IOCReport

loading gif

Files

File Path
Type
Category
Malicious
case (166).xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: , Last Saved By: , Name of Creating Application: Microsoft Excel, Last Printed: Tue Jan 26 16:17:13 2021, Create Time/Date: Thu Apr 23 13:26:24 2020, Last Saved Time/Date: Tue Jan 26 16:28:15 2021, Security: 0
initial sample
 malicious
C:\ProgramData\formnet.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
downloaded
 malicious
C:\Users\user\AppData\Local\Temp\B0EE0000
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jan 27 04:24:43 2021, atime=Wed Jan 27 04:24:43 2021, length=12288, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\case (166).LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Jan 27 04:24:43 2021, atime=Wed Jan 27 04:24:43 2021, length=99328, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
modified
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\9GI0R7W2.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\VVPZM9EY.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\X2GDAG4X.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\ZEL5A6R0.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Ywmiu\egwih.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 clean
C:\Users\user\Desktop\A1EE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
 malicious
C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
 clean

URLs

Name
IP
Malicious
https://rnollg.com/kev/scfrd.dll
unknown
 malicious
http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://crl.entrust.net/server1.crl0
unknown
 clean
http://crl3.digicert
unknown
 clean
http://ocsp.entrust.net03
unknown
 clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
 clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
 clean
https://homesoapmolds.com/post.phpv
unknown
 clean
https://gadgetswolf.com/post.php
unknown
 clean
https://govemedico.tk/
unknown
 clean
https://homesoapmolds.com/post.php
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
https://gadgetswolf.com/post.phpx
unknown
 clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
https://gadgetswolf.com/A
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
https://gadgetswolf.com/post.phpr
unknown
 clean
https://gadgetswolf.com/y
unknown
 clean
https://homesoapmolds.com/=
unknown
 clean
http://investor.msn.com/
unknown
 clean
https://govemedico.tk/O
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
unknown
 clean
http://ocsp.entrust.net0D
unknown
 clean
https://rnollg.com/kev/scfrd.dll$8
unknown
 clean
https://secure.comodo.com/CPS0
unknown
 clean
https://homesoapmolds.com/
unknown
 clean
http://crl.entrust.net/2048ca.crl0
unknown
 clean
https://govemedico.tk/post.php
unknown
 clean
Https://homesoapmolds.com/post.phpZ
unknown
 clean
There are 26 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
homesoapmolds.com
172.67.198.109
 clean
rnollg.com
172.67.150.228
 clean
gadgetswolf.com
104.21.44.135
 clean
govemedico.tk
172.67.158.184
 clean

IPs

IP
Domain
Country
Active
Malicious
172.67.158.184
unknown
United States
unknown
 clean
172.67.150.228
unknown
United States
unknown
 clean
104.21.44.135
unknown
United States
unknown
 clean
172.67.198.109
unknown
United States
unknown
 clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
k(3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ED7AA
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EDE3E
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE15A
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE1F6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
r63
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F2F3B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F2F89
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F2F3B
 clean
C:\Windows\SysWOW64\msiexec.exe
ilyo
 clean
C:\Windows\SysWOW64\msiexec.exe
ewuwkope
 clean
C:\Windows\SysWOW64\msiexec.exe
ewuwkope
 clean
C:\Windows\SysWOW64\msiexec.exe
ewuwkope
 clean
C:\Windows\SysWOW64\msiexec.exe
SavedLegacySettings
 clean
There are 112 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1EBF000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
1E9D000
unkown
page read and write
 clean
3E4000
heap default
page read and write
 clean
2490000
heap private
page read and write
 clean
A20000
heap private
page read and write
 clean
376000
heap private
page read and write
 clean
2120000
unkown
page readonly
 clean
2990000
unkown
page read and write
 clean
468000
heap default
page read and write
 clean
874000
heap private
page read and write
 clean
248E000
unkown
page read and write
 clean
24D0000
unkown
page readonly
 clean
1E0000
unkown
page execute and read and write
 clean
370000
heap private
page read and write
 clean
180000
heap default
page read and write
 clean
4C0000
unkown
page read and write
 clean
2B6E000
unkown
page read and write
 clean
4BF000
heap default
page read and write
 clean
2307000
unkown
page readonly
 clean
3030000
heap private
page read and write
 clean
20000
heap private
page read and write
 clean
45D000
heap default
page read and write
 clean
1F90000
unkown
page readonly
 clean
150000
unkown
page readonly
 clean
866000
unkown image
page execute read
 clean
1D0000
unkown
page execute and read and write
 clean
2DAC000
unkown
page read and write
 clean
1BC000
unkown
page read and write
 clean
3FF000
heap default
page read and write
 clean
2A71000
unkown
page read and write
 clean
24000
heap private
page read and write
 clean
3C7000
heap default
page read and write
 clean
BC000
unkown
page read and write
 clean
280000
unkown
page read and write
 clean
3C0000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
290000
heap private
page read and write
 clean
1BC000
unkown
page read and write
 clean
41D000
heap default
page read and write
 clean
870000
heap private
page read and write
 clean
90000
unkown
page execute and read and write
 clean
924000
unkown image
page read and write
 clean
840000
unkown image
page readonly
 clean
1C0000
unkown
page execute and read and write
 clean
841000
unkown image
page execute read
 clean
A3E000
unkown
page read and write
 clean
46B000
heap default
page read and write
 clean
840000
unkown image
page readonly
 clean
160000
unkown
page read and write
 clean
2AD0000
heap private
page read and write
 clean
910000
unkown image
page readonly
 clean
500000
unkown
page readonly
 clean
2CDE000
unkown
page read and write
 clean
2820000
unkown
page read and write
 clean
680000
unkown
page readonly
 clean
187000
heap default
page read and write
 clean
23EF000
unkown
page read and write
 clean
990000
heap private
page read and write
 clean
20000
unkown
page readonly
 clean
2B0000
heap default
page read and write
 clean
E0000
unkown
page readonly
 clean
4C0000
unkown
page read and write
 clean
170000
unkown
page readonly
 clean
2950000
heap private
page read and write
 clean
160000
unkown
page readonly
 clean
120000
unkown
page read and write
 clean
1E80000
unkown
page read and write
 clean
2499000
heap private
page read and write
 clean
418000
heap default
page read and write
 clean
1C0000
unkown
page readonly
 clean
444000
heap default
page read and write
 clean
45D000
heap default
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
D0000
unkown
page write copy
 clean
47D000
unkown
page read and write
 clean
1C87000
unkown
page readonly
 clean
865000
unkown image
page readonly
 clean
294E000
unkown
page read and write
 clean
26E000
unkown
page read and write
 clean
29FA000
unkown
page read and write
 clean
DD000
stack
page read and write
 clean
85E000
unkown
page read and write
 clean
840000
unkown image
page readonly
 clean
24B7000
heap private
page read and write
 clean
936000
unkown image
page readonly
 clean
170000
unkown
page read and write
 clean
380000
unkown
page readonly
 clean
1BE000
heap default
page read and write
 clean
862000
unkown image
page read and write
 clean
47D000
heap default
page read and write
 clean
840000
unkown image
page readonly
 clean
2901000
unkown
page read and write
 clean
4D0000
unkown
page readonly
 clean
2BA0000
heap private
page read and write
 clean
934000
unkown image
page read and write
 clean
2080000
heap private
page read and write
 clean
91F000
unkown image
page read and write
 clean
170000
heap private
page read and write
 clean
2B6000
unkown
page read and write
 clean
840000
unkown image
page readonly
 clean
1F80000
unkown
page readonly
 clean
2D4D000
unkown
page read and write
 clean
360000
unkown
page readonly
 clean
A80000
unkown
page readonly
 clean
A30000
heap private
page read and write
 clean
90000
unkown
page read and write
 clean
1AA0000
unkown
page readonly
 clean
4BD000
unkown
page read and write
 clean
427000
heap default
page read and write
 clean
11B000
unkown
page read and write
 clean
C00000
heap private
page read and write
 clean
500000
unkown
page readonly
 clean
457000
heap default
page read and write
 clean
90E000
unkown
page read and write
 clean
860000
unkown image
page readonly
 clean
A70000
heap private
page read and write
 clean
BB0000
heap private
page read and write
 clean
2820000
unkown
page readonly
 clean
9EE000
unkown
page read and write
 clean
420000
heap default
page read and write
 clean
E0000
unkown
page readonly
 clean
3FA000
heap default
page read and write
 clean
520000
unkown
page readonly
 clean
1EC4000
unkown
page read and write
 clean
3040000
unkown
page read and write
 clean
47D000
unkown
page read and write
 clean
892000
heap private
page read and write
 clean
280000
heap default
page read and write
 clean
4BA000
unkown
page read and write
 clean
1EAF000
unkown
page read and write
 clean
6A0000
unkown
page readonly
 clean
420000
heap default
page read and write
 clean
2A7D000
unkown
page read and write
 clean
920000
unkown image
page execute and read and write
 clean
There are 125 hidden memdumps, click here to show them.