Overview

overview

7

Static

static

1

ZoomWorkspace.exe

windows10-2004-x64

5

ZoomWorkspace.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/11/2025, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ZoomWorkspace.exe
  • Size 23.3MB
  • Sample251107-pptd2avmhy
  • SHA256 33e59926cd50c0627c217a1173debd27742fd4b93ae8b9db513a33ecf87bc8b8
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 61 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 18 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 47 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 27 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.exe
    "C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattended.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattended.exe" -regsvc "-installerFileName" "ZoomWorkspace.exe"
      2⤵
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6104
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 6104 -InstallationId Qorzpbx0Da -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" -ApplicationType 4 -Environment "Production" -ForceInstall 0
        3⤵
        • Checks system information in the registry
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2600
    • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveTools64.exe" -InstallVDD
      2⤵
      • Drops file in System32 directory
      • Checks system information in the registry
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=4be2e4eb90e3ddd6d46030c196f10bbd --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=platform=win --annotation=version=1.27.1.1320 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodulehandler.json" --initial-client-data=0x334,0x338,0x33c,0x32c,0x340,0x7ff6ca1cf8a8,0x7ff6ca1cf8c0,0x7ff6ca1cf8d8
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4972
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:5080
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:5796
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5572
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{79a15557-f36b-d642-8ea7-78c461226849}\g2rvdd.inf" "9" "41d402e2b" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3724
  • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" -ApplicationType "4"
    1⤵
    • Drops file in System32 directory
    • Checks system information in the registry
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5936
    • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=5529630244420707091 --annotation=component=Unattended --annotation=computerid=4be2e4eb90e3ddd6d46030c196f10bbd --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=platform=win --annotation=version=1.28.0.3438 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodulehandler.json" --initial-client-data=0x874,0x878,0x87c,0x7d8,0x880,0x7065ed10,0x7065ed20,0x7065ed30
      2⤵
      • Executes dropped EXE
      PID:5236
    • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattended.exe
      "C:/Program Files (x86)/GoTo Resolve Unattended/5529630244420707091/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "5936" "-InstallationId" "Qorzpbx0Da" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_5529630244420707091" "-Service" "-LogLevel" "2" "-CrashHandlerPipe" "\\.\pipe\crashpad_5936_NAQDBOARLUBZYKXU"
      2⤵
      • Checks BIOS information in registry
      • Drops file in System32 directory
      • Checks system information in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5128
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveLoggerProcess.exe
        GoToResolveLoggerProcess.exe -ParentProcessId 5128 -CompanyId 5529630244420707091 -InstallationId Qorzpbx0Da -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_5936_NAQDBOARLUBZYKXU -HostId 4be2e4eb90e3ddd6d46030c196f10bbd -LogLevel 2 -SessionType Unattended
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:6012
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveExternalModuleHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveExternalModuleHandler.exe" -InstallationId Qorzpbx0Da -CompanyId 5529630244420707091 -publickey e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf -LogLevel 2 -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_5936_NAQDBOARLUBZYKXU
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6056
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 2516
          4⤵
          • Program crash
          PID:5312
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveNetworkChecker.exe
        GoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId Qorzpbx0Da -CompanyId 5529630244420707091 -Environment Production -CrashHandlerPipe \\.\pipe\crashpad_5936_NAQDBOARLUBZYKXU
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:4668
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveTools64.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveTools64.exe" -InstallVDD
        3⤵
        • Drops file in System32 directory
        • Checks system information in the registry
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=version=1.24.0.142 --initial-client-data=0x35c,0x360,0x364,0x334,0x368,0x7ff7d048baf8,0x7ff7d048bb10,0x7ff7d048bb28
          4⤵
          • Executes dropped EXE
          PID:3132
    • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattendedUi.exe
      "C:/Program Files (x86)/GoTo Resolve Unattended/5529630244420707091/GoToResolveUnattendedUi.exe" "-CompanyId" "5529630244420707091" "-InstallationId" "Qorzpbx0Da" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" "-Environment" "Production" "-ApplicationType" "4" "-CrashHandlerPipe" "\\.\pipe\crashpad_5936_NAQDBOARLUBZYKXU" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:6000
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=5529630244420707091 --annotation=component=Unattended --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=platform=win --annotation=version=1.28.0.3438 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\externalmodulehandler.json" --initial-client-data=0x76c,0x770,0x774,0x744,0x778,0x7065ed10,0x7065ed20,0x7065ed30
        3⤵
        • Executes dropped EXE
        PID:3936
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe
    1⤵
    • Launches sc.exe
    PID:5432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 6056 -ip 6056
    1⤵
      PID:3816
    • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" -ApplicationType "4"
      1⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x7b4,0x7b8,0x7bc,0x78c,0x7c0,0x715a6fac,0x715a6fbc,0x715a6fcc
        2⤵
        • Executes dropped EXE
        PID:3820
      • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattended.exe
        "C:/Program Files (x86)/GoTo Resolve Unattended/5529630244420707091/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "3380" "-InstallationId" "Qorzpbx0Da" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_5529630244420707091" "-Service" "-LogLevel" "2"
        2⤵
        • Checks BIOS information in registry
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5908
        • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveLoggerProcess.exe
          GoToResolveLoggerProcess.exe -ParentProcessId 5908 -CompanyId 5529630244420707091 -InstallationId Qorzpbx0Da -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" -Environment Production -ApplicationType 4 -HostId 4be2e4eb90e3ddd6d46030c196f10bbd -LogLevel 2 -SessionType Unattended -ThingName syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:5568
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x72c,0x730,0x734,0x6fc,0x738,0x715a6fac,0x715a6fbc,0x715a6fcc
            4⤵
            • Executes dropped EXE
            PID:6140
        • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x7a8,0x7ac,0x7b0,0x710,0x7b4,0x715a6fac,0x715a6fbc,0x715a6fcc
          3⤵
          • Executes dropped EXE
          PID:1344
        • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveExternalModuleHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveExternalModuleHandler.exe" -InstallationId Qorzpbx0Da -CompanyId 5529630244420707091 -publickey e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf -LogLevel 2 -Environment Production
          3⤵
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:1684
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x77c,0x780,0x784,0x754,0x788,0x715a6fac,0x715a6fbc,0x715a6fcc
            4⤵
            • Executes dropped EXE
            PID:4012
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AntivirusModule\1.2025.1017.02\GoTo.Resolve.Antivirus.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AntivirusModule\1.2025.1017.02\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3684
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\BcdrModule\1.2025.1013.2-bcdr\GoTo.Resolve.Bcdr.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\BcdrModule\1.2025.1013.2-bcdr\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4032
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AlertsModule\1.2025.1003.4\GoTo.Resolve.Alerts.Monitor.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AlertsModule\1.2025.1003.4\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4904
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\EdrModule\1.2025.0410.02\GoTo.Resolve.Edr.Client.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\EdrModule\1.2025.0410.02\GoTo.Resolve.Edr.Client.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\EdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:6016
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\IataModule\0.108.3\GoTo.Resolve.Iata.App.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\IataModule\0.108.3\GoTo.Resolve.Iata.App.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\IataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Executes dropped EXE
            PID:440
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\PatchManagementModule\1.2025.1105.2\GoTo.Resolve.PatchManagement.Client.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\PatchManagementModule\1.2025.1105.2\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
            4⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4456
            • C:\Windows\SYSTEM32\where.exe
              "where" -r "C:\Program Files\WindowsApps" Winget.exe
              5⤵
                PID:4020
              • C:\Windows\SYSTEM32\where.exe
                "where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe
                5⤵
                  PID:3148
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$PSVersionTable.PSVersion.ToString()"
                  5⤵
                  • Drops file in System32 directory
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:968
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "Import-Module appx Add-AppxProvisionedPackage -Online -PackagePath C:\Windows\SystemTemp\tmplnfrww.tmp.msixbundle -SkipLicense"
                  5⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2072
                  • C:\Windows\TEMP\21E673CE-0FD1-44EC-AE5C-FE5045FFE0A4\dismhost.exe
                    C:\Windows\TEMP\21E673CE-0FD1-44EC-AE5C-FE5045FFE0A4\dismhost.exe {36DF8071-B041-47D5-A4D8-F592DA587633}
                    6⤵
                    • Drops file in Windows directory
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5160
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\DeviceDataModule\1.236.0\GoTo.Resolve.DeviceData.App.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\DeviceDataModule\1.236.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 5529630244420707091 --Credentials:HostId syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\token.txt" --ZeroTrust:ReferencePublicKeyHash e602710c8deed7ad44b93a381523425b54a831c3068568b54501ad2da46a10cf --Native:Version 1.27.1.3232
                4⤵
                • Drops file in System32 directory
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:724
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveFileManager.exe
              GoToResolveFileManager.exe -CompanyId 5529630244420707091 -Environment Production -InstallationId Qorzpbx0Da -LogLevel 2
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:5320
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x778,0x840,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Executes dropped EXE
                PID:5092
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveQuickView.exe
              GoToResolveQuickView.exe -InstallationId Qorzpbx0Da -LogLevel 2 -Environment Production
              3⤵
              • Checks BIOS information in registry
              • Checks system information in the registry
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              PID:4388
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x72c,0x730,0x734,0x704,0x738,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Executes dropped EXE
                PID:3056
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveTerminal.exe
              GoToResolveTerminal.exe -CompanyId 5529630244420707091 -Environment Production -InstallationId Qorzpbx0Da -LogLevel 2
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:1080
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x828,0x82c,0x830,0x774,0x834,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Drops file in Program Files directory
                • Executes dropped EXE
                PID:5204
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveServiceManager.exe
              GoToResolveServiceManager.exe -CompanyId 5529630244420707091 -Environment Production -InstallationId Qorzpbx0Da -LogLevel 2
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:5084
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x830,0x834,0x838,0x784,0x83c,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Executes dropped EXE
                PID:5608
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveRemoteControl.exe
              GoToResolveRemoteControl.exe -CompanyId 5529630244420707091 -InstallationId Qorzpbx0Da -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 1 -ThingName syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b
              3⤵
              • Checks system information in the registry
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:2820
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x77c,0x780,0x784,0x6a4,0x788,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Executes dropped EXE
                PID:4016
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveRegistryEditor.exe
              GoToResolveRegistryEditor.exe -CompanyId 5529630244420707091 -Environment Production -InstallationId Qorzpbx0Da -LogLevel 2
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:944
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x830,0x834,0x838,0x778,0x83c,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Executes dropped EXE
                PID:1108
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveNetworkChecker.exe
              GoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId Qorzpbx0Da -CompanyId 5529630244420707091 -Environment Production
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:996
              • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x72c,0x730,0x734,0x704,0x738,0x715a6fac,0x715a6fbc,0x715a6fcc
                4⤵
                • Executes dropped EXE
                PID:708
          • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattendedUi.exe
            "C:/Program Files (x86)/GoTo Resolve Unattended/5529630244420707091/GoToResolveUnattendedUi.exe" "-CompanyId" "5529630244420707091" "-InstallationId" "Qorzpbx0Da" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com" "-ThingName" "syn-prd-ava-unattended-2400bad3-aba3-4432-b137-d029d2f8643b"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2468
            • C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
              "C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Llnskqsm --annotation=installationid=Qorzpbx0Da --annotation=version=1.27.1.3232 --initial-client-data=0x770,0x774,0x778,0x754,0x77c,0x715a6fac,0x715a6fbc,0x715a6fcc
              3⤵
              • Executes dropped EXE
              PID:480
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:4408
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
            1⤵
              PID:864

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  g2rvdd.cat
                  • Path C:\PROGRA~2\GOTORE~1\552963~1\x64\g2rvdd.cat
                  • Size 10KB
                  • SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  g2rvdd.dll
                  • Path C:\PROGRA~2\GOTORE~1\552963~1\x64\g2rvdd.dll
                  • Size 141KB
                  • SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  FileManager.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\FileManager.dll
                  • Size 16.2MB
                  • SHA256 66ff60c469120003e6b97b3558a95b2249f64ad80cfa6126cb966ed2c802dd12
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveCrashHandler.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveCrashHandler.exe
                  • Size 652KB
                  • SHA256 93929f414ccde82cc842fe6836b3b224d015d5fc920a023bff544a408062522e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveLoggerProcess.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveLoggerProcess.exe
                  • Size 410KB
                  • SHA256 5de37de17c8cee1fcafe6a40625c4243305a681c0a0c841e78c7b13b3f60523d
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveProcessChecker.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveProcessChecker.exe
                  • Size 409KB
                  • SHA256 f2a1e74101dc8f6c4dd6cc8be36d744c624ab107401cd96c4a68a56a989fd4c5
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveTools64.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveTools64.exe
                  • Size 1.3MB
                  • SHA256 993294a4a17aeb0c4932de84456a18efbd2e2c1c1070cb4f2a8b8bca95b4bf78
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveUnattended.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\GoToResolveUnattended.exe
                  • Size 409KB
                  • SHA256 23926c7180ddd504f681885c1e49e0b691b06fd0e2e0898f6f09a6949bc8c526
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  LibGoToResolve.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\LibGoToResolve.dll
                  • Size 19.8MB
                  • SHA256 9bd3ca8973cdf29bfa9360c0ec3934d4e078b10dbeb50f214d5f73a95b2bb448
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  MediaClientLib.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\MediaClientLib.dll
                  • Size 14.0MB
                  • SHA256 8ef91a0a10883a7046f0e24ad46dbea6d84fa05cec0afe92f280a194bd657d85
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  PasswordPrivacyDll.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\PasswordPrivacyDll.dll
                  • Size 1.1MB
                  • SHA256 b058ea60be10abb4a38877a3ca9b9afa04265ac2e9248b5be930d9a3babcf4da
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveProcessChecker.log
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\GoToResolveProcessChecker.log
                  • Size 7KB
                  • SHA256 f0f0e16cf85238f5a937224a0100b520ca4aead20c7436a83042f0180b19d7cf
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveUnattended.log
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\appdata\GoToResolveUnattended.log
                  • Size 2KB
                  • SHA256 50e41a5409a2a42de0652c65db968c49b792605a0d05e14a5d327d136a7871c9
                  • MD5 SHA1 SHA512
                  Submit Download

                  GoToResolveUnattendedUpdater.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\downloads\k34D7718Fg\GoToResolveUnattendedUpdater.exe
                  • Size 23.3MB
                  • SHA256 344771c49b4ccd4b45eb078e96245b11280785add044c75932d43f8e50568f59
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  2025-11-07.log
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AlertsModule\1.2025.1003.4\logs\2025-11-07.log
                  • Size 1KB
                  • SHA256 fa2cbe306fc83f41eea808f81b70299562eb9076170c2ea0c6b9633c88697978
                  • MD5 SHA1 SHA512
                  Submit Download

                  2025-11-07.log
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AlertsModule\1.2025.1003.4\logs\2025-11-07.log
                  • Size 4KB
                  • SHA256 996b3479640eb7e677575397eeda6e614f6bb7ca5911180d51cc6d680c22606a
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveUnattendedUpdater.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AlertsModule\downloads\1.2025.1003.4\GoToResolveUnattendedUpdater.exe
                  • Size 34.7MB
                  • SHA256 824c54a3438c2c0c2f72945a7dec22c70260fcadc644f2068211256da6c310b3
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoTo.Resolve.Antivirus.App.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\AntivirusModule\1.2025.1017.02\GoTo.Resolve.Antivirus.App.exe
                  • Size 150KB
                  • SHA256 2c91931473678df7ba861bb977e2247f12b137b44046dffdce740e855c869506
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoTo.Resolve.Edr.Client.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\EdrModule\1.2025.0410.02\GoTo.Resolve.Edr.Client.exe
                  • Size 146KB
                  • SHA256 d3c0465c91b588ea6f8f78463c58c69323fc831782eb1fdf9ffb7649d5da2329
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveUnattendedUpdater.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\EdrModule\downloads\1.2025.0410.02\GoToResolveUnattendedUpdater.exe
                  • Size 34.1MB
                  • SHA256 d627952e7bd7e888cbc4392b10762b012eebaf3519e916cfb1879be51c36bff3
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  2025-11-07.log
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\PatchManagementModule\1.2025.1105.2\logs\2025-11-07.log
                  • Size 1KB
                  • SHA256 79054fd3b43137671cbafd404f6314c9285dc5f7e81c111aba74fa9e4a9dfe6d
                  • MD5 SHA1 SHA512
                  Submit Download

                  2025-11-07.log
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\PatchManagementModule\1.2025.1105.2\logs\2025-11-07.log
                  • Size 3KB
                  • SHA256 dcc2945f2379b25f501eabbf63435e270adea4ce64ed314c2622a8a37d57af49
                  • MD5 SHA1 SHA512
                  Submit Download

                  RemoteExecution.Runner.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe
                  • Size 157KB
                  • SHA256 658562be436234a6c39b6f3d022aa62b6c94c83c323e52bf96541a012f403d07
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  mscordaccore_amd64_amd64_8.0.1925.36514.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\RemoteExecutionModule\1.2025.0827.1\mscordaccore_amd64_amd64_8.0.1925.36514.dll
                  • Size 1.3MB
                  • SHA256 c05d685863850917187b7282aa9739b23d5b967cac411c1fbe122b13a24ce5fa
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  GoToResolveUnattendedUpdater.exe
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\externalmodules\RemoteExecutionModule\downloads\1.2025.0827.1\GoToResolveUnattendedUpdater.exe
                  • Size 36.2MB
                  • SHA256 b5b2b00437a939a5eb9730e64ca968ef1982e898e7c55c7f647307434023864e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libcrypto-3-x64.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\libcrypto-3-x64.dll
                  • Size 5.8MB
                  • SHA256 acc95858e79c29f7180c0613a65fc3b6bdf3bc640fdda7b1a270d27269ac2352
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\libcrypto-3.dll
                  • Size 4.2MB
                  • SHA256 e56092c9d3c96a4471902fce281eb1c87a2b54df8e1d095658f22fd0fcec122b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  libssl-3.dll
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\libssl-3.dll
                  • Size 1.1MB
                  • SHA256 138b0fd663e51213a54f73ae2cb370737f85ca32c1ac1a37ad9a41770c7ec164
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  logger.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\logger.json
                  • Size 321B
                  • SHA256 ec00a3a80124f1e53f884724c631d0addcc96fa106b8bb795a8df82532188a07
                  • MD5 SHA1 SHA512
                  Submit Download

                  logger.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\logger.json
                  • Size 401B
                  • SHA256 218d84d5bfcc55f8a6ca7758b4923eb85b39720af0f34d510fc1900053bb9c12
                  • MD5 SHA1 SHA512
                  Submit Download

                  mandatory.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\mandatory.json
                  • Size 1KB
                  • SHA256 f83b9fa0663dc52dcb613fc795b7364c1385257292c155b4b428a31186b2627c
                  • MD5 SHA1 SHA512
                  Submit Download

                  unattended.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json
                  • Size 746B
                  • SHA256 28a2bc995cb72388008c692afb05513cad2c87a6f8f2f8ed81bc2dd03f466bd6
                  • MD5 SHA1 SHA512
                  Submit Download

                  unattended.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json
                  • Size 853B
                  • SHA256 3ae7128c230fe613aae2642096aab1cf7043d30e9fdf842b8220ba9b45c2b9f7
                  • MD5 SHA1 SHA512
                  Submit Download

                  unattended.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json
                  • Size 1KB
                  • SHA256 788f22c4009e37ed6c5ce349aa5eb9c02fd08ca3e71673b0306e43ec4a1aeda2
                  • MD5 SHA1 SHA512
                  Submit Download

                  unattended.json
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\unattended.json
                  • Size 1KB
                  • SHA256 5af4d8402e4dfe9266d5b78b6d76e539628b75b37711975f70afeab5b515f8b7
                  • MD5 SHA1 SHA512
                  Submit Download

                  g2rvdd.inf
                  • Path C:\Program Files (x86)\GoTo Resolve Unattended\5529630244420707091\x64\g2rvdd.inf
                  • Size 3KB
                  • SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
                  • MD5 SHA1 SHA512
                  Submit Download

                  0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                  • Size 727B
                  • SHA256 a908ab7d5c892bf7e5a11f358eaa9fedc288505b873622257519b5f45516fa5a
                  • MD5 SHA1 SHA512
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
                  • Size 727B
                  • SHA256 f0368aa493a36bf4e096b04d219044c28f29ede181e5c381a379814ee12a6b13
                  • MD5 SHA1 SHA512
                  Submit Download

                  0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                  • Size 400B
                  • SHA256 c7fa5739f6862d2d2732efbb7413839b1d13f75db673b7d8c8a3c65955ff1b0d
                  • MD5 SHA1 SHA512
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
                  • Size 408B
                  • SHA256 125c9f6f7400c238531c076ea8670bed061c0615683379c5ea7b434b79ed68d8
                  • MD5 SHA1 SHA512
                  Submit Download

                  UnattendedUpdater.csv
                  • Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
                  • Size 7KB
                  • SHA256 b1293cdca117fdb0e4d19a033838a99c4ee8a2709a53eb2eb3606c4df796e22c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  UnattendedUpdater.log
                  • Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log
                  • Size 4KB
                  • SHA256 61e89e0e9619f3b738117c802a76eb3d56115a849d32dc86c0d108bf7599193b
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  ZoomWorkspace.exe.cmd
                  • Path C:\Users\Admin\AppData\Local\Temp\ZoomWorkspace.exe.cmd
                  • Size 537B
                  • SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
                  • MD5 SHA1 SHA512
                  Submit Download

                  dism.log
                  • Path C:\Windows\Logs\DISM\dism.log
                  • Size 288KB
                  • SHA256 0e81e271a38614508885bbd61f6181061ec3d52d9759c26bd069e47e4d7aa898
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                  • Size 400B
                  • SHA256 0750132b642c6db00e9938b2fa1816b814f6d22e46f9423118360bf736da52e6
                  • MD5 SHA1 SHA512
                  Submit Download

                  8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
                  • Size 408B
                  • SHA256 4fc149c77abe6d7fcb0d79bc68a4e67f9c7e3ec82f19136925781557297e0cf0
                  • MD5 SHA1 SHA512
                  Submit Download

                  1l5ra5e4.hq1
                  • Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\062aa9785629e259bab90d087ac05aee7265273e1c28b488425a167d6d092892\1l5ra5e4.hq1
                  • Size 1B
                  • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
                  • MD5 SHA1 SHA512
                  Submit Download

                  __PSScriptPolicyTest_pptediaw.syl.ps1
                  • Path C:\Windows\Temp\__PSScriptPolicyTest_pptediaw.syl.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/968-3869-0x00000215F8900000-0x00000215F8922000-memory.dmp
                  Download

                  memory/2072-3891-0x000002CC373A0000-0x000002CC373AA000-memory.dmp
                  Download

                  memory/2072-3882-0x000002CC37160000-0x000002CC3717C000-memory.dmp
                  Download

                  memory/2072-3889-0x000002CC373C0000-0x000002CC373DC000-memory.dmp
                  Download

                  memory/2072-3890-0x000002CC373E0000-0x000002CC37493000-memory.dmp
                  Download

                  memory/2072-3892-0x000002CC375F0000-0x000002CC37616000-memory.dmp
                  Download

                  memory/3936-2847-0x0000000000B80000-0x0000000000C23000-memory.dmp
                  Download

                  memory/4668-1364-0x0000000000190000-0x00000000001F6000-memory.dmp
                  Download

                  memory/4972-1447-0x0000000000B80000-0x0000000000C23000-memory.dmp
                  Download

                  memory/5128-794-0x00000000006A0000-0x0000000000706000-memory.dmp
                  Download

                  memory/5128-2846-0x00000000006A0000-0x0000000000706000-memory.dmp
                  Download

                  memory/5236-793-0x0000000000B80000-0x0000000000C23000-memory.dmp
                  Download

                  memory/5936-2853-0x0000000070850000-0x0000000070C8D000-memory.dmp
                  Download

                  memory/5936-2852-0x0000000070CC0000-0x0000000071D12000-memory.dmp
                  Download

                  memory/5936-2855-0x000000006F330000-0x0000000070730000-memory.dmp
                  Download

                  memory/5936-2854-0x0000000070730000-0x000000007084D000-memory.dmp
                  Download

                  memory/5936-2851-0x0000000071D20000-0x0000000072CCD000-memory.dmp
                  Download

                  memory/5936-2849-0x0000000000DE0000-0x0000000000E46000-memory.dmp
                  Download

                  memory/5936-2850-0x0000000072CD0000-0x0000000072DF1000-memory.dmp
                  Download

                  memory/6000-860-0x00000000006B0000-0x0000000000716000-memory.dmp
                  Download

                  memory/6012-2303-0x00000000008B0000-0x0000000000916000-memory.dmp
                  Download

                  memory/6012-2844-0x00000000008B0000-0x0000000000916000-memory.dmp
                  Download

                  memory/6056-2304-0x00000000008C0000-0x0000000000926000-memory.dmp
                  Download

                  memory/6056-2839-0x00000000008C0000-0x0000000000926000-memory.dmp
                  Download