IOC Report
file.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ECFB.exe_c28f7e147f7233fac35d68c9fdcbff1142cbb9f3_c36f58af_10581eb1\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5036.tmp.dmp

Mini DuMP crash report, 14 streams, Wed Feb 8 03:45:20 2023, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5392.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER545E.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\LocalLow\10PkIt2V82WR

SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2

dropped

C:\Users\user\AppData\LocalLow\2KyP65ecp6T3

SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 4, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\LocalLow\432zCWSnwm1N

SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 4, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 4

dropped

C:\Users\user\AppData\LocalLow\cdE656z8QTF7

SQLite 3.x database, last written using SQLite version 3038005, file counter 17, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 17

dropped

C:\Users\user\AppData\LocalLow\msvcp140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\LocalLow\vcruntime140.dll

PE32 executable (DLL) (console) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A33B.exe.log

CSV text

dropped

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

JSON data

dropped

C:\Users\user\AppData\Local\Temp\db.dat

data

dropped

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\user\AppData\Local\09cc62dd-ff65-4927-b82d-d455eaaeb9f0" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 520

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1