Analysis
- max time kernel
299s - max time network
305s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
urpremiuminvite_2026.vbs
Resource
win10v2004-20260130-en
windows10-2004-x64
29 signatures
300 seconds
Behavioral task
behavioral2
Sample
urpremiuminvite_2026.vbs
Resource
win11-20260130-en
windows11-21h2-x64
29 signatures
300 seconds
General
- Target urpremiuminvite_2026.vbs
- Size 3KB
- Sample260503-vbqzmshs4n
- SHA256 00644e0c825460375f520c1d3247f7cf7aa67c0235a7a09bca4c10ee7e2f842f
- MD5 958b15aa8ef14262a92eee511ade7502
- SHA1 a6b241046077ff917a545d16753db3c7ee727887
- SHA512 3779e87793e20a7a909795f22629c89195ed99feaa127b05608b7f971f48d4d3ba177cbd760bfb881bf7b916939a7a0c411cb8b8125c2ee62bf413a3367d4ea7
- TLSH T1FA710F779B05E1ACB070C66E59AB5F0DD8413653BC4804A8B8B9FC515BDD62D4E808FE
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://urpremiuminvite.s3.us-east-2.amazonaws.com/LogMeInResolve_Unattended.msi
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveUnattended.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation WScript.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 26 IoCs
pid Process 5640 unattended-updater.exe 4564 GoToResolveUnattended.exe 2536 GoToResolveTools64.exe 3120 GoToResolveCrashHandler.exe 1444 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 2060 GoToResolveCrashHandler.exe 4444 GoToResolveUnattended.exe 4788 GoToResolveLoggerProcess.exe 2296 GoToResolveExternalModuleHandler.exe 3088 GoToResolveNetworkChecker.exe 5488 GoToResolveUnattendedUi.exe 5736 GoToResolveCrashHandler.exe 2764 GoTo.Resolve.Edr.Client.exe 6036 GoTo.Resolve.Iata.App.exe 3968 GoTo.Resolve.DeviceData.App.exe 4192 GoTo.Resolve.Bcdr.App.exe 4500 GoTo.Resolve.Alerts.Monitor.App.exe 2952 GoTo.Resolve.PatchManagement.Client.exe 1820 RemoteExecution.Runner.exe 5800 GoTo.Resolve.Antivirus.App.exe 2284 GoTo.Resolve.Bcdr.App.exe 1612 GoTo.Resolve.Antivirus.OesisWorker.exe 2280 dismhost.exe 3936 GoTo.Resolve.Bcdr.App.exe 5508 GoTo.Resolve.Bcdr.App.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x0007000000024522-48.dat rat_gotoresolve - Loads dropped DLL 64 IoCs
pid Process 5040 MsiExec.exe 5040 MsiExec.exe 2536 GoToResolveTools64.exe 4564 GoToResolveUnattended.exe 4564 GoToResolveUnattended.exe 4564 GoToResolveUnattended.exe 4564 GoToResolveUnattended.exe 4564 GoToResolveUnattended.exe 4564 GoToResolveUnattended.exe 1444 GoToResolveProcessChecker.exe 1444 GoToResolveProcessChecker.exe 1444 GoToResolveProcessChecker.exe 1444 GoToResolveProcessChecker.exe 1444 GoToResolveProcessChecker.exe 1444 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4788 GoToResolveLoggerProcess.exe 4788 GoToResolveLoggerProcess.exe 4788 GoToResolveLoggerProcess.exe 3088 GoToResolveNetworkChecker.exe 4788 GoToResolveLoggerProcess.exe 4788 GoToResolveLoggerProcess.exe 2296 GoToResolveExternalModuleHandler.exe 3088 GoToResolveNetworkChecker.exe 2296 GoToResolveExternalModuleHandler.exe 4788 GoToResolveLoggerProcess.exe 3088 GoToResolveNetworkChecker.exe 2296 GoToResolveExternalModuleHandler.exe 3088 GoToResolveNetworkChecker.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 3088 GoToResolveNetworkChecker.exe 3088 GoToResolveNetworkChecker.exe 2296 GoToResolveExternalModuleHandler.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe 2764 GoTo.Resolve.Edr.Client.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 10 4580 msiexec.exe 12 4580 msiexec.exe 21 4580 msiexec.exe 22 4580 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe - Drops file in System32 directory 52 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveExternalModuleHandler.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\w2bnznj0.ang GoTo.Resolve.Bcdr.App.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\81359c4d285ec56ddbfdec4ee441fa5ec8ef212367be7b5f267e66960f515606\zb1avm0l.qgp GoTo.Resolve.PatchManagement.Client.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\8653cd360c544dbca7d73b4cb0ab3f98c1fd018d27d83fb73b63f4d5a47ee622\nzuwlxyh.ces RemoteExecution.Runner.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\2zmshm2m.rhe GoTo.Resolve.Bcdr.App.exe File created C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\SET821D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156} DrvInst.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveExternalModuleHandler.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\5dad4k5k.pa3 GoTo.Resolve.Bcdr.App.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\SET821D.tmp DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\g4o5idcm.cxq GoTo.Resolve.Alerts.Monitor.App.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\5oolx5kr.mzf GoTo.Resolve.Alerts.Monitor.App.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\81359c4d285ec56ddbfdec4ee441fa5ec8ef212367be7b5f267e66960f515606\ilxihamm.rus GoTo.Resolve.PatchManagement.Client.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\SET821E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\8653cd360c544dbca7d73b4cb0ab3f98c1fd018d27d83fb73b63f4d5a47ee622\wxti2wsl.tbz RemoteExecution.Runner.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\zwjtu1sc.uue GoTo.Resolve.Alerts.Monitor.App.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\z1c1uk15.si2 GoTo.Resolve.Bcdr.App.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\4996C8E53066611F1D52CB8CB46DCBE1ADE8F817 GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File created C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\SET821E.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\SET821C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{547ae5de-8e49-134e-9ff3-b47ef2a3b156}\SET821C.tmp DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\e201347bdd3d27acaec6f1248cd1acb1424077d3a77f0684480a3934efdecac1\3wom1fwh.tfu GoTo.Resolve.Antivirus.App.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Formats.Tar.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.Identity.Client.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Net.Http.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Xml.ReaderWriter.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Runtime.Loader.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.ServiceProcess.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\Microsoft.VisualBasic.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Diagnostics.PerformanceCounter.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Private.Xml.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.IO.Compression.FileSystem.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Reflection.DispatchProxy.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Security.Cryptography.Csp.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.runtimeconfig.json GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Net.Sockets.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Reflection.DispatchProxy.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Reflection.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Text.Encoding.CodePages.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\IPC GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Security.Cryptography.Encoding.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Diagnostics.Tools.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libcrypto-3-x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Data.DataSetExtensions.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.IO.FileSystem.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Windows.Extensions.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.AppContext.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\Microsoft.Extensions.Configuration.FileExtensions.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Net.Http.Formatting.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\Microsoft.Extensions.Diagnostics.Abstractions.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\Microsoft.Extensions.FileSystemGlobbing.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.AI.PerfCounterCollector.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Diagnostics.StackTrace.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Threading.Tasks.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.IO.FileSystem.Primitives.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnlock64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Runtime.Serialization.Formatters.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Threading.Timer.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Diagnostics.StackTrace.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Net.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Resources.ResourceManager.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\GoToResolveUnattendedUi.log GoToResolveUnattendedUi.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.CodeDom.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Runtime.Serialization.Json.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Net.NameResolution.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.Extensions.Logging.Debug.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Linq.Parallel.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Security.Cryptography.Encoding.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Linq.Parallel.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Xml.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Threading.Timer.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Threading.Thread.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Runtime.Numerics.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Net.Ping.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Private.Uri.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.Extensions.Http.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\mscordaccore_amd64_amd64_8.0.2626.16921.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\GoToResolveLoggerProcess.log GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Threading.Tasks.Parallel.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Security.Cryptography.Algorithms.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Threading.Overlapped.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Xml.XmlSerializer.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Threading.Tasks.Extensions.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Configuration.dll GoToResolveExternalModuleHandler.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e584707.msi msiexec.exe File created C:\Windows\Installer\{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e584707.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI721E.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC} msiexec.exe File opened for modification C:\Windows\Installer\MSI73E4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7491.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Logs\DISM\dism.log powershell.exe File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e58470b.msi msiexec.exe File opened for modification C:\Windows\Installer\{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5848 sc.exe 824 sc.exe -
pid Process 1264 powershell.exe 4952 powershell.exe 2640 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unattended-updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe - Delays execution with timeout.exe 7 IoCs
pid Process 4668 timeout.exe 5920 timeout.exe 3264 timeout.exe 2356 timeout.exe 3360 timeout.exe 4056 timeout.exe 2320 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoTo.Resolve.DeviceData.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoTo.Resolve.DeviceData.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections GoTo.Resolve.Bcdr.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveUnattended.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\LogMeIn\Bookmark = "<BookmarkList>\r\n <Bookmark Channel='Application' RecordId='825' IsCurrent='true'/>\r\n <Bookmark Channel='Security' RecordId='29129'/>\r\n</BookmarkList>" GoTo.Resolve.DeviceData.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections GoTo.Resolve.Alerts.Monitor.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GoToResolveProcessChecker.exe - Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9F8EABFCD4E8ED64483E9D5504B989CA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\PackageName = "installer331.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9F8EABFCD4E8ED64483E9D5504B989CA\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Version = "18874368" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductIcon = "C:\\Windows\\Installer\\{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductIcon = "C:\\Program Files (x86)\\GoTo Resolve Unattended\\3534568598794572930\\GoToResolveUnattended.exe" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\PackageCode = "66CD4AB4BF2C9DF4794E499624EAEE89" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductName = "LogMeIn Resolve Unattended" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\9F8EABFCD4E8ED64483E9D5504B989CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductName = "LogMeIn Resolve Unattended 3534568598794572930" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\954B583007A425FBA480AEDD556B09C8FA3AA0E9 GoToResolveUnattended.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\954B583007A425FBA480AEDD556B09C8FA3AA0E9\Blob = 030000000100000014000000954b583007a425fba480aedd556b09c8fa3aa0e90b000000010000007000000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f00330035003300340035003600380035003900380037003900340035003700320039003300300000000200000001000000ec0000001c0000008c000000010000000000000000000000000000000100000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f00330035003300340035003600380035003900380037003900340035003700320039003300300000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e0030000000000020000000010000005d0300003082035930820241a00302010202145c2c1ecf3d75ae626acc9de0387140a6d93a6d8f300d06092a864886f70d01010b0500304d314b3049060355040b0c42416d617a6f6e20576562205365727669636573204f3d416d617a6f6e2e636f6d20496e632e204c3d53656174746c652053543d57617368696e67746f6e20433d5553301e170d3236303530333136343735335a170d3439313233313233353935395a301e311c301a06035504030c1341575320496f5420436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100b18de66c4f609abdf52a69504dfdb80f33ada9f9420dd6c9e16685025e641e232fdfe626186f39a8168e5fb343a61248bdd2cd296064f5141c44b641a60164c82f9e7813c5392a8726a93cf52bcc8e64368bc266e31465216400e425e484214cd4d837a4b5c221836b794b2927cc16a4fdc52e7ab46b80cef5173938d4347dc57fd7667c102d4323f95743535e74ed1cfc5ebe366eea3203a77cd32f5c1da791e8a5c4a59ad1cccea5ce0e99262e965c37e7c1abc7eab537f3b9d3155731d1d44e0254366642123b2826c3fdef207c4824ec6eb88f0b5db7665cd9941bbb36db54efc3498e96dafc8a1d00c9dc159f3a4a5fddbd74656a8ab39005fff61c6cbf0203010001a360305e301f0603551d2304183016801472923408ef4fd1877e1eb2ba46f59d415ec5c5f5301d0603551d0e041604144996c8e53066611f1d52cb8cb46dcbe1ade8f817300c0603551d130101ff04023000300e0603551d0f0101ff040403020780300d06092a864886f70d01010b050003820101006ef54329747677f29681150dae6758ec09345cd390ea99f9a949c7ad41d83debac996ac54ab5b1939b3352dfec0c4d0c9d20f071faa4ad53d87a8ac5d9c388b1ac7bce76d02c77bf19a22333574c80a8685efbb30a8a6be41b24a28cc0e40bf4a070b5c3ecaad40642a291f3d60d92d4422dd28935063ce7508576e06d82ffcb121d0f177608818724b3c3ae44d753449015d413af9fa6aaa83660866518fc483d166a62c95cc082faf91c43bc69da0420f4bf632a7f565e41475a81fd2370ff12951d11852c0751a671e9d22782650102829cda05bfa8562583b4e0bb3e8b30941e2079384daacf49d030139c966fa3e13d0a3360487e07cd72a87f6151c6cd GoToResolveUnattended.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\954B583007A425FBA480AEDD556B09C8FA3AA0E9\Blob = 1400000001000000140000004996c8e53066611f1d52cb8cb46dcbe1ade8f8170200000001000000ec0000001c0000008c000000010000000000000000000000000000000100000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f00330035003300340035003600380035003900380037003900340035003700320039003300300000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000007000000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f0033003500330034003500360038003500390038003700390034003500370032003900330030000000030000000100000014000000954b583007a425fba480aedd556b09c8fa3aa0e920000000010000005d0300003082035930820241a00302010202145c2c1ecf3d75ae626acc9de0387140a6d93a6d8f300d06092a864886f70d01010b0500304d314b3049060355040b0c42416d617a6f6e20576562205365727669636573204f3d416d617a6f6e2e636f6d20496e632e204c3d53656174746c652053543d57617368696e67746f6e20433d5553301e170d3236303530333136343735335a170d3439313233313233353935395a301e311c301a06035504030c1341575320496f5420436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100b18de66c4f609abdf52a69504dfdb80f33ada9f9420dd6c9e16685025e641e232fdfe626186f39a8168e5fb343a61248bdd2cd296064f5141c44b641a60164c82f9e7813c5392a8726a93cf52bcc8e64368bc266e31465216400e425e484214cd4d837a4b5c221836b794b2927cc16a4fdc52e7ab46b80cef5173938d4347dc57fd7667c102d4323f95743535e74ed1cfc5ebe366eea3203a77cd32f5c1da791e8a5c4a59ad1cccea5ce0e99262e965c37e7c1abc7eab537f3b9d3155731d1d44e0254366642123b2826c3fdef207c4824ec6eb88f0b5db7665cd9941bbb36db54efc3498e96dafc8a1d00c9dc159f3a4a5fddbd74656a8ab39005fff61c6cbf0203010001a360305e301f0603551d2304183016801472923408ef4fd1877e1eb2ba46f59d415ec5c5f5301d0603551d0e041604144996c8e53066611f1d52cb8cb46dcbe1ade8f817300c0603551d130101ff04023000300e0603551d0f0101ff040403020780300d06092a864886f70d01010b050003820101006ef54329747677f29681150dae6758ec09345cd390ea99f9a949c7ad41d83debac996ac54ab5b1939b3352dfec0c4d0c9d20f071faa4ad53d87a8ac5d9c388b1ac7bce76d02c77bf19a22333574c80a8685efbb30a8a6be41b24a28cc0e40bf4a070b5c3ecaad40642a291f3d60d92d4422dd28935063ce7508576e06d82ffcb121d0f177608818724b3c3ae44d753449015d413af9fa6aaa83660866518fc483d166a62c95cc082faf91c43bc69da0420f4bf632a7f565e41475a81fd2370ff12951d11852c0751a671e9d22782650102829cda05bfa8562583b4e0bb3e8b30941e2079384daacf49d030139c966fa3e13d0a3360487e07cd72a87f6151c6cd GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F GoTo.Resolve.DeviceData.App.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 040000000100000010000000173574af7b611cebf4f93ce2ee40f9a20f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba GoTo.Resolve.DeviceData.App.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa4040000000100000010000000173574af7b611cebf4f93ce2ee40f9a22000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba GoTo.Resolve.DeviceData.App.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5488 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1264 powershell.exe 1264 powershell.exe 4580 msiexec.exe 4580 msiexec.exe 5640 unattended-updater.exe 5640 unattended-updater.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 2296 GoToResolveExternalModuleHandler.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 4444 GoToResolveUnattended.exe 5720 GoToResolveProcessChecker.exe 5720 GoToResolveProcessChecker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1264 powershell.exe Token: SeShutdownPrivilege 5148 msiexec.exe Token: SeIncreaseQuotaPrivilege 5148 msiexec.exe Token: SeSecurityPrivilege 4580 msiexec.exe Token: SeCreateTokenPrivilege 5148 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5148 msiexec.exe Token: SeLockMemoryPrivilege 5148 msiexec.exe Token: SeIncreaseQuotaPrivilege 5148 msiexec.exe Token: SeMachineAccountPrivilege 5148 msiexec.exe Token: SeTcbPrivilege 5148 msiexec.exe Token: SeSecurityPrivilege 5148 msiexec.exe Token: SeTakeOwnershipPrivilege 5148 msiexec.exe Token: SeLoadDriverPrivilege 5148 msiexec.exe Token: SeSystemProfilePrivilege 5148 msiexec.exe Token: SeSystemtimePrivilege 5148 msiexec.exe Token: SeProfSingleProcessPrivilege 5148 msiexec.exe Token: SeIncBasePriorityPrivilege 5148 msiexec.exe Token: SeCreatePagefilePrivilege 5148 msiexec.exe Token: SeCreatePermanentPrivilege 5148 msiexec.exe Token: SeBackupPrivilege 5148 msiexec.exe Token: SeRestorePrivilege 5148 msiexec.exe Token: SeShutdownPrivilege 5148 msiexec.exe Token: SeDebugPrivilege 5148 msiexec.exe Token: SeAuditPrivilege 5148 msiexec.exe Token: SeSystemEnvironmentPrivilege 5148 msiexec.exe Token: SeChangeNotifyPrivilege 5148 msiexec.exe Token: SeRemoteShutdownPrivilege 5148 msiexec.exe Token: SeUndockPrivilege 5148 msiexec.exe Token: SeSyncAgentPrivilege 5148 msiexec.exe Token: SeEnableDelegationPrivilege 5148 msiexec.exe Token: SeManageVolumePrivilege 5148 msiexec.exe Token: SeImpersonatePrivilege 5148 msiexec.exe Token: SeCreateGlobalPrivilege 5148 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe Token: SeTakeOwnershipPrivilege 4580 msiexec.exe Token: SeRestorePrivilege 4580 msiexec.exe - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe 5488 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4808 wrote to memory of 2248 4808 WScript.exe 84 PID 2248 wrote to memory of 1264 2248 WScript.exe 85 PID 2248 wrote to memory of 5148 2248 WScript.exe 88 PID 4580 wrote to memory of 5040 4580 msiexec.exe 92 PID 4580 wrote to memory of 5640 4580 msiexec.exe 95 PID 5640 wrote to memory of 4564 5640 unattended-updater.exe 98 PID 5640 wrote to memory of 2536 5640 unattended-updater.exe 99 PID 5640 wrote to memory of 2768 5640 unattended-updater.exe 100 PID 2536 wrote to memory of 3120 2536 GoToResolveTools64.exe 102 PID 2768 wrote to memory of 4056 2768 cmd.exe 103 PID 5436 wrote to memory of 3428 5436 svchost.exe 105 PID 2768 wrote to memory of 2320 2768 cmd.exe 107 PID 4564 wrote to memory of 1444 4564 GoToResolveUnattended.exe 108 PID 5720 wrote to memory of 2060 5720 GoToResolveProcessChecker.exe 111 PID 5720 wrote to memory of 4444 5720 GoToResolveProcessChecker.exe 113 PID 2768 wrote to memory of 4668 2768 cmd.exe 116 PID 4444 wrote to memory of 4788 4444 GoToResolveUnattended.exe 117 PID 4444 wrote to memory of 2296 4444 GoToResolveUnattended.exe 118 PID 4444 wrote to memory of 3088 4444 GoToResolveUnattended.exe 119 PID 5720 wrote to memory of 5488 5720 GoToResolveProcessChecker.exe 121 PID 5488 wrote to memory of 5736 5488 GoToResolveUnattendedUi.exe 122 PID 2768 wrote to memory of 5920 2768 cmd.exe 123 PID 2768 wrote to memory of 3264 2768 cmd.exe 125 PID 2768 wrote to memory of 2356 2768 cmd.exe 126 PID 2768 wrote to memory of 3360 2768 cmd.exe 127 PID 2296 wrote to memory of 2764 2296 GoToResolveExternalModuleHandler.exe 132 PID 2296 wrote to memory of 6036 2296 GoToResolveExternalModuleHandler.exe 133 PID 2296 wrote to memory of 3968 2296 GoToResolveExternalModuleHandler.exe 137 PID 2296 wrote to memory of 4192 2296 GoToResolveExternalModuleHandler.exe 136 PID 2296 wrote to memory of 4500 2296 GoToResolveExternalModuleHandler.exe 140 PID 2296 wrote to memory of 2952 2296 GoToResolveExternalModuleHandler.exe 142 PID 2296 wrote to memory of 1820 2296 GoToResolveExternalModuleHandler.exe 144 PID 2296 wrote to memory of 5800 2296 GoToResolveExternalModuleHandler.exe 146 PID 2952 wrote to memory of 6116 2952 GoTo.Resolve.PatchManagement.Client.exe 148 PID 2296 wrote to memory of 2284 2296 GoToResolveExternalModuleHandler.exe 149 PID 2952 wrote to memory of 3272 2952 GoTo.Resolve.PatchManagement.Client.exe 151 PID 5800 wrote to memory of 1612 5800 GoTo.Resolve.Antivirus.App.exe 153 PID 2952 wrote to memory of 4952 2952 GoTo.Resolve.PatchManagement.Client.exe 156 PID 2952 wrote to memory of 2640 2952 GoTo.Resolve.PatchManagement.Client.exe 157 PID 2640 wrote to memory of 2280 2640 powershell.exe 158 PID 2296 wrote to memory of 3936 2296 GoToResolveExternalModuleHandler.exe 161 PID 2296 wrote to memory of 5508 2296 GoToResolveExternalModuleHandler.exe 163
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\urpremiuminvite_2026.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\urpremiuminvite_2026.vbs" /elevate2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\dl_0003.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\installer331.msi" /qn /norestart3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D39E51861382C96C68F5F12662AD6EC52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5040
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe"C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\installer331.msi" "-MsiInstanceGuid" "{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}" "-MsiUiLevel" "2"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\installer331.msi" "-MsiInstanceGuid" "{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}" "-MsiUiLevel" "2" "-installerFileName" "installer331.msi"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 4564 -InstallationId fCDs5OcX4O -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" -ApplicationType 4 -Environment "Production" -ForceInstall 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1444
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools64.exe" -InstallVDD3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=dd49a0b28d26fce22bd43379da05cd7f --annotation=format=minidump --annotation=hostname=Eygipcxh --annotation=platform=win --annotation=version=1.27.1.1320 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodulehandler.json" --initial-client-data=0x328,0x32c,0x330,0x31c,0x334,0x7ff7780ef8a8,0x7ff7780ef8c0,0x7ff7780ef8d84⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3120
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4056
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2320
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4668
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5920
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3264
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2356
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3360
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\x64\g2rvdd.inf" "9" "485a815f7" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3428
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" -ApplicationType "4"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3534568598794572930 --annotation=component=Unattended --annotation=computerid=dd49a0b28d26fce22bd43379da05cd7f --annotation=format=minidump --annotation=hostname=Eygipcxh --annotation=installationid=fCDs5OcX4O --annotation=platform=win --annotation=version=1.32.0.1672 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodulehandler.json" --initial-client-data=0x7ec,0x7f0,0x7f4,0x754,0x7f8,0x70dac5d0,0x70dac5e0,0x70dac5f02⤵
- Executes dropped EXE
PID:2060
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/3534568598794572930/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "5720" "-InstallationId" "fCDs5OcX4O" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_3534568598794572930" "-Service" "-LogLevel" "2" "-CrashHandlerPipe" "\\.\pipe\crashpad_5720_GXLVHBNCEXCPJTPX"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 4444 -CompanyId 3534568598794572930 -InstallationId fCDs5OcX4O -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_5720_GXLVHBNCEXCPJTPX -HostId dd49a0b28d26fce22bd43379da05cd7f -LogLevel 2 -SessionType Unattended3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4788
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveExternalModuleHandler.exe" -InstallationId fCDs5OcX4O -CompanyId 3534568598794572930 -publickey cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc -LogLevel 2 -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_5720_GXLVHBNCEXCPJTPX3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\GoTo.Resolve.Edr.Client.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\GoTo.Resolve.Edr.Client.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\0.155.1\GoTo.Resolve.Iata.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\0.155.1\GoTo.Resolve.Iata.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
PID:6036
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4192
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:3968
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\GoTo.Resolve.Alerts.Monitor.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4500
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\GoTo.Resolve.PatchManagement.Client.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SYSTEM32\where.exe"where" -r "C:\Program Files\WindowsApps" Winget.exe5⤵PID:6116
-
-
C:\Windows\SYSTEM32\where.exe"where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe5⤵PID:3272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$PSVersionTable.PSVersion.ToString()"5⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "Import-Module appx Add-AppxProvisionedPackage -Online -PackagePath C:\Windows\TEMP\tmpv0lezm.tmp.msixbundle -SkipLicense"5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\TEMP\16C02AA6-4A41-4AFB-B737-9D5F74C7D869\dismhost.exeC:\Windows\TEMP\16C02AA6-4A41-4AFB-B737-9D5F74C7D869\dismhost.exe {CB4F55AA-2BC2-4937-9D7D-6052DB796588}6⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2280
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1820
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.exe" --pipe-name resolve-antivirus-oesis-1BB6D3FDC6B0B05C9483AF8DF527597A654E2FF880E961E9B4914520DFE5B4FC5⤵
- Executes dropped EXE
PID:1612
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2284
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3936
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-1efb7cc3-d06e-40ec-bb6c-328b74a5c266 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5508
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId fCDs5OcX4O -CompanyId 3534568598794572930 -Environment Production -CrashHandlerPipe \\.\pipe\crashpad_5720_GXLVHBNCEXCPJTPX3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3088
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/3534568598794572930/GoToResolveUnattendedUi.exe" "-CompanyId" "3534568598794572930" "-InstallationId" "fCDs5OcX4O" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" "-Environment" "Production" "-ApplicationType" "4" "-CrashHandlerPipe" "\\.\pipe\crashpad_5720_GXLVHBNCEXCPJTPX" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3534568598794572930 --annotation=component=Unattended --annotation=format=minidump --annotation=hostname=Eygipcxh --annotation=installationid=fCDs5OcX4O --annotation=platform=win --annotation=version=1.32.0.1672 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\externalmodulehandler.json" --initial-client-data=0x820,0x824,0x828,0x81c,0x82c,0x70dac5d0,0x70dac5e0,0x70dac5f03⤵
- Executes dropped EXE
PID:5736
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:5848
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start GoToResolve_35345685987945729301⤵
- Launches sc.exe
PID:824
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3872
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:5320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58470a.rbs
- Size 7KB
- SHA256 489935b932a8124ad69f969cc2d75c3292342ba36ea439ad66022894b7f131e8
- MD5 6945e8055b026bae15099cf1d4dd854a
- SHA1 7713474711df09ec2104f0b84fd0b30712bf1cec
- SHA512 80b460d8115d6b8d48dae1c65253402838fe504d3778b87abcdf6a5b426731da2920486c5180c9e89612788803f90aa9885d566a306b3dab5e957cb9c49fcf71
- SSDEEP 96:hqtZpqeeKvMWhXbCOThq+WhXbCgj2S23ThqSHqK5fy3ktqEC2pljt29jBf2:h5ed/hmG+hmbBst2pJ
- TLSH T15CF1FD41624091E2FD973739C70727A93BB3D7F96215230B89DCE4686F03B9A5F942CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\353456~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\353456~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\FileManager.dll
- Size 16.2MB
- SHA256 e52df3605f8c28c3357c9a1eacb9bdb576b027c678d7b0a135382277f48d3f49
- MD5 c61215f3fe0fc66cde5992989959cd49
- SHA1 5e3d0d1007079972acea927a45400666c3106e46
- SHA512 0d77ac85877d7925ebe47ad5c3f556773d9e055a543881a79276ab6c3dca3cb54e741b92d03c980015df272e889ee54cd10941d68bb4a00541ccfb8ee9273e1a
- SSDEEP 393216:uHAVIztmuPEqUDEgitGFTf+DvBqEbjQJsv6tWKFdu9CU9:uHAVIpmuPUpitGpfIEEF9
- TLSH T15F07BFA2B1639135DD8A3172796EF73F5E2886144B2604C7935C3ED9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe
- Size 642KB
- SHA256 e044ba035f15440e020ae94324f53df505009a38e8a1d8c4d4cc2ec1ed6cdf68
- MD5 18fbb9f8ae08d8aa210b79bf9a74b2f1
- SHA1 268519465a14a27fe278dfa634c684ad967c781b
- SHA512 0f771f5c935c22cb1d155eda75ef6a88f74e7cb78da726874871a364776742858dce0cd41422578dfadf343a9a80c192cae5d5909626942319d1f186eb537dd3
- SSDEEP 12288:gipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e2:gipIc72CJhxGfRBYcRXHTqM8JMfqPwhX
- TLSH T13CE4BF11B1818032F5B222B2A9BDBFB059FCB52647BB09D773C44A3B5B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveLoggerProcess.exe
- Size 402KB
- SHA256 4fd864ec59e8ae3d7b0df2d1898feb16bc87413175e728c4a6c2b4bb726d2e4a
- MD5 1514d03b0f2889c83328aac8e59f9b09
- SHA1 4afa429703212f30a33b8d270bf45746fc5d1675
- SHA512 e3ca924cc97d7d2a69aa1572a70e58612ede3d1c733b5999fecdcb4b6cec37e915549b378e9bd0d1a05f99700651f3400ffc306a010ddd859ff53065914a3391
- SSDEEP 6144:Tv+waIQWan+HIl/HUxWaUn4hN6dER82AOG/HSOjAOSyrS9b92M1ZR/:Tv+wdFan+olvUan4hMyOjzib48z
- TLSH T1CC94AD127A81D032E8B210318FA4EF75667DEC304BA25ADFA7D43E6D4E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe
- Size 402KB
- SHA256 e648da008aa07264f886b3cf9ebe8a43d843bf3a002883e6b10b3dab56cb05fb
- MD5 fa95f55129c1cbe0d2e9216bb2646056
- SHA1 201c7bcccc271e6dc1f9949c9e412347217056b5
- SHA512 8d09876721735bb1554f14135794fc102869f687d31fccce3190ee1f697e342291acaff1669e1b7a4408983d68f54cc104b75119292f96777dd3cfefacf01db8
- SSDEEP 6144:3v+waIQWan+HIl/HUxWaUn4hN6dER82AOG/HSOjAO5RVS9b92M1ZR:3v+wdFan+olvUan4hMyOjHib48
- TLSH T12494AD127A81D032E8B210318FA4EF75667DEC304BA25ADFA7D43E6D4E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 f02a0f4eafa34bab44a4e71a3fc66f39e3d6e67f7114e84543d18b0cd0aa315b
- MD5 49dfb5b9b10fe31cd5e2649388694fc2
- SHA1 4fdf3940506746e59ce45224bd8f4d5860dcc155
- SHA512 d262b626427035d8d759aeefd107eb1cc1f1471f0d9c7902eb4c32fb9fa2c26e57d8b9c274aba271d58fe925e1580727b5488010df5029193d8228231b6d2632
- SSDEEP 24576:yPJ9T605srQiAfXFOmesUvLTTQlxwF2UM6eXzbaOCFL2KFhH4zc:E97LiAfXFasUTTTuxA21X/aO4hH4g
- TLSH T1E7558D1B62A841F8D0BFE17C8946890AE7B1780643729BEF13A8475A1F277E15F7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe
- Size 402KB
- SHA256 cbf8d4bd43ca8e5909c3558574e61ce632701eace734a8e052fa62fb8a025630
- MD5 0d590194e148269d3a7605b91b39274a
- SHA1 3bc802e951f3eaa67b3255fd63ec4bdc28df87cb
- SHA512 fa9346d8dcf2687675ba57dc5e76d9f6acaafaa17326d75450a2398aef845973657711872c269f3fdac794d33e7f3e2bff203a2de94a23ef946f8a256ff9d521
- SSDEEP 6144:Lv6wOIAean+HIlnTsRWaUnox9CdER02gOu7+nijAO/ZrS9b92M1ZRa:Lv6wR1an+olTs6noxwyijzib482
- TLSH T1A194AD127A81D032E8B210318FA4EF75667DEC304BA25ADFA7D43E6D4E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\LibGoToResolve.dll
- Size 20.2MB
- SHA256 cca7fa3a1dafe307b44fe9b3a740e960d2e50e2c9a1b73454a4d8eb379cb9d86
- MD5 475fea685ec1a6b0ac287be60537b286
- SHA1 344102a70e32f15f96330c0003d1c6ee58d8ee48
- SHA512 ad321d47e802195de7275087920ee8ad25babe25c78924ac00e1dc45d87e3bd0718272a0f4d777b8d5f2cb156f1100bec640eb153fac6ba6823fefff6d69747e
- SSDEEP 393216:wpvT+uHMcvvMmWjslJsv6tWKFdu9CU310z:SvTdscHM/si310z
- TLSH T1C2279EA27653C0F1E89611BD957AAB7F9678A820071910D7A3EC3F2D59301D33B37A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\MediaClientLib.dll
- Size 14.0MB
- SHA256 ebb4db37f0a7cd24606043c374244c0c3cd61a01e681634fb85757d529e497e8
- MD5 ccc2019e97c017c1104bcf329cbf5ddc
- SHA1 f1d851b5a63bf39b621189e6a6fc3955a46c1142
- SHA512 d6fb607a2ff92555fb9df94acacee70c5ab72b8a40b1470d3112d7e5a09a943e6fdea74b47101432d5588d3e07dbf80d727052fcf52edb9800042a51169970d5
- SSDEEP 196608:wJm8ZLHmdtSDClUCtsVj8OEBobQld7Tym37ZaBfjsbtCOGp8w9mnoj9:wJmILAtiCNOjbQSm3ejkTw+oZ
- TLSH T1ACE6BF82E2629070C9461D70AD3DBA3E6E29061D47B44AF7E7D85CA07BF37C03779686
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 3779453e2f6169dca499012c49dccd7a9083f7c600f6bc6e109fd8c1da507bfa
- MD5 47bbfebe111d79b3064c16292a868b3d
- SHA1 752dbdd7a3d5058227cfd832f9701b88b8916d09
- SHA512 45f684eaad775b2223d777ee0eac41b4b43d23f8a46357bb025d41f63bf69eaf4cca5e5e62f379535b22c95c38b23f33e33fe336b7a83e1ba99db2861fc0eda0
- SSDEEP 24576:OZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr5r:zYM801G81cOS5TI1hr5r
- TLSH T12E358C03BAC189B1F1AE46B44876B33C897EBD308734C5C75BC8688969715C1BB3B796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 322266b9ebbb68df4104b57316f7a19333c3a504b0dc0055073976e3eacacee8
- MD5 de324131859d253b93d109c7f8139797
- SHA1 2a207aff701645fafca5af51cc9a51f220feb5a0
- SHA512 3012d11a09bd734950e68c2138a6544f2095202e0029ba7117e0968ed42969dda55facce43a7706eca09857e7b6b6d2c281bb6674aa158ad6a898d537cdc073c
- SSDEEP 96:obepExJ5KOra38/X6yw638HEJH6y2608aSWHpT/BYf5riAn:o+30fz38CkpSxri+
- TLSH T166A12EA949A93CB333659717FE5708D589A5344E88E5AEF04BC974021ADFF3633D3820
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\GoToResolveUnattended.log
- Size 3KB
- SHA256 96f5ea53831f5c97b9420db3dd6e7b23aac0cd6afe77f462a0f031c03fe0c4e9
- MD5 2af08d9c76d2997b863940cfe815596b
- SHA1 ca51a09688190beca0c2a5427a372eeb40a2839c
- SHA512 d4b602c53b01af6b2820278f239bf39873c54fac462897b8ab5adbe5031adfaf1c4d09e7ac424fdea8d54eb7aac2cdf0254323b70853fe39fa0371b465133a7c
- TLSH T199619DA5491A3CE3E2565E6BBD834AD67997713AECCD4FD053C03508620EE1723832B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\logs\2026-05-03.log
- Size 1KB
- SHA256 39a9adc38e1bd589d90406a28cedf96225b5bab82959d1c22c22305cd18eeb75
- MD5 1bcede3a4773e1316cced45ca76ffc26
- SHA1 1d59eef94dbcd84707f1dc95f6ce36656ed78c06
- SHA512 799e2ede1aba06679e58d7eb4ae4f4410b2e78caf7463e003208197dfd4ed8906b6d0bab80d20ffbc0eae7504d1ab1be52bbb92918ef70920f18b571bd70b9f5
- TLSH T1AC4101304EB944266B42D799B70353C0F5728391741E0B316AFB94436DC38199D2E5F2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\logs\2026-05-03.log
- Size 4KB
- SHA256 597b824596cd2fada1cc4762081e0f03b24f19509b867a19defae0a690a8551e
- MD5 c66f728af061471495b633c8253a0095
- SHA1 4b918784aa3fcccb76b9a5658cb8304b2fb61eec
- SHA512 3fb6d344bc8a928d23745732bdaae0221162687edc40d9b428dd590d6536a131000b08a7d1d3f951ed420b2bf7e207e389c5acff3c5050d9124d13af677f09b0
- SSDEEP 96:K56QSfFahb2mGQ4x5Oeidxf59gJSyRPfyRwpNME:8cFahb2dQQOXd159gJSyxfy+p7
- TLSH T1DDA173755EAE04671781E366B70312C0FDB65149792E2530AAFEE0026FC3D0A952F6B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.exe
- Size 158KB
- SHA256 8531aff05f5e30172d8c4036ed17f5ea3b2b27a9a8581928b2f7539f9a97b168
- MD5 afe73177f76ddfde403c66ed0b631f28
- SHA1 6ba6d684c2c3be03fa7d57ae130696ac02ead7fe
- SHA512 dee81f1ba60daa5582a24beea4334ffd8365ad6d47ba0c00fb716daaeee518d95de5ad40c9037ef6bb75ac455fe0346fe0afb48278448dfe7a4d247c1e7afe11
- SSDEEP 3072:rqeXA/4yIg9vkNPNu6H6xCYOixUE265rJOQud:rvgvkNFNaxmVELJS
- TLSH T1B8F33B07A6A850BDE1B7D679CD924D41FB7378598B71A6CF03504AB60F63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.runtimeconfig.json
- Size 372B
- SHA256 ac9248778962c11c614017172e848d42c3ae84b0ecd7567fba1a4eae611b3ddd
- MD5 9bdb98d460f67b734c4af5ec18d407fc
- SHA1 6a080d646c41f184e7aecdfbd5bfa6ca20873151
- SHA512 57c0f1e3261c97107aa21fb347552df563742eadae42f4f41dc42f66f03629abf217d6b752b4612a50808c04ceed40b23a853037645cb26e8500a5e244e1c802
- TLSH T1CEE0DF69CA156D6711FAB27ECA21C083EA30632700041C81B8FD080C6F7B5A50113F96
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\appdata\logs\2026-05-03.log
- Size 2KB
- SHA256 7e6cb0447dcfb2f76b819b5c76bbd30602031abf8e7f6fa878ebc44ac4820f89
- MD5 34d6c01f6c5bd13f1d933e4b96ed4eda
- SHA1 99e6081d1c0197a85e18f73910042759623907db
- SHA512 9f6389fb8491492576ff5a1e228a0e706136fdbebfdf7c3ada9a27c9299b8cd787f96bbfa07dc6547d87e53803857b354af7e8df009747f2e0d0f22af9a537ed
- TLSH T13751B9B41E9722A917C3C24FBB0397C9CC37426F391D6B6462FE55846AD382B056F8B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe
- Size 26.3MB
- SHA256 1b5ad086b53faa907804a22f43d2cc7ffb7e9e4f391b80e633270ff04cb5e292
- MD5 8c616f47a3109487172fc5972eac11e2
- SHA1 d75b616b1efa4a8f9a34d62c7b62706699598333
- SHA512 61f9661d0b55107d3bb126a89ee15c1bbae99a8c50f7c67343f59490f8415e51ce8b9d5645e203d24cd86c92dfb89be861de540a0cce03ed7df4f94455ba2daa
- SSDEEP 196608:GZJx8lw5C4KS5JNJiTjY3G9MuppfBCX/9b/f20wBRJkvx0GwJcRFM81vSwX:GD5B5JN0Y2Gu3fuQkqGwJxC
- TLSH T12F579D11B3E8466AE5FF8378D4724116CBF2B8466725E7CF2548A5E91E23BC08E35363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe
- Size 24.2MB
- SHA256 fd043bbde640004e8b638a1f8de26b53b7c90edb234ebdb1e3864d3fde7dd39d
- MD5 e3d46fb95349429be560b5aab97a6702
- SHA1 a85027cf90d8f958a6a56f3f528156aa0cfaa74f
- SHA512 8ebaa5930c2dc2af049d5a4851d1217772818c8f318fe1ce4d42f53fd69b7560fd57d3105816a50363f785ffc56b39205b7177b03dece4f2f164caaed8899c78
- SSDEEP 196608:vPSHmI6WG3FKp3eN6o9grznlLnQY4+Zp7COjw1ZbxW6C6pIzn1wfBgC:v6HmI6Op32GzlDkHBR15
- TLSH T1DE478D47E8A610D9C9ADD230C5A696237B727C494B3127D72E60F7382F76BE06E79304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\GoTo.Resolve.Edr.Client.exe
- Size 158KB
- SHA256 8ae662f1cf09566bab2372526a36b1951d580f1a4dd896208850789ecacdb297
- MD5 075fc389d43f529cdaeaafd8803ccbd7
- SHA1 83cb229d3bbfbf60b7f5df842650ca8a15ce3760
- SHA512 9ff841a49476566b6f663332bcd6804004e71419db9e5e5dae5b35ce01b8658b0531a619a69eac13e7ddfeeeef10c78ce7da9b13d3cbb7b3b41936b767047de6
- SSDEEP 3072:bqvmgiYSoIk8uIHzlqRwa/YB26myIguAdf:b64k83TlEvGhIgJ
- TLSH T1EBF34B07E6A850BEE1B7D679CD924941FB7278598B71A7CF03504AB60F637D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\0.155.1\GoTo.Resolve.Iata.App.exe
- Size 4.7MB
- SHA256 86aa73fb6187e9f1c7bd683c9cdda1e59d534471c2fdd93f76ab149d7bd0dfbf
- MD5 a53bd149094a273d993211bac96bcd66
- SHA1 6fab646317f92a4c9fa61848c7669f9d65bb8369
- SHA512 94ff485c2a16b7e9f5cd7179f19a06cc939c57a9794a6c0b33bb78883a1d3f0964e9c2ddead773342d46ad5ac23c062f84c95770121609f39bd8dcd6316624ce
- SSDEEP 49152:6Tw1GtcVTKd0jgHkJMRyBUCBKWtQxgLnplsoSVzz5xDzd833V5YSXBUpunJTEv/5:csVcjoat83dXWbunGgZW
- TLSH T191363B02BE9A98E9C099C874C74A87A34A2274DB0A36F5FF45C911293F6DBB55F1C31C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\logs\2026-05-03.log
- Size 1KB
- SHA256 b04df00065f4dfb015e8dfc1106851e4493ad08b5859410a764c20dd61dca31f
- MD5 a48b262946de86c6e3b060b87bccf815
- SHA1 e47260b82ea195f028bedd9831c469cd8953395e
- SHA512 22cb58d7d49b107c00628baf48b9f1b17973c89ab735499d7c442e49ea6daf817bd6ebff49d03cde097622d00e35ac1b9504b0cf8f7a30f7c32ef0ab25ecbd48
- TLSH T1A83161715E7F28626903C385FB03A2C0D8374386180E0A745ADF45CB0DC2D26AC9F273
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\logs\2026-05-03.log
- Size 3KB
- SHA256 14939e3d5bfa05094a2248d90605938a4408dd4ac0a9a45d286147033da6e427
- MD5 b15ec91515acb51c2f0518c349c88ef3
- SHA1 93dff180b8c9b47e37429f1375783347513e00c5
- SHA512 7030128b1ca3bfde3d51b0d2c1fdf823b236e089fbbb5bd982ebec057ece48656131227913fd34b1355282526579721b065d492322ec92bc3a0f1f8ac3122f9e
- TLSH T1956153721EBF51755786C2857B0713C4CD17A198204D3BFC3AEF85898E9381AC9BE072
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe
- Size 157KB
- SHA256 658562be436234a6c39b6f3d022aa62b6c94c83c323e52bf96541a012f403d07
- MD5 1c4d80225b89ec730d0b2618be88fa6e
- SHA1 0e14a2f99c36ac4b325b39177a852fbbcbe2f230
- SHA512 fb31a12c3061abbf9edd81bc34a438c4e1f6f75ee3a05f764767350a3b9a46e85999a77aa10865bfcc54190c44dfbbdb6138256d911b2d41f91eec828deda872
- SSDEEP 3072:M4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZ88wJ:Mlm4sqMaFFBniJfBa23
- TLSH T1E6F33A07B6A950FED26BA678CD920905FB727C564BB1A3CF035049B60F62BD0AE7D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\mscordaccore_amd64_amd64_8.0.1925.36514.dll
- Size 1.3MB
- SHA256 c05d685863850917187b7282aa9739b23d5b967cac411c1fbe122b13a24ce5fa
- MD5 ba95de25f100739f3b28e0b80165e643
- SHA1 e8b992ad23e4fac1698a530d835fd086a80cf238
- SHA512 78096dc0570e3e2f44d8a866ddc1ff8ef4967a1a3122155adaff010f9a113b795fa556ed06fc30ac03e10457f484c109852f53745053e6dcf8a55df1dcd29773
- SSDEEP 24576:9SjmBjTo743G8eHkXYNXh3LlgNkBIi6VCA:wCBjTo74NYNR3pmk1ux
- TLSH T1BC554B56D6BC4499CEA9D0FCC547491FE7B13810037466EF46A48B192F3BBE6ABB8310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 2209fca646361b1cfe4d1563ee872211e930fe8980589abd1b00dbfccb887665
- MD5 c2ef30a5d9b1a18813adf97ea3ad6f82
- SHA1 67c498f42a2f231ac64e19d35554a92661ed5b2d
- SHA512 e28cfdc068b66252ccb6b9f8573c15e69d5194272c32124b4a5038ef01fdfb37c04deadc5102410cb0a9f9b3af6510e33d9938cfb3a91d7a95ed068286ebabf1
- SSDEEP 98304:jw+XiDVl+wisVycTFluaCYMJAvAPtD1CPwDvt3uFlDCBV2qH:swiDVsUvFlZCYMJAvAFD1CPwDvt3uFls
- TLSH T108568C6AB7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libcrypto-3.dll
- Size 4.2MB
- SHA256 6a8aab3ead89e7439f1b4b504e345cbdfcdd0ee6ea34cce98d67b5bb93bb41c7
- MD5 4b84fcf1a6c3fda9f0523e3dc6133190
- SHA1 797f136512b8fac0485d4bf6232f9d262e4044df
- SHA512 75918e7f42787395189fb4cfc67c7d04ede1817b2c833f81428ccdb57db4e5d7c533582e786ba33112ce8ca9215259b785533a782ea948ef485becf8b90e67a4
- SSDEEP 49152:vGk+pEt0x2dJ+fikXQrQ3iM9Ltx0vzRKvEMzia+FY1CPwDvt3uFlDCiro2a0VN:+k+JXKhS70FXVa+y1CPwDvt3uFlDCY
- TLSH T1BF26BF16FF926191E8DF917D12EFA33F0D3D5B54872489D38EA229E9C8256C0673E390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libssl-3.dll
- Size 1.1MB
- SHA256 d36015e483838a11e66ef62f55fc310d20833d53d067bee71af26f3586e423e6
- MD5 e26ea1d4422cb54be322af6cfdc75e0d
- SHA1 e48bfc3b6bec8f0443118f799753abb8276f2682
- SHA512 bc25430dc5a4570d450fe0e042eb7f30af8a126f60c003565505fb4fc26d2e3765d739da3050283bd515b088a38bac2119dce0ede6430b746c961f74d9be4fae
- SSDEEP 12288:G/PDN8rrGs0uxHyTOtGESs/02jspkaXD/ObOEIP6NK7zZbft0O3NqtFe9XbtQbn:G/ParrOY8zU/Kh2eNCFe9XbtQbn
- TLSH T1E735BF12BA818971DCE621BE06EDB77E463DA2101318C9C74F8559FEEE215C06B3A7CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\mandatory.json
- Size 1KB
- SHA256 376fdc360b7cd55d377283ca69b91c0f2a6035c57e181ca16e97e2078c2a1b83
- MD5 d46c7eb642bf59ade7cefe75ebfc9d9f
- SHA1 ad677db3206dfca6f98f30e3d0c43b2dd868d07f
- SHA512 8919427562cb7c808cd354d1639e990badc9096a9a5f46320f6514a0f55a75db63240b111988cc9f97c2d90f400d8f5d31ad0f262ac2b9515cf7cc307ef68d2f
- TLSH T1C7211460CAA12D3A2B0199D8EC2519527271126B1DD474B6BBC6190F0F4FF6F21B253E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json
- Size 699B
- SHA256 ec3ba05312a4d712365066169a2452cd634a45789a7630d42fdec054805a5747
- MD5 0a1cd8fd143aad63053aa717027ad1f6
- SHA1 7e48f61bd4633c0fda598ff6103edbaa26303ee2
- SHA512 7c5d95ca678d18c169e6bf2749acb36457b5dd8ddf793f290343c5d656f05381e379e7aa28e8710e56157fd69541f8c9beb35094af5b55bed29955915f205365
- TLSH T1C0014CA14EFA21384B13BED8CCAD544EE1B6485654C8A8E2994E2E1A05A2F932046478
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json
- Size 800B
- SHA256 4b8df005335646b7b82a7bb95ab2d40940074d8155b610851e4f854be48d89c2
- MD5 65eb59a32b0b7cf443b01d26a6c7576c
- SHA1 eb37ae392efc66e063cae4641ab97d0b3e552c31
- SHA512 8476cdf2ddb00ee2cc4512396163b0beedc3cd4b12883eee41de2d3b18d138b2c56ee6761a832a0792660b3c86c2dc9877469451efa56cc188349d6db2ac30f4
- TLSH T1E90126A1CCB52D360B1199C8DC65104AF22549675C88B8EAB74D1A0E0F9FEAF31B293C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json
- Size 1KB
- SHA256 70ba567f653bce80f00393bd421fe6a9fe1d50220ab39c5eebe122e168072600
- MD5 0972dafa96bd782ef0a587db278b55ac
- SHA1 d5067b48a8b886548729c7c1671cab58a9afab45
- SHA512 030bcb6ec5d25e869c784e6f5ee4d5a095d109293279f96397046660dd084297b5eef84dbc3581887a0648f12e602930db536476cedc64e80a7998733c242503
- TLSH T12C118EB1CCA12D360B01D9D4EC55154AB132466B5C54B8A6BB49090E0F8FF6F31B657C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
- Size 23.6MB
- SHA256 76cef15345e9dd1a0d433dc7186ae70c2b7579d185f4cf118617b31223c034a4
- MD5 19282535ab8af0cfffe7ec70817c6224
- SHA1 f28ce6a4a3dcfef62a7a7889ed00a79b3779b53a
- SHA512 134f82f9dd23d7f4cf265bad64287293dd393aa2813048188fbaaf96b62f874521773f5d01e024637c25e42199ede1d8f8454b7582d26363091598bdde0504ee
- SSDEEP 393216:Kn8KyMArcQC+kd5XtA0+Cl6vMmx0XWxDN+905OUKiWM62Wy8o+gx/03VlPp:y8KdAr1tkd5fgvDAWxDg9NQCJyD+m03B
- TLSH T1474733327247C576D59112F1AE3CAFE992AD9D244B7640DBB3CC5E298B204C33E36B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mslsntio.0lj.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dl_0003.ps1
- Size 718B
- SHA256 ee736b05543420c652338c29fe04cedff37f175030192d65611a247058bfc5c4
- MD5 104755034d6f072205c6d86ce7e7f214
- SHA1 8736fd376a798f108068e2e1303820712f67201d
- SHA512 e52b99ae74b8d5d455ead45d823ad5b8e9d1327d683015e93804eaa2557b41d5d604563dfd49abdf296928a3c579bf8f7fadc363bae43a4803583b888b6cbedd
- TLSH T14701C093954793344D79A52B4EBBA36CCCA20432BE8C1624FFB6C8001723A0DB581D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI721E.tmp
- Size 1.0MB
- SHA256 9a173cd40f43575ae6516eead420fa01664ce25494c7b4995083278021c1dfa9
- MD5 55ffec9e36c38659bae3971fdfb10534
- SHA1 c85da23369f03d2ae14d474dfbb5abe6bb33fe0d
- SHA512 0e700e091f28102753f4a3cf1e587f6eaeffdb5f41eb8920ecea906187ca0da3801c74535ecdecf777727b1dcfa3b98ca701864e30ac7a03ab01943ec2131917
- SSDEEP 24576:SGzNvWy0AUd4ND5VJxKZWdr+TUNnYafh0lhSMXlLU5FXS:/vWy0fd43VJxKZ+r+TUNzeAbXS
- TLSH T1FA25AF213A81C0F5D98E11F1597CBFBA927D59310FF148DB67DCAE6969300C26B32A87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e584707.msi
- Size 23.8MB
- SHA256 f45c4b8c1c5cc075fbab4ebcfe435891903622eb6028700b0f617428c3629ba1
- MD5 539694089b97debb94ea7b5cc9c18981
- SHA1 fc22b62efb7472ed24c68345efaa3e46a3a1b45d
- SHA512 f51e92996d5caf221138b6427a73c557a6462d590bd6600e3c2d7f8d85d9a757c611d99f9d93b2de3a54ab4ce128668bc280b3838a2bfbc9886cecd4f44f9dc6
- SSDEEP 393216:r0/KoQ3Wn7iPEcBwjzT+NSmEBk81t9dsh6ily59SFZa2lR2wJhL9grZo62pw:A/KoQmn7G/BwjAskW1sh6WyOKSdJR9Wt
- TLSH T1334733227A82C5F6D98911F09D7CAEE9613D9C250FB184CB73DCBE597B301D22B32916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logs\DISM\dism.log
- Size 2.1MB
- SHA256 bbf4144f4809010b5947ee9e3b868d416c798b71b7ef3f88343e9466ba01449b
- MD5 5b0fd3e28bbe795de7b90321814b4782
- SHA1 b611ec2c57f81f61ad4bab66352c2f6848ee5e97
- SHA512 76d7b8623fdd68afe0d3fd19cc93f3ed014372327dacfffef689df2b1db72e513c2fc0ec25714220d345a2f80a8351dc93bc77ae5980187474669d7ffbdc92d1
- SSDEEP 3072:hy/V3M3wRQ2rxqliM2wkobIlGiYCwkrPdcb8Kp9vwko/zQoc/CVWa4CymPIF+CNC:06/C5kZn33DF//q
- TLSH T12AA5EC3D13BF09A1530984837974BAAD71C73187BBC9F314763FD62AA7C69A1C9096C8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 4295f262398e19e3e4eca1c0af02c8ac19fb9d6118d83e83ebc450f2a2c0cff3
- MD5 ac794436481752ebfcdb41e2d1c83749
- SHA1 6380bdf57229dd5dc37108da84d10c0ccb23e58b
- SHA512 9f27ebc7943a2f056494b24d1484c54261aabceccf18f4c78cb36da2f3c9eb5b74059bc0a044c9394bb02e5af8f340d14d8737d6bd322f222d2435b785821dfc
- TLSH T1300149B70D3C45406C50475734F86F6836B7555A15DF664EBF307D890DDC745F85A042
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 727B
- SHA256 32c4a06ab9a36c5c07ba664ecc253bc3e935dd195bc0dd9b391d7c34be13ec3e
- MD5 07d07dec1fe6ee95098dcb2892872f08
- SHA1 0a561a6d076e80ce391cdb7872ee5a7f1c3822a4
- SHA512 665be4e5fde63b538d2c44711fc0f7b3e97eb449d7abb004215693726f1075f52468f8ca39101aec85b6130dfc9ddd502db8acb62681081a062a7d0a1bd5cf9e
- TLSH T1AF01990C189CF5C0963CC948DDACFA7176B31F22838D58BA201D295044C37A03E18FBC
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 cc142d97d22192bb1eb41c5947d7d45961802a1d2801f475841e009e40f323a2
- MD5 72c255b1a09845894d62b7a4a5a91777
- SHA1 b707c352390c45d44007f4fc531054c0fc29e451
- SHA512 ca74fcd06b1bb3fb570d495bf746f6c4f00d55f4422eeb7c92377df649f67bdeabbc7239970836b750d80585aa6a5452f4e48a6e0dd896c08d5f9ac2685e383a
- TLSH T135E026242EF600FEF3B7CA795AC6B9969859F25358648BA508908A5DAA01F044E534B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 408B
- SHA256 ad43a5865f5faa1961c1dc4520465e0ad1eefd163f34b8d2e5517798d9e6f9af
- MD5 d7c1416f2dd5416667b25214cc629688
- SHA1 f1bf32d05c0ec6be253baf7029f12518213a4534
- SHA512 4a70b99a751982e83b94b6472b4b1346c207d59068e9765252ed1af2da896ceb18f4f4fc33c77956228ccd4abc350c93d6e38ea629105028abc26e1f6d104eab
- TLSH T134E0C03872FC016DF2F1F47846F56C11580AF22A1551C26500408B96FA11E401CE3724
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\5oolx5kr.mzf
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512