkown
|
page readonly
|
|
|
|
7FF5979E7000
|
unkown
|
page readonly
|
|
|
|
7FF5A87A1000
|
unkown
|
page readonly
|
|
|
|
7FF5A879A000
|
unkown
|
page readonly
|
|
|
|
7FF597B31000
|
unkown
|
page readonly
|
|
|
|
11934669000
|
unkown
|
page read and write
|
|
|
|
7FF5A8839000
|
unkown
|
page readonly
|
|
|
|
17A33853000
|
unkown
|
page read and write
|
|
|
|
11934600000
|
unkown
|
page read and write
|
|
|
|
1B9E0760000
|
heap default
|
page read and write
|
|
|
|
7FF597ABC000
|
unkown
|
page readonly
|
|
|
|
1193466A000
|
unkown
|
page read and write
|
|
|
|
11934702000
|
unkown
|
page read and write
|
|
|
|
7FF51A9EA000
|
unkown
|
page readonly
|
|
|
|
11934642000
|
unkown
|
page read and write
|
|
|
|
7FF51A8B8000
|
unkown
|
page readonly
|
|
|
|
7FF5A8866000
|
unkown
|
page readonly
|
|
|
|
7FF5A87BC000
|
unkown
|
page readonly
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
17A33913000
|
unkown
|
page read and write
|
|
|
|
17A3383C000
|
unkown
|
page read and write
|
|
|
|
1B9E0700000
|
heap private
|
page read and write
|
|
|
|
7FF51AA60000
|
unkown
|
page readonly
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
7FF597AAC000
|
unkown
|
page readonly
|
|
|
|
11934629000
|
unkown
|
page read and write
|
|
|
|
7FF51A9D6000
|
unkown
|
page readonly
|
|
|
|
7FF51A8D3000
|
unkown
|
page readonly
|
|
|
|
7FF5A886C000
|
unkown
|
page readonly
|
|
|
|
7FF597AD0000
|
unkown
|
page readonly
|
|
|
|
7FF51A9C2000
|
unkown
|
page readonly
|
|
|
|
1193466A000
|
unkown
|
page read and write
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
17A33871000
|
unkown
|
page read and write
|
|
|
|
7FF51AA36000
|
unkown
|
page readonly
|
|
|
|
1B9E2270000
|
unkown
|
page read and write
|
|
|
|
7FF5A807F000
|
unkown
|
page readonly
|
|
|
|
1193466B000
|
unkown
|
page read and write
|
|
|
|
7FF51A7EA000
|
unkown
|
page readonly
|
|
|
|
7FF597794000
|
unkown
|
page readonly
|
|
|
|
7FF51AA0F000
|
unkown
|
page readonly
|
|
|
|
7FF51A9D2000
|
unkown
|
page readonly
|
|
|
|
59B7E7F000
|
unkown
|
page read and write
|
|
|
|
1193466C000
|
unkown
|
page read and write
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
17A33829000
|
unkown
|
page read and write
|
|
|
|
7FF5977F5000
|
unkown
|
page readonly
|
|
|
|
7FF5A8825000
|
unkown
|
page readonly
|
|
|
|
119345D0000
|
heap default
|
page read and write
|
|
|
|
7FF5A8553000
|
unkown
|
page readonly
|
|
|
|
1B9E0829000
|
unkown
|
page read and write
|
|
|
|
17A33855000
|
unkown
|
page read and write
|
|
|
|
7FF597B2E000
|
unkown
|
page readonly
|
|
|
|
1B9E0770000
|
unkown
|
page write copy
|
|
|
|
17A34200000
|
unkown
|
page readonly
|
|
|
|
3836FF000
|
unkown
|
page read and write
|
|
|
|
37A44F9000
|
unkown
|
page read and write
|
|
|
|
7FF59788A000
|
unkown
|
page readonly
|
|
|
|
7FF5A88E9000
|
unkown
|
page readonly
|
|
|
|
7FF51A5C0000
|
unkown
|
page readonly
|
|
|
|
7FF51A8DD000
|
unkown
|
page readonly
|
|
|
|
7FF5A8880000
|
unkown
|
page readonly
|
|
|
|
7FF5A863A000
|
unkown
|
page readonly
|
|
|
|
17A3384B000
|
unkown
|
page read and write
|
|
|
|
7FF5A87F2000
|
unkown
|
page readonly
|
|
|
|
7FF51AA19000
|
unkown
|
page readonly
|
|
|
|
17A33888000
|
unkown
|
page read and write
|
|
|
|
1193466C000
|
unkown
|
page read and write
|
|
|
|
7FF5A8884000
|
unkown
|
page readonly
|
|
|
|
7FF51A25A000
|
unkown
|
page readonly
|
|
|
|
17A33902000
|
unkown
|
page read and write
|
|
|
|
7FF51A89A000
|
unkown
|
page readonly
|
|
|
|
7FF5A87F8000
|
unkown
|
page readonly
|
|
|
|
7FF5A85A5000
|
unkown
|
page readonly
|
|
|
|
1193466A000
|
unkown
|
page read and write
|
|
|
|
11934602000
|
unkown
|
page read and write
|
|
|
|
37A40DB000
|
unkown
|
page read and write
|
|
|
|
7FF51A88E000
|
unkown
|
page readonly
|
|
|
|
7FF597A75000
|
unkown
|
page readonly
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
7FF5A884D000
|
unkown
|
page readonly
|
|
|
|
17A337B0000
|
unkown
|
page readonly
|
|
|
|
17A336D0000
|
heap default
|
page read and write
|
|
|
|
7FF51AAC9000
|
unkown
|
page readonly
|
|
|
|
7FF597B39000
|
unkown
|
page readonly
|
|
|
|
17A33854000
|
unkown
|
page read and write
|
|
|
|
11934672000
|
unkown
|
page read and write
|
|
|
|
11934669000
|
unkown
|
page read and write
|
|
|
|
7FF51AA67000
|
unkown
|
page readonly
|
|
|
|
17A33856000
|
unkown
|
page read and write
|
|
|
|
7FF5972CF000
|
unkown
|
page readonly
|
|
|
|
1B9E0902000
|
unkown
|
page read and write
|
|
|
|
59B7D7F000
|
unkown
|
page read and write
|
|
|
|
7FF5A8650000
|
unkown
|
page readonly
|
|
|
|
7FF5979EA000
|
unkown
|
page readonly
|
|
|
|
3835FA000
|
unkown
|
page read and write
|
|
|
|
7FF51A84F000
|
unkown
|
page readonly
|
|
|
|
1B9E0840000
|
unkown
|
page read and write
|
|
|
|
1193466C000
|
unkown
|
page read and write
|
|
|
|
11934669000
|
unkown
|
page read and write
|
|
|
|
7FF597AA6000
|
unkown
|
page readonly
|
|
|
|
1B9E0813000
|
unkown
|
page read and write
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
1B9E0900000
|
unkown
|
page read and write
|
|
|
|
383679000
|
unkown
|
page read and write
|
|
|
|
59B7A75000
|
unkown
|
page read and write
|
|
|
|
1B9E2370000
|
unkown
|
page readonly
|
|
|
|
7FF5A88DE000
|
unkown
|
page readonly
|
|
|
|
7FF51A9C0000
|
unkown
|
page readonly
|
|
|
|
7FF5A85B0000
|
unkown
|
page readonly
|
|
|
|
7FF51AA3C000
|
unkown
|
page readonly
|
|
|
|
37A457F000
|
unkown
|
page read and write
|
|
|
|
17A337C0000
|
unkown
|
page readonly
|
|
|
|
7FF597A6E000
|
unkown
|
page readonly
|
|
|
|
17A33849000
|
unkown
|
page read and write
|
|
|
|
11934669000
|
unkown
|
page read and write
|
|
|
|
11934669000
|
unkown
|
page read and write
|
|
|
|
7FF5A86F3000
|
unkown
|
page readonly
|
|
|
|
1B9E0A00000
|
unkown
|
page readonly
|
|
|
|
7FF597A9D000
|
unkown
|
page readonly
|
|
|
|
59B7C77000
|
unkown
|
page read and write
|
|
|
|
7FF51AAC9000
|
unkown
|
page readonly
|
|
|
|
7FF5A8877000
|
unkown
|
page readonly
|
|
|
|
7FF51A9D8000
|
unkown
|
page readonly
|
|
|
|
7FF5A87FA000
|
unkown
|
page readonly
|
|
|
|
7FF51A93C000
|
unkown
|
page readonly
|
|
|
|
7FF5A86F7000
|
unkown
|
page readonly
|
|
|
|
1B9E0800000
|
unkown
|
page read and write
|
|
|
|
59B797F000
|
unkown
|
page read and write
|
|
|
|
7FF597A0A000
|
unkown
|
page readonly
|
|
|
|
17A33670000
|
heap private
|
page read and write
|
|
|
|
7FF51AAC1000
|
unkown
|
page readonly
|
|
|
|
7FF5A87BA000
|
unkown
|
page readonly
|
|
|
|
7FF5979F1000
|
unkown
|
page readonly
|
|
|
|
119345E0000
|
unkown
|
page readonly
|
|
|
|
11934658000
|
unkown
|
page read and write
|
|
|
|
7FF597928000
|
unkown
|
page readonly
|
|
|
|
1B9E0869000
|
unkown
|
page read and write
|
|
|
|
38377F000
|
unkown
|
page read and write
|
|
|
|
7FF51AA05000
|
unkown
|
page readonly
|
|
|
|
37A447A000
|
unkown
|
page read and write
|
|
|
|
7FF5978A0000
|
unkown
|
page readonly
|
|
|
|
7FF5A8797000
|
unkown
|
page readonly
|
|
|
|
38347B000
|
unkown
|
page read and write
|
|
|
|
7FF5A8856000
|
unkown
|
page readonly
|
|
|
|
7FF597AC7000
|
unkown
|
page readonly
|
|
|
|
17A33800000
|
unkown
|
page read and write
|
|
|
|
7FF5977A7000
|
unkown
|
page readonly
|
|
|
|
1B9E086F000
|
unkown
|
page read and write
|
|
|
|
7FF5A8887000
|
unkown
|
page readonly
|
|
|
|
1193466C000
|
unkown
|
page read and write
|
|
|
|
59B787B000
|
unkown
|
page read and write
|
|
|
|
1B9E0913000
|
unkown
|
page read and write
|
|
|
|
7FF51A5BA000
|
unkown
|
page readonly
|
|
|
|
7FF597A48000
|
unkown
|
page readonly
|
|
|
|
17A3387B000
|
unkown
|
page read and write
|
|
|
|
11934800000
|
unkown
|
page readonly
|
|
|
|
37A41DE000
|
unkown
|
page read and write
|
|
|
|
7FF597A42000
|
unkown
|
page readonly
|
|
There are 218 hidden memdumps, click here to show them.