IOC Report
Export Shipment Documents 72335.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_fe8167436d6db6c6d2c4bed5d6f2d2c06e142845_f78a65ed_688ef81c-3112-4aa5-919d-bbcba7e35c47\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE45D.tmp.dmp

Mini DuMP crash report, 17 streams, Mon Oct 28 13:13:34 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA4A.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA8A.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\Windows[2].json

JSON data

dropped

C:\Users\user\AppData\Local\Temp\parters

data

dropped

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Windows\SysWOW64\svchost.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4084 -s 7096

http://www.yzwj-she.xyzReferer:

unknown

http://www.ixiaopu.top

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13glsK-dark

unknown

https://powerpoint.office.comer

unknown

https://android.notify.windows.com/iOSA4

unknown

http://www.rilseguloseheating.shop

unknown

http://www.uiejosdarksumdauts.shop/ms84/

unknown

http://www.mployee-jkmmz.xyz/ms84/

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV

unknown

http://www.erform-tgap.xyzReferer:

unknown

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew

Classes