IOCReport

loading gif

Files

File Path
Type
Category
Malicious
case (1057).xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Author: , Last Saved By: , Name of Creating Application: Microsoft Excel, Last Printed: Tue Jan 26 16:17:13 2021, Create Time/Date: Thu Apr 23 13:26:24 2020, Last Saved Time/Date: Tue Jan 26 16:28:15 2021, Security: 0
initial sample
 malicious
C:\ProgramData\formnet.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\scfrd[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
downloaded
 malicious
C:\Users\user\AppData\Local\Temp\0CEE0000
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Jan 27 04:37:45 2021, atime=Wed Jan 27 04:37:45 2021, length=12288, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\case (1057).LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Jan 27 04:37:45 2021, atime=Wed Jan 27 04:37:46 2021, length=99328, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
modified
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\6E2XX33J.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\A8FFZF1B.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\HPDR9FYI.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\TXFJIAR6.txt
ASCII text
downloaded
 clean
C:\Users\user\AppData\Roaming\Yzub\doa.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 clean
C:\Users\user\Desktop\0DEE0000
Applesoft BASIC program data, first line number 16
dropped
 clean
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\rundll32.exe
'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
 malicious
C:\Windows\SysWOW64\rundll32.exe
'C:\Windows\System32\rundll32.exe' C:\ProgramData\formnet.dll,DllRegisterServer
 malicious
C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
 clean

URLs

Name
IP
Malicious
https://rnollg.com/kev/scfrd.dll
unknown
 malicious
http://wmwifbajxxbcxmucxmlc.com/files/april24.dll)
unknown
 clean
http://www.windows.com/pctv.
unknown
 clean
http://investor.msn.com
unknown
 clean
http://www.msnbc.com/news/ticker.txt
unknown
 clean
http://crl.entrust.net/server1.crl0
unknown
 clean
http://ocsp.entrust.net03
unknown
 clean
https://govemedico.tk/post.php.u
unknown
 clean
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
 clean
https://gadgetswolf.com/
unknown
 clean
http://www.diginotar.nl/cps/pkioverheid0
unknown
 clean
https://gadgetswolf.com/post.php
unknown
 clean
https://govemedico.tk/
unknown
 clean
https://homesoapmolds.com/post.php
unknown
 clean
http://windowsmedia.com/redir/services.asp?WMPFriendly=true
unknown
 clean
http://www.hotmail.com/oe
unknown
 clean
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
unknown
 clean
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
 clean
http://www.icra.org/vocabulary/.
unknown
 clean
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
unknown
 clean
https://govemedico.tk/post.phpc
unknown
 clean
https://report-uri.clou
unknown
 clean
http://investor.msn.com/
unknown
 clean
https://homesoapmolds.com/?p
unknown
 clean
https://govemedico.tk/_u
unknown
 clean
http://ocsp.digicer
unknown
 clean
http://www.%s.comPA
unknown
 clean
http://crl4.digice
unknown
 clean
http://wmwifbajxxbcxmucxmlc.com/files/april24.dll~
unknown
 clean
http://ocsp.entrust.net0D
unknown
 clean
https://rnollg.com/kev/scfrd.dll$8
unknown
 clean
https://secure.comodo.com/CPS0
unknown
 clean
https://homesoapmolds.com/
unknown
 clean
http://crl.entrust.net/2048ca.crl0
unknown
 clean
Https://homesoapmolds.com/post.php
unknown
 clean
https://govemedico.tk/post.php
unknown
 clean
There are 26 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
homesoapmolds.com
172.67.198.109
 clean
rnollg.com
172.67.150.228
 clean
gadgetswolf.com
104.21.44.135
 clean
govemedico.tk
104.21.73.69
 clean

IPs

IP
Domain
Country
Active
Malicious
172.67.150.228
unknown
United States
unknown
 clean
104.21.44.135
unknown
United States
unknown
 clean
104.21.73.69
unknown
United States
unknown
 clean
172.67.198.109
unknown
United States
unknown
 clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1)7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE0AE
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EE86C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EECB0
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EED6B
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
d:7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\system32\qagentrt.dll,-10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-843
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\fveui.dll,-844
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
@%SystemRoot%\System32\wuaueng.dll,-400
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F39F4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F3A52
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 21
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Blob
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F39F4
 clean
C:\Windows\SysWOW64\msiexec.exe
ilyo
 clean
C:\Windows\SysWOW64\msiexec.exe
keokirq
 clean
C:\Windows\SysWOW64\msiexec.exe
keokirq
 clean
C:\Windows\SysWOW64\msiexec.exe
keokirq
 clean
C:\Windows\SysWOW64\msiexec.exe
SavedLegacySettings
 clean
There are 112 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
100000
unkown
page read and write
 clean
440000
unkown image
page readonly
 clean
441000
unkown image
page execute read
 clean
4D0000
heap private
page read and write
 clean
1BB0000
unkown
page readonly
 clean
2CBE000
unkown
page read and write
 clean
1EB0000
unkown
page readonly
 clean
574000
heap default
page read and write
 clean
2BD1000
unkown
page read and write
 clean
260000
unkown
page read and write
 clean
280000
unkown
page readonly
 clean
59D000
heap default
page read and write
 clean
4E0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
440000
unkown image
page readonly
 clean
D0000
unkown
page execute and read and write
 clean
2A4000
heap private
page read and write
 clean
ED9000
heap private
page read and write
 clean
106000
unkown
page read and write
 clean
606000
unkown
page read and write
 clean
2E6000
heap private
page read and write
 clean
29D000
stack
page read and write
 clean
7EFDF000
unkown
page read and write
 clean
2400000
unkown
page readonly
 clean
F6F000
unkown
page read and write
 clean
160000
unkown
page readonly
 clean
7D0000
unkown
page readonly
 clean
567000
heap default
page read and write
 clean
2530000
heap private
page read and write
 clean
D0000
unkown
page read and write
 clean
58A000
heap default
page read and write
 clean
606000
unkown
page read and write
 clean
5FE000
unkown
page read and write
 clean
370000
heap default
page read and write
 clean
5B8000
heap default
page read and write
 clean
602000
unkown
page read and write
 clean
9C000
unkown
page read and write
 clean
291E000
unkown
page read and write
 clean
340000
unkown
page readonly
 clean
524000
unkown image
page read and write
 clean
2C1E000
unkown
page read and write
 clean
230000
heap private
page read and write
 clean
54B000
unkown
page read and write
 clean
5EA000
heap default
page read and write
 clean
29E000
unkown
page read and write
 clean
1C0000
unkown
page execute and read and write
 clean
E9F000
unkown
page read and write
 clean
DED000
unkown
page read and write
 clean
330000
heap private
page read and write
 clean
466000
unkown image
page execute read
 clean
2A0000
unkown
page execute and read and write
 clean
2097000
unkown
page readonly
 clean
440000
unkown image
page readonly
 clean
58F000
heap default
page read and write
 clean
23D0000
heap private
page read and write
 clean
5FE000
unkown
page read and write
 clean
3ED000
unkown
page read and write
 clean
3C0000
heap default
page read and write
 clean
51F000
unkown image
page read and write
 clean
4E0000
unkown
page read and write
 clean
ED0000
heap private
page read and write
 clean
414000
unkown
page read and write
 clean
20A0000
heap private
page read and write
 clean
510000
unkown image
page readonly
 clean
470000
unkown
page readonly
 clean
2A0000
heap private
page read and write
 clean
3FF000
unkown
page read and write
 clean
2BDE000
unkown
page read and write
 clean
2DD0000
unkown
page read and write
 clean
910000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
440000
unkown image
page readonly
 clean
1AC000
unkown
page read and write
 clean
2DC0000
heap private
page read and write
 clean
2AF0000
unkown
page read and write
 clean
970000
unkown
page readonly
 clean
536000
unkown image
page readonly
 clean
2C2000
heap private
page read and write
 clean
2AE1000
unkown
page read and write
 clean
110000
unkown
page readonly
 clean
90000
unkown
page readonly
 clean
440000
unkown image
page readonly
 clean
24C000
unkown
page read and write
 clean
274D000
unkown
page read and write
 clean
557000
heap default
page read and write
 clean
606000
heap default
page read and write
 clean
550000
heap default
page read and write
 clean
2980000
heap private
page read and write
 clean
230000
heap private
page read and write
 clean
EF7000
heap private
page read and write
 clean
5F0000
unkown
page readonly
 clean
584000
heap default
page read and write
 clean
597000
heap default
page read and write
 clean
1B0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
645000
unkown
page read and write
 clean
460000
unkown image
page readonly
 clean
350000
heap default
page read and write
 clean
462000
unkown image
page read and write
 clean
64C000
unkown
page read and write
 clean
3AE000
heap default
page read and write
 clean
1D97000
unkown
page readonly
 clean
790000
unkown
page readonly
 clean
5A8000
heap default
page read and write
 clean
2E0000
heap private
page read and write
 clean
2840000
heap private
page read and write
 clean
120000
heap private
page read and write
 clean
2A50000
unkown
page readonly
 clean
3D0000
unkown
page read and write
 clean
40F000
unkown
page read and write
 clean
250000
unkown
page read and write
 clean
1D0000
unkown
page read and write
 clean
2A4E000
unkown
page read and write
 clean
2A00000
unkown
page read and write
 clean
5AB000
heap default
page read and write
 clean
377000
heap default
page read and write
 clean
2F0000
heap private
page read and write
 clean
180000
unkown
page write copy
 clean
7EFDF000
unkown
page read and write
 clean
650000
unkown
page readonly
 clean
606000
unkown
page read and write
 clean
534000
unkown image
page read and write
 clean
465000
unkown image
page readonly
 clean
645000
unkown
page read and write
 clean
1D0000
unkown
page execute and read and write
 clean
520000
unkown image
page execute and read and write
 clean
2F30000
heap private
page read and write
 clean
FBE000
unkown
page read and write
 clean
560000
heap default
page read and write
 clean
60000
unkown
page readonly
 clean
614000
heap private
page read and write
 clean
4F0000
unkown
page readonly
 clean
1CB000
unkown
page read and write
 clean
610000
heap private
page read and write
 clean
1000000
unkown
page readonly
 clean
There are 125 hidden memdumps, click here to show them.