IOC Report
VFylJFPzqX.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_fe8167436d6db6c6d2c4bed5d6f2d2c06e142845_f78a65ed_9dc28938-91ad-4d68-8a9f-87867cc31365\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4EB8.tmp.dmp

Mini DuMP crash report, 17 streams, Wed Oct 2 16:59:23 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A23.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A53.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\Windows[2].json

JSON data

dropped

C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\user\AppData\Local\Temp\AddInProcess32.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4084 -s 3228

https://powerpoint.office.comer

unknown

http://www.mckinleyint.com/igbn/www.livewey.net

unknown

http://www.123-tecnicos.com/igbn/www.s5agents.com

unknown

http://www.bangunrumahkreasi.comReferer:

unknown

http://www.prolongdogslife.comReferer:

unknown

https://android.notify.windows.com/iOSA4

unknown

http://www.s5agents.com/igbn/www.getrightspt.com

unknown

http://www.webinarcerdaskanindonesia.com/igbn/

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV

unknown