FormBook IOC's

**** FORMBOOK IOC's DIC 09-2020 ****

6c7167c113f946a8d900b4b56b7e6a235ca8bfa8e312444d61750416df054a91  1672-6.exe
86b4f4f13aa8ae39a472d735ed1404754f731b4b74d78c3dd9642dfcdcf214cb  1672-7.exe
4dcba91a4a1109a7f49f9b03b5d6be7e34c31f0d6fe71c0d97ac4c0fb377891c  dmhlBMoFwNoumZJaRerJkoKuCRIreMpT.exe
2110b17a27de9020419993b6dd1d740e57597948b74d5e4e5860c9c62222d162  shed2222222222.vbs
5c95ed3402fed1621c92141d15bff8e906da7720e73f3857bf0c1a7e80f82936  PO NO. CWI191502 - JANUARY 2021.xlam

https://cdn.discordapp.com/attachments/785282636637405216/785282716375187466/shed2222222222.vbs

**** C2: ****
www.629gretnagreen.com
http://www.629gretnagreen.com/drc/?Jvjt8dL=3Hp+3KQJLCXvJeua6fsnrKrq2guiWYbv3b0BFYVIu9wO9zPupbJgyzfBofpScJApB1Jqig==&4h=ZvaP-nDHjLPp

www.wochay.com
http://www.wochay.com/drc/?Jvjt8dL=Kq9F5pEYH2TTrC1eIvoSH7If92oboAx5inur0VUuMy50P+JGOSk3HV9zKobJ0tAnV/ScnQ==&4h=ZvaP-nDHjLPp

www.seagardenceramics.com
http://www.seagardenceramics.com/drc/?Jvjt8dL=ZLeY1XLZnVxXo1HXUu8plrAGfOaANMNVh9x2ZfFMTXFXBZ0Wm5aKdNe9vz9ViY00cR/vGA==&4h=ZvaP-nDHjLPp

www.gitti-geldi.xyz
http://www.gitti-geldi.xyz/drc/?Jvjt8dL=xv+WM08/TW2HSXzpokufbg3L/n+Uk2B5WONQ/XKTxwiCgxI68WzCo1pmd32buvs1o7HVIQ==&4h=ZvaP-nDHjLPp

www.madeinthecarolinas.net
http://www.madeinthecarolinas.net/drc/?Jvjt8dL=qIT/mPyeHFfEYivC4nfb0z0g5s4g4yDIIOyaITxb6Hs6q9AKjQgI9ntdWErQpQFcY54l4g==&4h=ZvaP-nDHjLPp

**** COMMANDS ****
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
C:\Windows\System32\WScript.exe" "C:\Users\Public\svchost.vbs
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
C:\Windows\system32\conhost.exe "1854669727-1752923000-1886653689-2000026242-5670327441625869845-11543388462022675592"
C:\WINDOWS\syswow64\notepad.exe "{path}"
C:\Windows\SysWOW64\help.exe