IOC Report
NEW ORDER_.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_fe8167436d6db6c6d2c4bed5d6f2d2c06e142845_f78a65ed_d88794a9-3ae8-4ccf-9e81-c2d383b4609a\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1593.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15C3.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD8.tmp.dmp

Mini DuMP crash report, 17 streams, Fri Nov 22 15:16:45 2024, 0x1205a4 type

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001b.db

data

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\Windows[1].json

JSON data

dropped

C:\Users\user\AppData\Local\Temp\aut7281.tmp

data

dropped

C:\Users\user\AppData\Local\Temp\syphilous

data

modified

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Windows\SysWOW64\svchost.exe"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4056 -s 3536

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA12QGBm-dark

unknown

https://api.msn.com:443/v1/news/Feed/Windows?t

unknown

https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV

unknown

http://www.066iwx2t.shop/ge07/www.g18q11a.top

unknown

https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world

unknown

https://api.msn.com:443/v1/news/Feed/Windows?

unknown

https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter

unknown

http://www.reyhazeusa.shop

unknown

http://www.ivglass.xyzReferer:

unknown

https://excel.office.com

unknown