Overview

overview

10

Static

static

1

1876_invoice.exe

windows7-x64

1

1876_invoice.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2024, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1876_invoice.exe
  • Size 25.8MB
  • Sample240516-ve5bfaec2w
  • SHA256 39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
egregordiscoverypersistenceransomware

Malware Config

Signatures

  • Detected Egregor ransomware 1 IoCs
  • Egregor Ransomware

    Variant of the Sekhmet ransomware first seen in September 2020.

    ransomwareegregor
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1876_invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\1876_invoice.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe" -regsvc
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2492
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 2492 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572" -ApplicationType 4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:2304
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe" -InstallVDD
      2⤵
      • Executes dropped EXE
      • Checks system information in the registry
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      PID:3972
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\1876_invoice.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\1876_invoice.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:396
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:2864
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{998799f7-755c-ba44-a7bc-5b38916bab5e}\g2rvdd.inf" "9" "415529917" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2772
  • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572" -ApplicationType "4"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
      "C:/Program Files (x86)/GoTo Resolve Unattended/1937918270322737572/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "828" "-WtsStartingUsername" "-ServiceName" "GoToResolve_1937918270322737572" "-Service"
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Checks system information in the registry
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveLoggerProcess.exe
        GoToResolveLoggerProcess.exe -ParentProcessId 4332 -CompanyId 1937918270322737572 -InstallationId PXBDpeXZ6e -MonitoringUrl https://dumpster.console.gotoresolve.com -HostId 5a05b107b1bb256115310f76666e1593 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 -SessionType Unattended
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:/Program Files (x86)/GoTo Resolve Unattended/1937918270322737572\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Fzbxdxua --annotation=installationid=PXBDpeXZ6e --annotation=version=1.15.2.3338 --initial-client-data=0x4d0,0x4d4,0x4d8,0x4a4,0x4dc,0x749ae09c,0x749ae0ac,0x749ae0bc
          4⤵
          • Executes dropped EXE
          PID:1716
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Fzbxdxua --annotation=installationid=PXBDpeXZ6e --annotation=version=1.15.2.3338 --initial-client-data=0x580,0x584,0x588,0x540,0x58c,0x749ae09c,0x749ae0ac,0x749ae0bc
        3⤵
        • Executes dropped EXE
        PID:3804
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveFileManager.exe
        GoToResolveFileManager.exe -CompanyId 1937918270322737572 -InstallationId PXBDpeXZ6e -LogLevel 2 -MonitoringUrl https://dumpster.console.gotoresolve.com
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:880
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Fzbxdxua --annotation=installationid=PXBDpeXZ6e --annotation=version=1.15.2.3338 --initial-client-data=0x5dc,0x5e0,0x5e4,0x5b0,0x5e8,0x749ae09c,0x749ae0ac,0x749ae0bc
          4⤵
          • Executes dropped EXE
          PID:4864
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveQuickView.exe
        GoToResolveQuickView.exe -InstallationId PXBDpeXZ6e -LogLevel 2
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1324
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTerminal.exe
        GoToResolveTerminal.exe -CompanyId 1937918270322737572 -InstallationId PXBDpeXZ6e -LogLevel 2 -MonitoringUrl https://dumpster.console.gotoresolve.com
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Fzbxdxua --annotation=installationid=PXBDpeXZ6e --annotation=version=1.15.2.3338 --initial-client-data=0x5cc,0x5f4,0x5f8,0x5d0,0x5fc,0x749ae09c,0x749ae0ac,0x749ae0bc
          4⤵
          • Executes dropped EXE
          PID:3376
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3532
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4036
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        PID:8
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:2076
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\1.2024.0507.5\GoTo.Resolve.PatchManagement.Client.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\1.2024.0507.5\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\SYSTEM32\where.exe
          "where" -r "C:\Program Files\WindowsApps" Winget.exe
          4⤵
            PID:4244
          • C:\Windows\SYSTEM32\where.exe
            "where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe
            4⤵
              PID:1628
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:4536
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-617f9466-c52e-4aed-a515-b0accb7901b8 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
            3⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            PID:4860
      • C:\Windows\System32\Conhost.exe
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        1⤵
          PID:2304

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              g2rvdd.cat
              • Path C:\PROGRA~2\GOTORE~1\193791~1\x64\g2rvdd.cat
              • Size 10KB
              • SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              g2rvdd.dll
              • Path C:\PROGRA~2\GOTORE~1\193791~1\x64\g2rvdd.dll
              • Size 141KB
              • SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FileManager.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\FileManager.dll
              • Size 16.1MB
              • SHA256 94df392a600acb29ff711f164073c1c80bbcf270dcc5a4cd8cba8e762b1ae40f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveCrashHandler.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
              • Size 1.1MB
              • SHA256 2b4556e9c709e1da52cab89aa754fab86c7bb5265e63850dc133dc4ca387fc70
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveFileManager.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveFileManager.exe
              • Size 109KB
              • SHA256 b2fc90c66d76aa33da449039e6ea5f66b43880b3ef86e7ae263e1e113f7c3296
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveLoggerProcess.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveLoggerProcess.exe
              • Size 109KB
              • SHA256 dc21f66e9dd2ca56504c3dcc02862117f2da94f212b289d3b09349bc59f57a25
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveProcessChecker.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
              • Size 107KB
              • SHA256 34e6f7d1fd0aa8b20cb8cac184b8ecd90c157ccc62e38568699efa10c411c7ea
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveQuickView.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveQuickView.exe
              • Size 109KB
              • SHA256 72d654e3f4f292ed8c8bb56ef29f1400fa38a943b4e9eff09fa5fe11e0145d32
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveTools64.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe
              • Size 1.3MB
              • SHA256 f36b1c32a5fa8969422d99042287685634bb8d85c9643100032e9df5744dd39e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveUnattended.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
              • Size 109KB
              • SHA256 1b6fc8321728fccd3a9a0f88f51ab115f0c6d227d644b948d9d0b58d1123c923
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveUnlock64.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnlock64.dll
              • Size 149KB
              • SHA256 9cb3d6be955b20f06efdeaa0f1732415a22642fe3cea7e9dc6c581bdeb2ce746
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LibGoToResolve.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\LibGoToResolve.dll
              • Size 19.7MB
              • SHA256 1f13a2911d6cad19314f330bab9a57d81c8323575fdc7182e1c2eb6f844ba89b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MediaClientLib.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\MediaClientLib.dll
              • Size 13.9MB
              • SHA256 c132232018896ba3f84ff37a1ece4a7a58eef08afecf495fc31176b276b000bb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PasswordPrivacyDll.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\PasswordPrivacyDll.dll
              • Size 1.1MB
              • SHA256 95743c6c9d2f626fa66c3b95e2b3c003313089f653681c82c1e9c214ddd2778d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveProcessChecker.log
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveProcessChecker.log
              • Size 4KB
              • SHA256 bad2dd6d2dbf5c59126322276d14322ec7ace6bc08b6912d15f11f6aa33827a6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoToResolveUnattended.log
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveUnattended.log
              • Size 12KB
              • SHA256 d6b8a8017ceea5e0692d093c24af05a49807d7f025d36f985078e1d5ff2b9217
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              2024-05-16.log
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\logs\2024-05-16.log
              • Size 4KB
              • SHA256 ee24e08b4b51491b721ade66b3534d4628bbd9f2111ac0f34281f73c322777ec
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              2024-05-16.log
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\logs\2024-05-16.log
              • Size 1KB
              • SHA256 7855a55da406ef08a8d9ed837d56684f7fab02c7a70ff4a397a49568a838d039
              • MD5 SHA1 SHA512
              Submit Download

              GoTo.Resolve.Antivirus.App.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
              • Size 161KB
              • SHA256 7680070e0ba04e4219943cf513cdb004cd20aa5fcccf9644b8caa1cdf9a3f4fc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              GoTo.Resolve.DeviceData.App.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe
              • Size 11.5MB
              • SHA256 0bc404e30bdad9be1d7ed633adc054800f2e7e757e6414795136c0a896b0bb87
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RemoteExecution.Runner.exe
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe
              • Size 164KB
              • SHA256 8f70badc067ff6e828d6afccaead174a7623a8ef89c1c81a614f5fa8648f1019
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libcrypto-3.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\libcrypto-3.dll
              • Size 4.2MB
              • SHA256 e852018ec59efbe2dc2e32c064f35ee68171417d8c5bc5ba319609555dde2bc6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              libssl-3.dll
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\libssl-3.dll
              • Size 1.1MB
              • SHA256 11598140036154dcd8ccd5619ac059aea4012cf9a4535ffa7c9b2f0ae405906d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              logger.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\logger.json.tmp
              • Size 375B
              • SHA256 41eaff480d5b5eec02935aa8fe64b0c2d5e5db1f50160820674a5e8bd0a5e7eb
              • MD5 SHA1 SHA512
              Submit Download

              mandatory.json
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\mandatory.json
              • Size 74B
              • SHA256 afc6a427fd31151d995e93e66edd9138df27dc88580b03b12d8a8012c481f3bd
              • MD5 SHA1 SHA512
              Submit Download

              mandatory.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\mandatory.json.tmp
              • Size 1KB
              • SHA256 e36156e802f146367f9a2122cc38bd501ba295a3d15c6569f6ecd8b0f282b1e3
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json
              • Size 582B
              • SHA256 f967768b99cebe2225ef1c41d9ee31c21f9014f87f29cf30c487b448aa074dfa
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
              • Size 703B
              • SHA256 19eb67cc4ed0b294ba19f7ff2ab3c3f616cb05f27b9d6b87071fa52b9754b8ef
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
              • Size 1KB
              • SHA256 79644077374b4547d90500ec1dec00f57ee2e8f273203a03f82737962baf90c9
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
              • Size 1KB
              • SHA256 92d9f7ad5082545fbc5ded99647fe795d24dba77643162a56b92b11071a7cc20
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
              • Size 1007B
              • SHA256 465e5190e2e2efc5ecc5d34cdd78cb1c029554b4aa3ded0d0db8e6870836584f
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
              • Size 1KB
              • SHA256 e5f571d3aa967c7e989255360c8295151ca1582d0b5e18fdc646242992f4e9e1
              • MD5 SHA1 SHA512
              Submit Download

              unattended.json.tmp
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
              • Size 1KB
              • SHA256 ec149de85f8ac18eb973e956a45a8df95b3e3ccb4475bdf86f8fd742279beb4d
              • MD5 SHA1 SHA512
              Submit Download

              g2rvdd.inf
              • Path C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\x64\g2rvdd.inf
              • Size 3KB
              • SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
              • MD5 SHA1 SHA512
              Submit Download

              UnattendedUpdater.csv
              • Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
              • Size 3KB
              • SHA256 3df933982ffefb132a0bd637c2828818389a2000d255ea5b94a35de928b1a40e
              • MD5 SHA1 SHA512
              Submit Download

              1876_invoice.exe.cmd
              • Path C:\Users\Admin\AppData\Local\Temp\1876_invoice.exe.cmd
              • Size 537B
              • SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
              • MD5 SHA1 SHA512
              Submit Download

              0h4wvxvg.eq5
              • Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\49a79555446a342df02477815a2e44309b6db288b6f82a7fb9c8c03c3af6f5d9\0h4wvxvg.eq5
              • Size 1B
              • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
              • MD5 SHA1 SHA512
              Submit Download