Analysis
- max time kernel
300s - max time network
301s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
urpremiuminvite_2026.vbs
Resource
win10v2004-20260130-en
windows10-2004-x64
29 signatures
300 seconds
Behavioral task
behavioral2
Sample
urpremiuminvite_2026.vbs
Resource
win11-20260130-en
windows11-21h2-x64
29 signatures
300 seconds
General
- Target urpremiuminvite_2026.vbs
- Size 3KB
- Sample260503-vbqzmshs4n
- SHA256 00644e0c825460375f520c1d3247f7cf7aa67c0235a7a09bca4c10ee7e2f842f
- MD5 958b15aa8ef14262a92eee511ade7502
- SHA1 a6b241046077ff917a545d16753db3c7ee727887
- SHA512 3779e87793e20a7a909795f22629c89195ed99feaa127b05608b7f971f48d4d3ba177cbd760bfb881bf7b916939a7a0c411cb8b8125c2ee62bf413a3367d4ea7
- TLSH T1FA710F779B05E1ACB070C66E59AB5F0DD8413653BC4804A8B8B9FC515BDD62D4E808FE
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://urpremiuminvite.s3.us-east-2.amazonaws.com/LogMeInResolve_Unattended.msi
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveUnattended.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 26 IoCs
pid Process 1624 unattended-updater.exe 6004 GoToResolveUnattended.exe 3028 GoToResolveTools64.exe 1220 GoToResolveCrashHandler.exe 2568 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 536 GoToResolveCrashHandler.exe 4708 GoToResolveUnattended.exe 2132 GoToResolveLoggerProcess.exe 5156 GoToResolveExternalModuleHandler.exe 4592 GoToResolveNetworkChecker.exe 5768 GoToResolveUnattendedUi.exe 5372 GoToResolveCrashHandler.exe 2864 GoTo.Resolve.Antivirus.App.exe 5792 GoTo.Resolve.Edr.Client.exe 1056 GoTo.Resolve.Iata.App.exe 3176 GoTo.Resolve.DeviceData.App.exe 3236 GoTo.Resolve.Bcdr.App.exe 1660 GoTo.Resolve.Alerts.Monitor.App.exe 1032 RemoteExecution.Runner.exe 1652 GoTo.Resolve.PatchManagement.Client.exe 3288 GoTo.Resolve.Bcdr.App.exe 1208 GoTo.Resolve.Antivirus.OesisWorker.exe 2820 dismhost.exe 5604 GoTo.Resolve.Bcdr.App.exe 2368 GoTo.Resolve.Bcdr.App.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x001900000002b43c-64.dat rat_gotoresolve - Loads dropped DLL 64 IoCs
pid Process 5732 MsiExec.exe 5732 MsiExec.exe 3028 GoToResolveTools64.exe 6004 GoToResolveUnattended.exe 6004 GoToResolveUnattended.exe 6004 GoToResolveUnattended.exe 6004 GoToResolveUnattended.exe 6004 GoToResolveUnattended.exe 6004 GoToResolveUnattended.exe 2568 GoToResolveProcessChecker.exe 2568 GoToResolveProcessChecker.exe 2568 GoToResolveProcessChecker.exe 2568 GoToResolveProcessChecker.exe 2568 GoToResolveProcessChecker.exe 2568 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 2132 GoToResolveLoggerProcess.exe 2132 GoToResolveLoggerProcess.exe 2132 GoToResolveLoggerProcess.exe 5156 GoToResolveExternalModuleHandler.exe 2132 GoToResolveLoggerProcess.exe 4592 GoToResolveNetworkChecker.exe 2132 GoToResolveLoggerProcess.exe 4592 GoToResolveNetworkChecker.exe 5156 GoToResolveExternalModuleHandler.exe 2132 GoToResolveLoggerProcess.exe 4592 GoToResolveNetworkChecker.exe 5156 GoToResolveExternalModuleHandler.exe 4592 GoToResolveNetworkChecker.exe 4592 GoToResolveNetworkChecker.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 4592 GoToResolveNetworkChecker.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe 2864 GoTo.Resolve.Antivirus.App.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 3936 msiexec.exe 8 3936 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 5516 powershell.exe 5548 powershell.exe 5024 powershell.exe 1620 powershell.exe 1980 powershell.exe 6064 powershell.exe 4700 powershell.exe 5868 powershell.exe 4572 powershell.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe - Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85} DrvInst.exe File opened for modification C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\jdtollxj.3bt GoTo.Resolve.Alerts.Monitor.App.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\Settings\defaultState\rest_information winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\wge3unih.son GoTo.Resolve.Bcdr.App.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85}\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveExternalModuleHandler.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\8653cd360c544dbca7d73b4cb0ab3f98c1fd018d27d83fb73b63f4d5a47ee622\nt4u34uu.53b RemoteExecution.Runner.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AD65D3207566995440E2C2CC379B7B0 winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 winget.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_afb8b1a6452c68d5\virtualdisplayadapter.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85}\SETAE7B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85}\SETAE8C.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveUnattended.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\tjwvflxe.4ds GoTo.Resolve.Bcdr.App.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7E7D146147E46C8361E336CACF0A16E6 winget.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ddafac63f34fa55b\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.Winget.Source_8wekyb3d8bbwe\installed.db-journal winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\f297[1] winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.Winget.Source_8wekyb3d8bbwe\installed.db winget.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\81359c4d285ec56ddbfdec4ee441fa5ec8ef212367be7b5f267e66960f515606\2npnivgf.kmc GoTo.Resolve.PatchManagement.Client.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\77d9[1] winget.exe File created C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85}\SETAE7B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85}\SETAE8D.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\yhelksvi.j4p GoTo.Resolve.Alerts.Monitor.App.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7 winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f2b6b999c6ef750fc3d2cabf23fbbd288a8bc2e3fe9ad4284b32460a60edc865\ldkowmin.ezd GoTo.Resolve.Bcdr.App.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{1c094974-3f63-a747-aeb9-f6c972ff2b85}\SETAE8C.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\2035[1] winget.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\B3BE88AE82EB3628FBFFB367BF0A390558A39841 GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveExternalModuleHandler.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\e201347bdd3d27acaec6f1248cd1acb1424077d3a77f0684480a3934efdecac1\m12reu3t.klb GoTo.Resolve.Antivirus.App.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\892580777767344DCAEF580FFA143EA6_06AA6C92E12381CACC311949FAA50FF1 winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\e736[1] winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\versionData[1].mszyml winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AD65D3207566995440E2C2CC379B7B0 winget.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_2a9c012705b571c0\displayoverride.PNF GoToResolveTools64.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\8653cd360c544dbca7d73b4cb0ab3f98c1fd018d27d83fb73b63f4d5a47ee622\2ro1rmkv.isx RemoteExecution.Runner.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44 winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7 winget.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\PowerShell-7.6.1[1].msixbundle winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\Settings\defaultState\sources_metadata winget.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_38452bb97e6ec2c3\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.PreIndexed.Package\Microsoft.Winget.Source_8wekyb3d8bbwe\source.msix.dnld.msix winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.PreIndexed.Package\Microsoft.Winget.Source_8wekyb3d8bbwe\source.msix.dnld.msix:Zone.Identifier winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.Winget.Source_8wekyb3d8bbwe\installed.db winget.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44 winget.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\Microsoft.Extensions.Logging.Debug.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Reflection.Primitives.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Collections.NonGeneric.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Windows.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Quartz.Extensions.Hosting.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libcrypto-3-x64.dll unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Xml.Serialization.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Azure.Core.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Resources.Reader.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Net.Primitives.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Net.Primitives.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.IdentityModel.Abstractions.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Numerics.Vectors.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Collections.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Security.Cryptography.Algorithms.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Xml.Serialization.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Xml.XmlDocument.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Data.Common.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Runtime.Serialization.Json.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Runtime.InteropServices.RuntimeInformation.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Threading.Overlapped.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.IO.Pipes.AccessControl.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\UnattendedUpdater.log unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.Extensions.Logging.Console.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\OpenTelemetry.Api.ProviderBuilderExtensions.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\Microsoft.CSharp.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\downloads\1.2026.0316.05\GoToResolveUnattendedUpdater.exe GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Console.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Diagnostics.Debug.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Text.Encoding.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Quartz.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Runtime.Intrinsics.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Collections.Immutable.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\Microsoft.Extensions.Hosting.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools32.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\Microsoft.Extensions.Http.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\Polly.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\Microsoft.Extensions.Logging.EventSource.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Text.Encoding.CodePages.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Text.Encoding.Extensions.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\appdata\vault\3534568598794572930_DeviceGroupVault.json GoTo.Resolve.Alerts.Monitor.App.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Net.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\System.Net.WebHeaderCollection.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Runtime.Loader.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Data.DataSetExtensions.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Linq.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.ValueTuple.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Data.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.IO.FileSystem.Watcher.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.runtimeconfig.json GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Diagnostics.Contracts.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Transactions.Local.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\Microsoft.IdentityModel.Logging.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\Microsoft.VisualBasic.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Collections.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Security.dll GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.Reflection.Emit.Lightweight.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.IO.MemoryMappedFiles.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\System.Security.Principal.Windows.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\System.IO.IsolatedStorage.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\downloads\0.155.1\GoToResolveUnattendedUpdater.exe GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.Collections.Specialized.dll GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\System.ComponentModel.DataAnnotations.dll GoToResolveExternalModuleHandler.exe - Drops file in Windows directory 30 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFDF73B1AEFFF20D99.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\SystemTemp\tem77C8.tmp Clipup.exe File opened for modification C:\Windows\SystemTemp\PS-winget-install-log.txt GoTo.Resolve.PatchManagement.Client.exe File created C:\Windows\Installer\e589da6.msi msiexec.exe File opened for modification C:\Windows\Installer\e589da2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF3057838781707B58.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA237.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF47EC5530D669F5E0.TMP msiexec.exe File created C:\Windows\SystemTemp\tmphhcizl.tmp.msixbundle GoTo.Resolve.PatchManagement.Client.exe File created C:\Windows\Installer\{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}\ProductIcon msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe File created C:\Windows\SystemTemp\PS-winget-install-log.txt GoTo.Resolve.PatchManagement.Client.exe File opened for modification C:\Windows\Installer\MSIA296.tmp msiexec.exe File opened for modification C:\Windows\Installer\{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIA13C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Logs\DISM\dism.log powershell.exe File created C:\Windows\Installer\e589da2.msi msiexec.exe File created C:\Windows\SystemTemp\~DFDB79F1AC0408C45C.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File created C:\Windows\SystemTemp\winget-export.907593bd-7f39-485d-94f8-b9e1ba7be9cf.json winget.exe File created C:\Windows\Installer\SourceHash{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC} msiexec.exe File created C:\Windows\SystemTemp\tmphhcizl.tmp GoTo.Resolve.PatchManagement.Client.exe File created C:\Windows\SystemTemp\GoTo.Resolve.PatchManagement-3534568598794572930-WingetUpdate.dat GoTo.Resolve.PatchManagement.Client.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1568 sc.exe 404 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unattended-updater.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0100 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0002 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0002 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\000E GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0003 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0020 GoToResolveUnattended.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe - Delays execution with timeout.exe 4 IoCs
pid Process 5652 timeout.exe 4488 timeout.exe 6064 timeout.exe 5228 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections GoTo.Resolve.Edr.Client.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing winget.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates winget.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoTo.Resolve.DeviceData.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoTo.Resolve.DeviceData.App.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople winget.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe - Modifies registry class 34 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductIcon = "C:\\Program Files (x86)\\GoTo Resolve Unattended\\3534568598794572930\\GoToResolveUnattended.exe" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-18\{83B8F8BD-AF8B-40C8-A766-DEDBDB697631} winget.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Version = "18874368" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9F8EABFCD4E8ED64483E9D5504B989CA\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\PackageCode = "66CD4AB4BF2C9DF4794E499624EAEE89" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductIcon = "C:\\Windows\\Installer\\{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}\\ProductIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\9F8EABFCD4E8ED64483E9D5504B989CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductName = "LogMeIn Resolve Unattended 3534568598794572930" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-18\{1748D52C-09AC-469D-B0E7-886D154981D5} winget.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-18\{970E5ABD-A96C-447F-A62A-8ED3BFDEE9E9} winget.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9F8EABFCD4E8ED64483E9D5504B989CA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\ProductName = "LogMeIn Resolve Unattended" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F8EABFCD4E8ED64483E9D5504B989CA\SourceList\PackageName = "installer331.msi" msiexec.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\AD208D15F3FA9162B020B5891986AC9815941BFC\Blob = 030000000100000014000000ad208d15f3fa9162b020b5891986ac9815941bfc0b000000010000007000000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f00330035003300340035003600380035003900380037003900340035003700320039003300300000000200000001000000ec0000001c0000008c000000010000000000000000000000000000000100000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f00330035003300340035003600380035003900380037003900340035003700320039003300300000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e0030000000000020000000010000005d0300003082035930820241a0030201020214468330aae5b2a53588ad0eda7d950a4df96d31a0300d06092a864886f70d01010b0500304d314b3049060355040b0c42416d617a6f6e20576562205365727669636573204f3d416d617a6f6e2e636f6d20496e632e204c3d53656174746c652053543d57617368696e67746f6e20433d5553301e170d3236303530333136343830315a170d3439313233313233353935395a301e311c301a06035504030c1341575320496f5420436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100bb92274af754fddb4536af9556466da3ead5ca7de422d34d6b3fe8eedaa0ba96cfdfd446319392a724de5303d633a22f03f2c8b4608be13ad42b762b2fb2eabe8ee50dcbd60dd5641f86d20150c5dbfa6c6ddec4ad5c5717fcd3d0910c0fb228c9b1a58f882c09591bd8680308f310681f7acd5a23f0fc1a1048742f794171311821bd30ef9fed59b75edcd8728e66f5950f6fed8ce00146deca89acab50cfa59085a74f9a8af6fb2ae135253716c43e91ea77eb2b3d5b7608bb1b1cb3d29a20fba5906c87cff26f4083abff03c0bb6adbfb016ee683697ba7210190085f4dffd3e2c36f78de5f8199875244f8686ea1f81bf7d99a28b5b9176db2d8e642f44f0203010001a360305e301f0603551d230418301680143dc6635517f5404458c57d6406f76fe6beeaa6c7301d0603551d0e04160414b3be88ae82eb3628fbffb367bf0a390558a39841300c0603551d130101ff04023000300e0603551d0f0101ff040403020780300d06092a864886f70d01010b0500038201010055162ed062fdb3720762e3f6f9d3f94d29c43caef5cfd47b2445598fb8d2d40b57cc26924d471dc906a9032d8c5bff8824be1452b89bad5a1ea033ff36d93c3b23f6e58d5a457f0da0cf2f01b138b045440e3d6154acec898507592b67047aac7524ff5968eaf1e8b1bf41d3c166c223a8d0cb6cf08da3eb43d22db5b1b3484ee3a53ab89389efd7e44851c835aa97df29215ee900540b6b72034da29d44acc52b7a8a6d8e52c9b12144fa1441478fc774e7fd0b3cc96dee9958b2a5d9de88412e52bbb9c865ec48c72dd4f8cf720dad9db731ef4554aa5272f9ff1d19268a807d4fcd9b389d44154e2083476cb858b9381d5cfa0cd04d41f35c6a7e2f9e59b0 GoToResolveUnattended.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\AD208D15F3FA9162B020B5891986AC9815941BFC\Blob = 140000000100000014000000b3be88ae82eb3628fbffb367bf0a390558a398410200000001000000ec0000001c0000008c000000010000000000000000000000000000000100000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f00330035003300340035003600380035003900380037003900340035003700320039003300300000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000007000000047006f0054006f005200650073006f006c007600650055006e0061007400740065006e0064006500640043006f006e006e0065006300740069006f006e0043006500720074005f0033003500330034003500360038003500390038003700390034003500370032003900330030000000030000000100000014000000ad208d15f3fa9162b020b5891986ac9815941bfc20000000010000005d0300003082035930820241a0030201020214468330aae5b2a53588ad0eda7d950a4df96d31a0300d06092a864886f70d01010b0500304d314b3049060355040b0c42416d617a6f6e20576562205365727669636573204f3d416d617a6f6e2e636f6d20496e632e204c3d53656174746c652053543d57617368696e67746f6e20433d5553301e170d3236303530333136343830315a170d3439313233313233353935395a301e311c301a06035504030c1341575320496f5420436572746966696361746530820122300d06092a864886f70d01010105000382010f003082010a0282010100bb92274af754fddb4536af9556466da3ead5ca7de422d34d6b3fe8eedaa0ba96cfdfd446319392a724de5303d633a22f03f2c8b4608be13ad42b762b2fb2eabe8ee50dcbd60dd5641f86d20150c5dbfa6c6ddec4ad5c5717fcd3d0910c0fb228c9b1a58f882c09591bd8680308f310681f7acd5a23f0fc1a1048742f794171311821bd30ef9fed59b75edcd8728e66f5950f6fed8ce00146deca89acab50cfa59085a74f9a8af6fb2ae135253716c43e91ea77eb2b3d5b7608bb1b1cb3d29a20fba5906c87cff26f4083abff03c0bb6adbfb016ee683697ba7210190085f4dffd3e2c36f78de5f8199875244f8686ea1f81bf7d99a28b5b9176db2d8e642f44f0203010001a360305e301f0603551d230418301680143dc6635517f5404458c57d6406f76fe6beeaa6c7301d0603551d0e04160414b3be88ae82eb3628fbffb367bf0a390558a39841300c0603551d130101ff04023000300e0603551d0f0101ff040403020780300d06092a864886f70d01010b0500038201010055162ed062fdb3720762e3f6f9d3f94d29c43caef5cfd47b2445598fb8d2d40b57cc26924d471dc906a9032d8c5bff8824be1452b89bad5a1ea033ff36d93c3b23f6e58d5a457f0da0cf2f01b138b045440e3d6154acec898507592b67047aac7524ff5968eaf1e8b1bf41d3c166c223a8d0cb6cf08da3eb43d22db5b1b3484ee3a53ab89389efd7e44851c835aa97df29215ee900540b6b72034da29d44acc52b7a8a6d8e52c9b12144fa1441478fc774e7fd0b3cc96dee9958b2a5d9de88412e52bbb9c865ec48c72dd4f8cf720dad9db731ef4554aa5272f9ff1d19268a807d4fcd9b389d44154e2083476cb858b9381d5cfa0cd04d41f35c6a7e2f9e59b0 GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F GoTo.Resolve.DeviceData.App.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 040000000100000010000000173574af7b611cebf4f93ce2ee40f9a20f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba GoTo.Resolve.DeviceData.App.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa4040000000100000010000000173574af7b611cebf4f93ce2ee40f9a22000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba GoTo.Resolve.DeviceData.App.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\AD208D15F3FA9162B020B5891986AC9815941BFC GoToResolveUnattended.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5768 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 powershell.exe 1980 powershell.exe 3936 msiexec.exe 3936 msiexec.exe 1624 unattended-updater.exe 1624 unattended-updater.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 5156 GoToResolveExternalModuleHandler.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe 4708 GoToResolveUnattended.exe 4708 GoToResolveUnattended.exe 332 GoToResolveProcessChecker.exe 332 GoToResolveProcessChecker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1980 powershell.exe Token: SeShutdownPrivilege 3356 msiexec.exe Token: SeIncreaseQuotaPrivilege 3356 msiexec.exe Token: SeSecurityPrivilege 3936 msiexec.exe Token: SeCreateTokenPrivilege 3356 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3356 msiexec.exe Token: SeLockMemoryPrivilege 3356 msiexec.exe Token: SeIncreaseQuotaPrivilege 3356 msiexec.exe Token: SeMachineAccountPrivilege 3356 msiexec.exe Token: SeTcbPrivilege 3356 msiexec.exe Token: SeSecurityPrivilege 3356 msiexec.exe Token: SeTakeOwnershipPrivilege 3356 msiexec.exe Token: SeLoadDriverPrivilege 3356 msiexec.exe Token: SeSystemProfilePrivilege 3356 msiexec.exe Token: SeSystemtimePrivilege 3356 msiexec.exe Token: SeProfSingleProcessPrivilege 3356 msiexec.exe Token: SeIncBasePriorityPrivilege 3356 msiexec.exe Token: SeCreatePagefilePrivilege 3356 msiexec.exe Token: SeCreatePermanentPrivilege 3356 msiexec.exe Token: SeBackupPrivilege 3356 msiexec.exe Token: SeRestorePrivilege 3356 msiexec.exe Token: SeShutdownPrivilege 3356 msiexec.exe Token: SeDebugPrivilege 3356 msiexec.exe Token: SeAuditPrivilege 3356 msiexec.exe Token: SeSystemEnvironmentPrivilege 3356 msiexec.exe Token: SeChangeNotifyPrivilege 3356 msiexec.exe Token: SeRemoteShutdownPrivilege 3356 msiexec.exe Token: SeUndockPrivilege 3356 msiexec.exe Token: SeSyncAgentPrivilege 3356 msiexec.exe Token: SeEnableDelegationPrivilege 3356 msiexec.exe Token: SeManageVolumePrivilege 3356 msiexec.exe Token: SeImpersonatePrivilege 3356 msiexec.exe Token: SeCreateGlobalPrivilege 3356 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe Token: SeTakeOwnershipPrivilege 3936 msiexec.exe Token: SeRestorePrivilege 3936 msiexec.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 9 IoCs
pid Process 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe 5768 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 5144 wrote to memory of 6108 5144 WScript.exe 79 PID 6108 wrote to memory of 1980 6108 WScript.exe 80 PID 6108 wrote to memory of 3356 6108 WScript.exe 83 PID 3936 wrote to memory of 5732 3936 msiexec.exe 85 PID 3936 wrote to memory of 1624 3936 msiexec.exe 86 PID 1624 wrote to memory of 6004 1624 unattended-updater.exe 87 PID 1624 wrote to memory of 3028 1624 unattended-updater.exe 88 PID 1624 wrote to memory of 3732 1624 unattended-updater.exe 89 PID 3028 wrote to memory of 1220 3028 GoToResolveTools64.exe 91 PID 3732 wrote to memory of 5228 3732 cmd.exe 92 PID 4636 wrote to memory of 1580 4636 svchost.exe 94 PID 6004 wrote to memory of 2568 6004 GoToResolveUnattended.exe 95 PID 3732 wrote to memory of 5652 3732 cmd.exe 97 PID 332 wrote to memory of 536 332 GoToResolveProcessChecker.exe 98 PID 332 wrote to memory of 4708 332 GoToResolveProcessChecker.exe 99 PID 4708 wrote to memory of 2132 4708 GoToResolveUnattended.exe 102 PID 4708 wrote to memory of 5156 4708 GoToResolveUnattended.exe 104 PID 4708 wrote to memory of 4592 4708 GoToResolveUnattended.exe 105 PID 332 wrote to memory of 5768 332 GoToResolveProcessChecker.exe 106 PID 3732 wrote to memory of 4488 3732 cmd.exe 107 PID 3732 wrote to memory of 6064 3732 cmd.exe 136 PID 5768 wrote to memory of 5372 5768 GoToResolveUnattendedUi.exe 111 PID 5156 wrote to memory of 2864 5156 GoToResolveExternalModuleHandler.exe 112 PID 5156 wrote to memory of 5792 5156 GoToResolveExternalModuleHandler.exe 113 PID 5156 wrote to memory of 1056 5156 GoToResolveExternalModuleHandler.exe 114 PID 5156 wrote to memory of 3176 5156 GoToResolveExternalModuleHandler.exe 117 PID 5156 wrote to memory of 3236 5156 GoToResolveExternalModuleHandler.exe 118 PID 5156 wrote to memory of 1660 5156 GoToResolveExternalModuleHandler.exe 122 PID 5156 wrote to memory of 1032 5156 GoToResolveExternalModuleHandler.exe 124 PID 5156 wrote to memory of 1652 5156 GoToResolveExternalModuleHandler.exe 126 PID 1652 wrote to memory of 4632 1652 GoTo.Resolve.PatchManagement.Client.exe 128 PID 5156 wrote to memory of 3288 5156 GoToResolveExternalModuleHandler.exe 129 PID 1652 wrote to memory of 3444 1652 GoTo.Resolve.PatchManagement.Client.exe 131 PID 2864 wrote to memory of 1208 2864 GoTo.Resolve.Antivirus.App.exe 132 PID 1652 wrote to memory of 6064 1652 GoTo.Resolve.PatchManagement.Client.exe 136 PID 1652 wrote to memory of 4700 1652 GoTo.Resolve.PatchManagement.Client.exe 137 PID 4700 wrote to memory of 2820 4700 powershell.exe 138 PID 5156 wrote to memory of 5604 5156 GoToResolveExternalModuleHandler.exe 141 PID 1652 wrote to memory of 2540 1652 GoTo.Resolve.PatchManagement.Client.exe 143 PID 1652 wrote to memory of 3016 1652 GoTo.Resolve.PatchManagement.Client.exe 144 PID 1652 wrote to memory of 3576 1652 GoTo.Resolve.PatchManagement.Client.exe 145 PID 1652 wrote to memory of 5868 1652 GoTo.Resolve.PatchManagement.Client.exe 146 PID 1652 wrote to memory of 4572 1652 GoTo.Resolve.PatchManagement.Client.exe 147 PID 1652 wrote to memory of 2256 1652 GoTo.Resolve.PatchManagement.Client.exe 148 PID 1652 wrote to memory of 3896 1652 GoTo.Resolve.PatchManagement.Client.exe 149 PID 3896 wrote to memory of 4312 3896 cmd.exe 150 PID 5156 wrote to memory of 2368 5156 GoToResolveExternalModuleHandler.exe 151 PID 1652 wrote to memory of 5516 1652 GoTo.Resolve.PatchManagement.Client.exe 155 PID 1652 wrote to memory of 4420 1652 GoTo.Resolve.PatchManagement.Client.exe 156 PID 1652 wrote to memory of 5024 1652 GoTo.Resolve.PatchManagement.Client.exe 162 PID 1652 wrote to memory of 1620 1652 GoTo.Resolve.PatchManagement.Client.exe 163 PID 1652 wrote to memory of 1836 1652 GoTo.Resolve.PatchManagement.Client.exe 164 PID 1836 wrote to memory of 768 1836 cmd.exe 165 PID 1652 wrote to memory of 5548 1652 GoTo.Resolve.PatchManagement.Client.exe 166 PID 1652 wrote to memory of 3884 1652 GoTo.Resolve.PatchManagement.Client.exe 167 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\urpremiuminvite_2026.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\urpremiuminvite_2026.vbs" /elevate2⤵
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\dl_0003.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\installer331.msi" /qn /norestart3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A8DC68DBE19FBCC16AFAFCE4DD59708D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5732
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe"C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\installer331.msi" "-MsiInstanceGuid" "{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}" "-MsiUiLevel" "2"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\installer331.msi" "-MsiInstanceGuid" "{CFBAE8F9-8E4D-46DE-84E3-D955409B98AC}" "-MsiUiLevel" "2" "-installerFileName" "installer331.msi"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 6004 -InstallationId YsjUels2BJ -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" -ApplicationType 4 -Environment "Production" -ForceInstall 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2568
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools64.exe" -InstallVDD3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=e2b54dd0e7ae0d80dd187aaa018ac1fa --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=platform=win --annotation=version=1.27.1.1320 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodulehandler.json" --initial-client-data=0x340,0x344,0x348,0x338,0x34c,0x7ff6cd7ef8a8,0x7ff6cd7ef8c0,0x7ff6cd7ef8d84⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5228
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5652
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4488
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:6064
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\x64\g2rvdd.inf" "9" "485a815f7" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1580
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" -ApplicationType "4"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3534568598794572930 --annotation=component=Unattended --annotation=computerid=e2b54dd0e7ae0d80dd187aaa018ac1fa --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=installationid=YsjUels2BJ --annotation=platform=win --annotation=version=1.32.0.1672 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodulehandler.json" --initial-client-data=0x7c4,0x7c8,0x7cc,0x730,0x7d0,0x70a3c5d0,0x70a3c5e0,0x70a3c5f02⤵
- Executes dropped EXE
PID:536
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/3534568598794572930/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "332" "-InstallationId" "YsjUels2BJ" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_3534568598794572930" "-Service" "-LogLevel" "2" "-CrashHandlerPipe" "\\.\pipe\crashpad_332_EFUBPZVGQPUFJVJW"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 4708 -CompanyId 3534568598794572930 -InstallationId YsjUels2BJ -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_332_EFUBPZVGQPUFJVJW -HostId e2b54dd0e7ae0d80dd187aaa018ac1fa -LogLevel 2 -SessionType Unattended3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2132
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveExternalModuleHandler.exe" -InstallationId YsjUels2BJ -CompanyId 3534568598794572930 -publickey cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc -LogLevel 2 -Environment Production -ApplicationType 4 -CrashHandlerPipe \\.\pipe\crashpad_332_EFUBPZVGQPUFJVJW3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.exe" --pipe-name resolve-antivirus-oesis-4185CB0B30E143215E4134FC531691BB1D5331A4004C93C612E39A9B557D5F745⤵
- Executes dropped EXE
PID:1208
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\GoTo.Resolve.Edr.Client.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\GoTo.Resolve.Edr.Client.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5792
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\0.155.1\GoTo.Resolve.Iata.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\0.155.1\GoTo.Resolve.Iata.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
PID:1056
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:3176
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
PID:3236
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\GoTo.Resolve.Alerts.Monitor.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1660
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1032
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\GoTo.Resolve.PatchManagement.Client.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SYSTEM32\where.exe"where" -r "C:\Program Files\WindowsApps" Winget.exe5⤵PID:4632
-
-
C:\Windows\SYSTEM32\where.exe"where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe5⤵PID:3444
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$PSVersionTable.PSVersion.ToString()"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6064
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "Import-Module appx Add-AppxProvisionedPackage -Online -PackagePath C:\Windows\SystemTemp\tmphhcizl.tmp.msixbundle -SkipLicense"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\TEMP\0FE0B012-651A-4479-92B6-0C8B7741A375\dismhost.exeC:\Windows\TEMP\0FE0B012-651A-4479-92B6-0C8B7741A375\dismhost.exe {4F8EABCD-B502-4DF5-B543-E17EB37885F0}6⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2820
-
-
-
C:\Windows\SYSTEM32\where.exe"where" -r "C:\Program Files\WindowsApps" Winget.exe5⤵PID:2540
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" --version5⤵PID:3016
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" source export --disable-interactivity5⤵PID:3576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "try { $v = (Find-Module -Name ""Microsoft.WinGet.Client"" -ErrorAction Stop).Version.ToString() Write-Output ""FindModule:$v"" } catch { try { $url = ""https://patchmanagement-client-api.services.gotoresolve.com/api/v2/FindPackagesById()?id=%27Microsoft.WinGet.Client%27&`$filter=IsLatestVersion&`$top=1"" $response = Invoke-RestMethod -Uri $url -ErrorAction Stop $v = $response.properties.Version if ($v) { Write-Output ""ApiProxy:$v"" } else { Write-Error ""Could not parse version from API response"" } } catch { Write-Error ""Failed to get latest module version: $_"" } }"5⤵
- Command and Scripting Interpreter: PowerShell
PID:5868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$PSVersionTable.PSVersion.ToString()"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4572
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c "ver"5⤵PID:2256
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ""C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" install --id Microsoft.Powershell --scope machine --silent --source winget"5⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" install --id Microsoft.Powershell --scope machine --silent --source winget6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4312
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$Version = ""1.12.440"" $ModulePath = ""$HOME\Documents\PowerShell\Modules\Microsoft.WinGet.Client\$Version"" if (!(Test-Path -Path $ModulePath)) { $DownloadUrl = ""https://patchmanagement-client-api.services.gotoresolve.com/api/v2/package/Microsoft.WinGet.Client/$Version"" $DownloadPath = ""${env:temp}\winget.zip"" (new-object System.Net.WebClient).DownloadFile($DownloadUrl, $DownloadPath) New-Item -ItemType Directory -Path $ModulePath Expand-Archive $DownloadPath -DestinationPath $ModulePath -Force Remove-Item $DownloadPath }"5⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:5516
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" export --include-versions --source "msstore" --disable-interactivity --accept-source-agreements -o "C:\Windows\SystemTemp\winget-export.907593bd-7f39-485d-94f8-b9e1ba7be9cf.json"5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
PID:4420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "try { $v = (Find-Module -Name ""Microsoft.WinGet.Client"" -ErrorAction Stop).Version.ToString() Write-Output ""FindModule:$v"" } catch { try { $url = ""https://patchmanagement-client-api.services.gotoresolve.com/api/v2/FindPackagesById()?id=%27Microsoft.WinGet.Client%27&`$filter=IsLatestVersion&`$top=1"" $response = Invoke-RestMethod -Uri $url -ErrorAction Stop $v = $response.properties.Version if ($v) { Write-Output ""ApiProxy:$v"" } else { Write-Error ""Could not parse version from API response"" } } catch { Write-Error ""Failed to get latest module version: $_"" } }"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$PSVersionTable.PSVersion.ToString()"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1620
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ""C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" install --id Microsoft.Powershell --scope machine --silent --source winget"5⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" install --id Microsoft.Powershell --scope machine --silent --source winget6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:768
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -OutputFormat Text -Command "$Version = ""1.12.440"" $ModulePath = ""$HOME\Documents\PowerShell\Modules\Microsoft.WinGet.Client\$Version"" if (!(Test-Path -Path $ModulePath)) { $DownloadUrl = ""https://patchmanagement-client-api.services.gotoresolve.com/api/v2/package/Microsoft.WinGet.Client/$Version"" $DownloadPath = ""${env:temp}\winget.zip"" (new-object System.Net.WebClient).DownloadFile($DownloadUrl, $DownloadPath) New-Item -ItemType Directory -Path $ModulePath Expand-Archive $DownloadPath -DestinationPath $ModulePath -Force Remove-Item $DownloadPath }"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5548
-
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe"C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.28.240.0_x64__8wekyb3d8bbwe\winget.exe" export --include-versions --source "winget" --disable-interactivity --accept-source-agreements -o "C:\Windows\SystemTemp\winget-export.907593bd-7f39-485d-94f8-b9e1ba7be9cf.json"5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3884
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3288
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5604
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe" --Credentials:CompanyId 3534568598794572930 --Credentials:HostId syn-prd-ava-unattended-5268202c-357f-47c1-8b6f-0c4a74e3ee29 --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\token.txt" --ZeroTrust:ReferencePublicKeyHash cec6ee6409da90621ea773feed772d34cae708a50a7e9f92daa8c68ed41e79bc --Native:Version 1.32.0.16724⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2368
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId YsjUels2BJ -CompanyId 3534568598794572930 -Environment Production -CrashHandlerPipe \\.\pipe\crashpad_332_EFUBPZVGQPUFJVJW3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4592
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/3534568598794572930/GoToResolveUnattendedUi.exe" "-CompanyId" "3534568598794572930" "-InstallationId" "YsjUels2BJ" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930" "-Environment" "Production" "-ApplicationType" "4" "-CrashHandlerPipe" "\\.\pipe\crashpad_332_EFUBPZVGQPUFJVJW" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3534568598794572930 --annotation=component=Unattended --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=installationid=YsjUels2BJ --annotation=platform=win --annotation=version=1.32.0.1672 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\externalmodulehandler.json" --initial-client-data=0x8ac,0x8b0,0x8b4,0x81c,0x8b8,0x70a3c5d0,0x70a3c5e0,0x70a3c5f03⤵
- Executes dropped EXE
PID:5372
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:1568
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start GoToResolve_35345685987945729301⤵
- Launches sc.exe
PID:404
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:4988
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:6068
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.PowerShell_8wekyb3d8bbwe1⤵PID:5264
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.PowerShell_8wekyb3d8bbwe -ppl C:\Windows\SystemTemp\tem77C8.tmp2⤵
- Drops file in Windows directory
PID:3952
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e589da5.rbs
- Size 7KB
- SHA256 afda03010a0c0e49e6e788372bec9ec09c8f1d7ebf7bbf8cb107e2c96f6adf9f
- MD5 33aae4c005ff6dca4b79f78e88f6b291
- SHA1 0ce33dfb8ebb1bab6d739d3c59c188e32f62095a
- SHA512 7cac286297036399f9a72cdc2fce3638e671bb7a0260fdc5a35401063ce7ab08d4588ef079b9130646c6d7d3fc1c726fdee2e90aa48e664cfd38287f11ff95c6
- SSDEEP 96:Aqc3pDCbHvMWhXbCOThq+WhXbCgj2S23ThqSHsK5fy3ktqEC2pljt29jBf2:AzCz/hmG+hmbjst2pJ
- TLSH T1BEF10D41624091E2FD973739C70727A93BB3D7F96215230B88DDA4686F43B9A5F843CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\353456~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\353456~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\FileManager.dll
- Size 16.2MB
- SHA256 e52df3605f8c28c3357c9a1eacb9bdb576b027c678d7b0a135382277f48d3f49
- MD5 c61215f3fe0fc66cde5992989959cd49
- SHA1 5e3d0d1007079972acea927a45400666c3106e46
- SHA512 0d77ac85877d7925ebe47ad5c3f556773d9e055a543881a79276ab6c3dca3cb54e741b92d03c980015df272e889ee54cd10941d68bb4a00541ccfb8ee9273e1a
- SSDEEP 393216:uHAVIztmuPEqUDEgitGFTf+DvBqEbjQJsv6tWKFdu9CU9:uHAVIpmuPUpitGpfIEEF9
- TLSH T15F07BFA2B1639135DD8A3172796EF73F5E2886144B2604C7935C3ED9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveCrashHandler.exe
- Size 642KB
- SHA256 e044ba035f15440e020ae94324f53df505009a38e8a1d8c4d4cc2ec1ed6cdf68
- MD5 18fbb9f8ae08d8aa210b79bf9a74b2f1
- SHA1 268519465a14a27fe278dfa634c684ad967c781b
- SHA512 0f771f5c935c22cb1d155eda75ef6a88f74e7cb78da726874871a364776742858dce0cd41422578dfadf343a9a80c192cae5d5909626942319d1f186eb537dd3
- SSDEEP 12288:gipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e2:gipIc72CJhxGfRBYcRXHTqM8JMfqPwhX
- TLSH T13CE4BF11B1818032F5B222B2A9BDBFB059FCB52647BB09D773C44A3B5B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveLoggerProcess.exe
- Size 402KB
- SHA256 4fd864ec59e8ae3d7b0df2d1898feb16bc87413175e728c4a6c2b4bb726d2e4a
- MD5 1514d03b0f2889c83328aac8e59f9b09
- SHA1 4afa429703212f30a33b8d270bf45746fc5d1675
- SHA512 e3ca924cc97d7d2a69aa1572a70e58612ede3d1c733b5999fecdcb4b6cec37e915549b378e9bd0d1a05f99700651f3400ffc306a010ddd859ff53065914a3391
- SSDEEP 6144:Tv+waIQWan+HIl/HUxWaUn4hN6dER82AOG/HSOjAOSyrS9b92M1ZR/:Tv+wdFan+olvUan4hMyOjzib48z
- TLSH T1CC94AD127A81D032E8B210318FA4EF75667DEC304BA25ADFA7D43E6D4E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveProcessChecker.exe
- Size 402KB
- SHA256 e648da008aa07264f886b3cf9ebe8a43d843bf3a002883e6b10b3dab56cb05fb
- MD5 fa95f55129c1cbe0d2e9216bb2646056
- SHA1 201c7bcccc271e6dc1f9949c9e412347217056b5
- SHA512 8d09876721735bb1554f14135794fc102869f687d31fccce3190ee1f697e342291acaff1669e1b7a4408983d68f54cc104b75119292f96777dd3cfefacf01db8
- SSDEEP 6144:3v+waIQWan+HIl/HUxWaUn4hN6dER82AOG/HSOjAO5RVS9b92M1ZR:3v+wdFan+olvUan4hMyOjHib48
- TLSH T12494AD127A81D032E8B210318FA4EF75667DEC304BA25ADFA7D43E6D4E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 f02a0f4eafa34bab44a4e71a3fc66f39e3d6e67f7114e84543d18b0cd0aa315b
- MD5 49dfb5b9b10fe31cd5e2649388694fc2
- SHA1 4fdf3940506746e59ce45224bd8f4d5860dcc155
- SHA512 d262b626427035d8d759aeefd107eb1cc1f1471f0d9c7902eb4c32fb9fa2c26e57d8b9c274aba271d58fe925e1580727b5488010df5029193d8228231b6d2632
- SSDEEP 24576:yPJ9T605srQiAfXFOmesUvLTTQlxwF2UM6eXzbaOCFL2KFhH4zc:E97LiAfXFasUTTTuxA21X/aO4hH4g
- TLSH T1E7558D1B62A841F8D0BFE17C8946890AE7B1780643729BEF13A8475A1F277E15F7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\GoToResolveUnattended.exe
- Size 402KB
- SHA256 cbf8d4bd43ca8e5909c3558574e61ce632701eace734a8e052fa62fb8a025630
- MD5 0d590194e148269d3a7605b91b39274a
- SHA1 3bc802e951f3eaa67b3255fd63ec4bdc28df87cb
- SHA512 fa9346d8dcf2687675ba57dc5e76d9f6acaafaa17326d75450a2398aef845973657711872c269f3fdac794d33e7f3e2bff203a2de94a23ef946f8a256ff9d521
- SSDEEP 6144:Lv6wOIAean+HIlnTsRWaUnox9CdER02gOu7+nijAO/ZrS9b92M1ZRa:Lv6wR1an+olTs6noxwyijzib482
- TLSH T1A194AD127A81D032E8B210318FA4EF75667DEC304BA25ADFA7D43E6D4E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\LibGoToResolve.dll
- Size 20.2MB
- SHA256 cca7fa3a1dafe307b44fe9b3a740e960d2e50e2c9a1b73454a4d8eb379cb9d86
- MD5 475fea685ec1a6b0ac287be60537b286
- SHA1 344102a70e32f15f96330c0003d1c6ee58d8ee48
- SHA512 ad321d47e802195de7275087920ee8ad25babe25c78924ac00e1dc45d87e3bd0718272a0f4d777b8d5f2cb156f1100bec640eb153fac6ba6823fefff6d69747e
- SSDEEP 393216:wpvT+uHMcvvMmWjslJsv6tWKFdu9CU310z:SvTdscHM/si310z
- TLSH T1C2279EA27653C0F1E89611BD957AAB7F9678A820071910D7A3EC3F2D59301D33B37A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\MediaClientLib.dll
- Size 14.0MB
- SHA256 ebb4db37f0a7cd24606043c374244c0c3cd61a01e681634fb85757d529e497e8
- MD5 ccc2019e97c017c1104bcf329cbf5ddc
- SHA1 f1d851b5a63bf39b621189e6a6fc3955a46c1142
- SHA512 d6fb607a2ff92555fb9df94acacee70c5ab72b8a40b1470d3112d7e5a09a943e6fdea74b47101432d5588d3e07dbf80d727052fcf52edb9800042a51169970d5
- SSDEEP 196608:wJm8ZLHmdtSDClUCtsVj8OEBobQld7Tym37ZaBfjsbtCOGp8w9mnoj9:wJmILAtiCNOjbQSm3ejkTw+oZ
- TLSH T1ACE6BF82E2629070C9461D70AD3DBA3E6E29061D47B44AF7E7D85CA07BF37C03779686
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 3779453e2f6169dca499012c49dccd7a9083f7c600f6bc6e109fd8c1da507bfa
- MD5 47bbfebe111d79b3064c16292a868b3d
- SHA1 752dbdd7a3d5058227cfd832f9701b88b8916d09
- SHA512 45f684eaad775b2223d777ee0eac41b4b43d23f8a46357bb025d41f63bf69eaf4cca5e5e62f379535b22c95c38b23f33e33fe336b7a83e1ba99db2861fc0eda0
- SSDEEP 24576:OZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr5r:zYM801G81cOS5TI1hr5r
- TLSH T12E358C03BAC189B1F1AE46B44876B33C897EBD308734C5C75BC8688969715C1BB3B796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\GoToResolveProcessChecker.log
- Size 7KB
- SHA256 fc5b8ecd5b9c5006220e9ab094cf8c78a504ae59e04bc380f39af89de8492a0e
- MD5 fe68dd2a126d0a544db600cba346d7df
- SHA1 126e238041377c0b61b256da5081e9448583ba83
- SHA512 0554f245058f1b2ee3bd4cd8be6f82ff6ebfe684b5caa8a509e029ad88224b77e1520504f18ac6ba8e9899cf5248426a35acd4697d31d03276c00484772a2509
- SSDEEP 192:tRq30Zz38uiaA4fn1/h7/DS9yC+O130Zz38uQv15S:tRS0Zj8uiaA4f1/h7/g0Zj8uT
- TLSH T18AF111A94D693CB22761A71BFA8B1CC9D4B1685D68E5A9B197C7350316CFF362393030
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\appdata\GoToResolveUnattended.log
- Size 3KB
- SHA256 d2ae0fe7b7718818b2207660872834b927b5272eeba99d0e7a7cc11226707ca5
- MD5 4f63414e0f845c02201078587941ae90
- SHA1 4393270002396fba1f114ae07d6483eb7420fe02
- SHA512 4b3cd8b8dbbed751f9bcdf08e805c5e6737e4506bc53c31c9281ac20b9775ddce7b03aa0ffd0c7797b2cb4b0f8b5ef6c4075245fc41906e2b7bca59045adf0a9
- TLSH T19661BCA94D1A3CE3A11D6F6BBE438ED4F852B63ABCCD4E9052C1354C614DD5B270326A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\logs\2026-05-03.log
- Size 1KB
- SHA256 2178daa2117bdd85166a72c0a5e27cad1992819236041a4dc9be83b960afc181
- MD5 ab37d6d170258d25cbbab7a481e36d6b
- SHA1 0d4edc1a63b4fa05ecc8196aa36bd7b4e655d9be
- SHA512 7ab7cb3b45e31a6fd83d356eb88de531070bf8f153398c37e5a41b09513529570efc5adfca1240c220f9dcea50ecaf770e1f196dc09734bbffd50c015fa5c130
- TLSH T1EA411EB04EA44026A642F7A6A74327D0F876C2A1B02D073557FBD9036ED3D2E5D2E872
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AlertsModule\1.2026.0226.1\logs\2026-05-03.log
- Size 4KB
- SHA256 4aa81d505d73fe434178594e8a615d1ff8db131249825379728c318b27ee8670
- MD5 83fe5f9f4ebf2bc919925b2edd12d703
- SHA1 91a6591f29d88d3889770639f67a8bc44c53e812
- SHA512 76e943cc21c7c67aaa46f21788e9adf8e060b0f98b6ed412cdad76f5293facacd8bd50db121daa15a4ab05e217210474ce52757f7648009c45a6d79f8802cfbd
- SSDEEP 96:5qwpSCLbbAfXxtUlXidYSP59gJSyRPfyRoMjEE:YyLbkfclydYW59gJSyxfy2Ml
- TLSH T12FA140B14EDD006716C0E266F64316D1FDBA8256753D2234ABFAD5022FC3D1E983E672
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\GoTo.Resolve.Antivirus.App.exe
- Size 158KB
- SHA256 8531aff05f5e30172d8c4036ed17f5ea3b2b27a9a8581928b2f7539f9a97b168
- MD5 afe73177f76ddfde403c66ed0b631f28
- SHA1 6ba6d684c2c3be03fa7d57ae130696ac02ead7fe
- SHA512 dee81f1ba60daa5582a24beea4334ffd8365ad6d47ba0c00fb716daaeee518d95de5ad40c9037ef6bb75ac455fe0346fe0afb48278448dfe7a4d247c1e7afe11
- SSDEEP 3072:rqeXA/4yIg9vkNPNu6H6xCYOixUE265rJOQud:rvgvkNFNaxmVELJS
- TLSH T1B8F33B07A6A850BDE1B7D679CD924D41FB7378598B71A6CF03504AB60F63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\1.2026.0417.04\oesis-worker\GoTo.Resolve.Antivirus.OesisWorker.runtimeconfig.json
- Size 372B
- SHA256 ac9248778962c11c614017172e848d42c3ae84b0ecd7567fba1a4eae611b3ddd
- MD5 9bdb98d460f67b734c4af5ec18d407fc
- SHA1 6a080d646c41f184e7aecdfbd5bfa6ca20873151
- SHA512 57c0f1e3261c97107aa21fb347552df563742eadae42f4f41dc42f66f03629abf217d6b752b4612a50808c04ceed40b23a853037645cb26e8500a5e244e1c802
- TLSH T1CEE0DF69CA156D6711FAB27ECA21C083EA30632700041C81B8FD080C6F7B5A50113F96
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\appdata\logs\2026-05-03.log
- Size 2KB
- SHA256 dc2c6614944bf3b513aa74c59a4978397f0979da89992f7a041deca8e0e5f0f6
- MD5 030dd30540d7c9d945872a2040055de4
- SHA1 0f3f0d16a583af8d7f063b3bf3d4e165dfd23b4a
- SHA512 9fe3c9ea668960a9626e8753b32de122a70ca05a5d6b4c8423d9cd285d3b7e2f3d8f55ecfde49f88a2cba4b81aedb63e314209ffc23c5f5e45b201ee0b7647d1
- TLSH T12051DBB01EEB126927C2D34BFB064BC9CD77426F391C67A4A2FE414426D392A052F9B5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\AntivirusModule\appdata\logs\2026-05-03.log
- Size 7KB
- SHA256 4eedf89019d8ec1529b45f19d66242b072f97a0bad894fce47a53a4b12762c90
- MD5 808725dfea1c2e791864acd7c19d2593
- SHA1 9dbda61888b02cb71161e58fce00606dfdb3a46b
- SHA512 29cf04de079aaa26c7e481b8b1f37ee249d652ae954073de70489e1be222e7868e0174ea83e2b64e0f581e053109762e83c4dfd764e0bf2780bb0d88beba3392
- SSDEEP 96:91U656LyeT2h59fK4Oc+K0+voP/KqWEazyWyHoeV:zT596+brEGMo8
- TLSH T10DF135B1ADFB70A60381F32AF9CE4200BC32114B665C296875F5858637E3F1A656F0B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\BcdrModule\1.2026.0422.1\GoTo.Resolve.Bcdr.App.exe
- Size 26.3MB
- SHA256 1b5ad086b53faa907804a22f43d2cc7ffb7e9e4f391b80e633270ff04cb5e292
- MD5 8c616f47a3109487172fc5972eac11e2
- SHA1 d75b616b1efa4a8f9a34d62c7b62706699598333
- SHA512 61f9661d0b55107d3bb126a89ee15c1bbae99a8c50f7c67343f59490f8415e51ce8b9d5645e203d24cd86c92dfb89be861de540a0cce03ed7df4f94455ba2daa
- SSDEEP 196608:GZJx8lw5C4KS5JNJiTjY3G9MuppfBCX/9b/f20wBRJkvx0GwJcRFM81vSwX:GD5B5JN0Y2Gu3fuQkqGwJxC
- TLSH T12F579D11B3E8466AE5FF8378D4724116CBF2B8466725E7CF2548A5E91E23BC08E35363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\DeviceDataModule\1.299.0\GoTo.Resolve.DeviceData.App.exe
- Size 24.2MB
- SHA256 fd043bbde640004e8b638a1f8de26b53b7c90edb234ebdb1e3864d3fde7dd39d
- MD5 e3d46fb95349429be560b5aab97a6702
- SHA1 a85027cf90d8f958a6a56f3f528156aa0cfaa74f
- SHA512 8ebaa5930c2dc2af049d5a4851d1217772818c8f318fe1ce4d42f53fd69b7560fd57d3105816a50363f785ffc56b39205b7177b03dece4f2f164caaed8899c78
- SSDEEP 196608:vPSHmI6WG3FKp3eN6o9grznlLnQY4+Zp7COjw1ZbxW6C6pIzn1wfBgC:v6HmI6Op32GzlDkHBR15
- TLSH T1DE478D47E8A610D9C9ADD230C5A696237B727C494B3127D72E60F7382F76BE06E79304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\EdrModule\1.2026.0316.05\GoTo.Resolve.Edr.Client.exe
- Size 158KB
- SHA256 8ae662f1cf09566bab2372526a36b1951d580f1a4dd896208850789ecacdb297
- MD5 075fc389d43f529cdaeaafd8803ccbd7
- SHA1 83cb229d3bbfbf60b7f5df842650ca8a15ce3760
- SHA512 9ff841a49476566b6f663332bcd6804004e71419db9e5e5dae5b35ce01b8658b0531a619a69eac13e7ddfeeeef10c78ce7da9b13d3cbb7b3b41936b767047de6
- SSDEEP 3072:bqvmgiYSoIk8uIHzlqRwa/YB26myIguAdf:b64k83TlEvGhIgJ
- TLSH T1EBF34B07E6A850BEE1B7D679CD924941FB7278598B71A7CF03504AB60F637D0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\IataModule\0.155.1\GoTo.Resolve.Iata.App.exe
- Size 4.7MB
- SHA256 86aa73fb6187e9f1c7bd683c9cdda1e59d534471c2fdd93f76ab149d7bd0dfbf
- MD5 a53bd149094a273d993211bac96bcd66
- SHA1 6fab646317f92a4c9fa61848c7669f9d65bb8369
- SHA512 94ff485c2a16b7e9f5cd7179f19a06cc939c57a9794a6c0b33bb78883a1d3f0964e9c2ddead773342d46ad5ac23c062f84c95770121609f39bd8dcd6316624ce
- SSDEEP 49152:6Tw1GtcVTKd0jgHkJMRyBUCBKWtQxgLnplsoSVzz5xDzd833V5YSXBUpunJTEv/5:csVcjoat83dXWbunGgZW
- TLSH T191363B02BE9A98E9C099C874C74A87A34A2274DB0A36F5FF45C911293F6DBB55F1C31C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\logs\2026-05-03.log
- Size 1KB
- SHA256 3828758e22aed390c70aec82c895adb042dd0d01b4cebc7c14c4593f2fc9ceb9
- MD5 5a90fc9be10be5be0189a1b81194014e
- SHA1 86518d69554be9d5808548d693ea6bb6a8ffdc05
- SHA512 56d0425320bde74b11abdec5429733d459af970d88ff081d217c362e56dcb43169398e7bf321191c3d2299ff7a67ec892934df48f2d18f7546decc49d481ef72
- TLSH T1DC3144F01CAB90B5A146C180F70226D0E83BC381581D13B957E7198E0DF2E295CAE473
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\logs\2026-05-03.log
- Size 3KB
- SHA256 df5f4176e12dadae405c93437d37e944bb45b88a43c77dcaa2c11146fc32ca04
- MD5 a2159bc5b464422ab0d44f78def147b1
- SHA1 8f302a16c8acb43086db6301c531349ce7e47fe9
- SHA512 3f4eb7a8c20c488e0d787fd92df7b522b8cf4c056e59d2761ee15e44578a028307f2de91e397039419b698320b1ffd3b284feb078e23d3cd28c31bab9c32a3f8
- TLSH T11C6153B21DEF51A46385C285BB0717C0D92BA251205D37FC3BFF49494EA391A89BE077
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\PatchManagementModule\1.2026.0422.07\logs\2026-05-03.log
- Size 5KB
- SHA256 c3adb295bbc95671d5370bc7170b16d33045f1ce4e17fd92a953681d5a981b0e
- MD5 e52c33c22c2480c3212decbeead6ba99
- SHA1 ad2370827de2cebd245269aeba7164d7e92609dd
- SHA512 065e79bac8b167ac4aea2df3213905c5b324e8b9f7d81ad439f9bc2b0794a4b4eed9780d20eab6b8281472d821ef426cbd55fa342f7cea5e6340671f33347fe4
- SSDEEP 96:ekzypul/LaxNZc46ipHxxnw/dSPCLlsE6LGyCct8PT1m81i3Rmj9:DzxLz46oPnw/dSPCLl72GyZt8rw80Rm5
- TLSH T136C144B22EAF81781346C286670716C05D27A115214E7BFC37FF5448AE63817CE6E1BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\RemoteExecution.Runner.exe
- Size 157KB
- SHA256 658562be436234a6c39b6f3d022aa62b6c94c83c323e52bf96541a012f403d07
- MD5 1c4d80225b89ec730d0b2618be88fa6e
- SHA1 0e14a2f99c36ac4b325b39177a852fbbcbe2f230
- SHA512 fb31a12c3061abbf9edd81bc34a438c4e1f6f75ee3a05f764767350a3b9a46e85999a77aa10865bfcc54190c44dfbbdb6138256d911b2d41f91eec828deda872
- SSDEEP 3072:M4ym4smLLFEFKMaFFBLb+bVQjhznh7Kd1JC3YkkaZ88wJ:Mlm4sqMaFFBniJfBa23
- TLSH T1E6F33A07B6A950FED26BA678CD920905FB727C564BB1A3CF035049B60F62BD0AE7D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\externalmodules\RemoteExecutionModule\1.2025.0827.1\mscordaccore_amd64_amd64_8.0.1925.36514.dll
- Size 1.3MB
- SHA256 c05d685863850917187b7282aa9739b23d5b967cac411c1fbe122b13a24ce5fa
- MD5 ba95de25f100739f3b28e0b80165e643
- SHA1 e8b992ad23e4fac1698a530d835fd086a80cf238
- SHA512 78096dc0570e3e2f44d8a866ddc1ff8ef4967a1a3122155adaff010f9a113b795fa556ed06fc30ac03e10457f484c109852f53745053e6dcf8a55df1dcd29773
- SSDEEP 24576:9SjmBjTo743G8eHkXYNXh3LlgNkBIi6VCA:wCBjTo74NYNR3pmk1ux
- TLSH T1BC554B56D6BC4499CEA9D0FCC547491FE7B13810037466EF46A48B192F3BBE6ABB8310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 2209fca646361b1cfe4d1563ee872211e930fe8980589abd1b00dbfccb887665
- MD5 c2ef30a5d9b1a18813adf97ea3ad6f82
- SHA1 67c498f42a2f231ac64e19d35554a92661ed5b2d
- SHA512 e28cfdc068b66252ccb6b9f8573c15e69d5194272c32124b4a5038ef01fdfb37c04deadc5102410cb0a9f9b3af6510e33d9938cfb3a91d7a95ed068286ebabf1
- SSDEEP 98304:jw+XiDVl+wisVycTFluaCYMJAvAPtD1CPwDvt3uFlDCBV2qH:swiDVsUvFlZCYMJAvAFD1CPwDvt3uFls
- TLSH T108568C6AB7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libcrypto-3.dll
- Size 4.2MB
- SHA256 6a8aab3ead89e7439f1b4b504e345cbdfcdd0ee6ea34cce98d67b5bb93bb41c7
- MD5 4b84fcf1a6c3fda9f0523e3dc6133190
- SHA1 797f136512b8fac0485d4bf6232f9d262e4044df
- SHA512 75918e7f42787395189fb4cfc67c7d04ede1817b2c833f81428ccdb57db4e5d7c533582e786ba33112ce8ca9215259b785533a782ea948ef485becf8b90e67a4
- SSDEEP 49152:vGk+pEt0x2dJ+fikXQrQ3iM9Ltx0vzRKvEMzia+FY1CPwDvt3uFlDCiro2a0VN:+k+JXKhS70FXVa+y1CPwDvt3uFlDCY
- TLSH T1BF26BF16FF926191E8DF917D12EFA33F0D3D5B54872489D38EA229E9C8256C0673E390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\libssl-3.dll
- Size 1.1MB
- SHA256 d36015e483838a11e66ef62f55fc310d20833d53d067bee71af26f3586e423e6
- MD5 e26ea1d4422cb54be322af6cfdc75e0d
- SHA1 e48bfc3b6bec8f0443118f799753abb8276f2682
- SHA512 bc25430dc5a4570d450fe0e042eb7f30af8a126f60c003565505fb4fc26d2e3765d739da3050283bd515b088a38bac2119dce0ede6430b746c961f74d9be4fae
- SSDEEP 12288:G/PDN8rrGs0uxHyTOtGESs/02jspkaXD/ObOEIP6NK7zZbft0O3NqtFe9XbtQbn:G/ParrOY8zU/Kh2eNCFe9XbtQbn
- TLSH T1E735BF12BA818971DCE621BE06EDB77E463DA2101318C9C74F8559FEEE215C06B3A7CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\mandatory.json
- Size 1KB
- SHA256 277ee286abc8d29c6c47434d7531e31d6c28c9d4382156e1460691df85a99f5f
- MD5 f284610ad69e5b0b2034254c4bd39b11
- SHA1 630e6829d77412cd519a1594b5f30313e687b5bb
- SHA512 f79407835d7689793bcb3928a347ab549d27e27d422b2a6f7023497f277e29088ffc8d51a6d8bade5ba051752b729df944582a23e6005050570bf4832f9ca571
- TLSH T17E21F160C9912D362B1196C8EC2519426171026B1DD434B6BBC6190E0F4FF3F21B257E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json
- Size 699B
- SHA256 ec3ba05312a4d712365066169a2452cd634a45789a7630d42fdec054805a5747
- MD5 0a1cd8fd143aad63053aa717027ad1f6
- SHA1 7e48f61bd4633c0fda598ff6103edbaa26303ee2
- SHA512 7c5d95ca678d18c169e6bf2749acb36457b5dd8ddf793f290343c5d656f05381e379e7aa28e8710e56157fd69541f8c9beb35094af5b55bed29955915f205365
- TLSH T1C0014CA14EFA21384B13BED8CCAD544EE1B6485654C8A8E2994E2E1A05A2F932046478
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json
- Size 800B
- SHA256 4b8df005335646b7b82a7bb95ab2d40940074d8155b610851e4f854be48d89c2
- MD5 65eb59a32b0b7cf443b01d26a6c7576c
- SHA1 eb37ae392efc66e063cae4641ab97d0b3e552c31
- SHA512 8476cdf2ddb00ee2cc4512396163b0beedc3cd4b12883eee41de2d3b18d138b2c56ee6761a832a0792660b3c86c2dc9877469451efa56cc188349d6db2ac30f4
- TLSH T1E90126A1CCB52D360B1199C8DC65104AF22549675C88B8EAB74D1A0E0F9FEAF31B293C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\unattended.json
- Size 1KB
- SHA256 4929d51ddf0f3a91f3d6eae506917b9ab91f96eba18dbc77cab9d7533888da25
- MD5 f32c1a4e10fb590d5c74b59a24a5cfbd
- SHA1 07abef510067ec97914220ce4f150c56b60c3477
- SHA512 b6a3aa3f7b939455a3c10576ebcc6e3ec5796e1e670ca534649b9479fd3ddee34845c7f927a440c8b74139009d880da1bed039c691c4ad190f984341925ece15
- TLSH T190118EB1CC612D360B01D9D4EC55164AB131466B4C54B8E6B7490A0E0F8FF6F31B652D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3534568598794572930\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
- Size 23.6MB
- SHA256 76cef15345e9dd1a0d433dc7186ae70c2b7579d185f4cf118617b31223c034a4
- MD5 19282535ab8af0cfffe7ec70817c6224
- SHA1 f28ce6a4a3dcfef62a7a7889ed00a79b3779b53a
- SHA512 134f82f9dd23d7f4cf265bad64287293dd393aa2813048188fbaaf96b62f874521773f5d01e024637c25e42199ede1d8f8454b7582d26363091598bdde0504ee
- SSDEEP 393216:Kn8KyMArcQC+kd5XtA0+Cl6vMmx0XWxDN+905OUKiWM62Wy8o+gx/03VlPp:y8KdAr1tkd5fgvDAWxDg9NQCJyD+m03B
- TLSH T1474733327247C576D59112F1AE3CAFE992AD9D244B7640DBB3CC5E298B204C33E36B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
- Size 8KB
- SHA256 c2662a6793cc39e7cf984ba66cc04224e9e902c8c9af672706398042118f4ebd
- MD5 c352a96ae3d0788f6a72ba2aaf48b92e
- SHA1 cea7a20b35d48e5a21fcfd0413c9e52a4c0c7397
- SHA512 92ba3b705cf18beaa47197b5caa387303b6182392be8b2c98d188a9e548864e87cd32b0b9aa705ae0786dc30f506d66aa2241a167e5b2efbae43c1daaaa84522
- SSDEEP 192:+StIzD8p+34p2p232z272a292oYa2Fa2/g2Z2vZ/BEow2/U:+Sin8p+op2p232z272a292oYa2Fa2/g6
- TLSH T1EF028FA1E39FDAF6604AEF3EBD030B9E4C65E851F46E76E4B3D63C49415BE15050C822
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log
- Size 4KB
- SHA256 295c897a30a94905c5b27f6a64484073e096d1814d4332eee503f3539f387abf
- MD5 61d8e6347d561111ba2159fd77989ee2
- SHA1 79cb4abdef9a5a5a0473f7f377dcd0f26f65311e
- SHA512 69ef93b5766a867625835535b8b8ecc96f21460990d87d0d23eb24d0f0020fd76c7596bfca7df14d72b60371ea989db430eab7a8525b47bc717bf7e11a3c2222
- SSDEEP 96:o3WvpF8Hd2/OuSNPypd8TKQm7YVbMpf8PcDhpo:k7vd
- TLSH T106911AA2A61FFEF25405CF6EBE030BD95C45616298DC7D90A3C678E8939EF13248D852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_moj0z5wd.3a4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dl_0003.ps1
- Size 718B
- SHA256 ee736b05543420c652338c29fe04cedff37f175030192d65611a247058bfc5c4
- MD5 104755034d6f072205c6d86ce7e7f214
- SHA1 8736fd376a798f108068e2e1303820712f67201d
- SHA512 e52b99ae74b8d5d455ead45d823ad5b8e9d1327d683015e93804eaa2557b41d5d604563dfd49abdf296928a3c579bf8f7fadc363bae43a4803583b888b6cbedd
- TLSH T14701C093954793344D79A52B4EBBA36CCCA20432BE8C1624FFB6C8001723A0DB581D42
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSIA13C.tmp
- Size 1.0MB
- SHA256 9a173cd40f43575ae6516eead420fa01664ce25494c7b4995083278021c1dfa9
- MD5 55ffec9e36c38659bae3971fdfb10534
- SHA1 c85da23369f03d2ae14d474dfbb5abe6bb33fe0d
- SHA512 0e700e091f28102753f4a3cf1e587f6eaeffdb5f41eb8920ecea906187ca0da3801c74535ecdecf777727b1dcfa3b98ca701864e30ac7a03ab01943ec2131917
- SSDEEP 24576:SGzNvWy0AUd4ND5VJxKZWdr+TUNnYafh0lhSMXlLU5FXS:/vWy0fd43VJxKZ+r+TUNzeAbXS
- TLSH T1FA25AF213A81C0F5D98E11F1597CBFBA927D59310FF148DB67DCAE6969300C26B32A87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e589da2.msi
- Size 23.8MB
- SHA256 f45c4b8c1c5cc075fbab4ebcfe435891903622eb6028700b0f617428c3629ba1
- MD5 539694089b97debb94ea7b5cc9c18981
- SHA1 fc22b62efb7472ed24c68345efaa3e46a3a1b45d
- SHA512 f51e92996d5caf221138b6427a73c557a6462d590bd6600e3c2d7f8d85d9a757c611d99f9d93b2de3a54ab4ce128668bc280b3838a2bfbc9886cecd4f44f9dc6
- SSDEEP 393216:r0/KoQ3Wn7iPEcBwjzT+NSmEBk81t9dsh6ily59SFZa2lR2wJhL9grZo62pw:A/KoQmn7G/BwjAskW1sh6WyOKSdJR9Wt
- TLSH T1334733227A82C5F6D98911F09D7CAEE9613D9C250FB184CB73DCBE597B301D22B32916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logs\DISM\dism.log
- Size 287KB
- SHA256 5c0e4ed42a41cbadb6b68d9919d4986da3c3b2aebedd66d71956973c42c6f3c0
- MD5 35f1db5e8dfec750c08cfd191ec737b0
- SHA1 5f3c07ead65c61e7cc3cebe71dca96f1f60f7583
- SHA512 75a954a837d7519f322dc3811dbc317dc03337e580e75f659db5e626d2e9aacb9bd49ccbc20355f77ce5451cb0eb9573dfcaf00dbd123c1832b7dddfe30ff26d
- SSDEEP 1536:+ik3XvChwWpsFRKRQEdImCMsQrZZbTURu73YaENEWqYJHr3APpq10+a:bXHp
- TLSH T1EA54012D0BAB0DB1934C8443B271BAFD61D67593BAC8F354373FD12A67C2599CB26680
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 4295f262398e19e3e4eca1c0af02c8ac19fb9d6118d83e83ebc450f2a2c0cff3
- MD5 ac794436481752ebfcdb41e2d1c83749
- SHA1 6380bdf57229dd5dc37108da84d10c0ccb23e58b
- SHA512 9f27ebc7943a2f056494b24d1484c54261aabceccf18f4c78cb36da2f3c9eb5b74059bc0a044c9394bb02e5af8f340d14d8737d6bd322f222d2435b785821dfc
- TLSH T1300149B70D3C45406C50475734F86F6836B7555A15DF664EBF307D890DDC745F85A042
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 727B
- SHA256 32c4a06ab9a36c5c07ba664ecc253bc3e935dd195bc0dd9b391d7c34be13ec3e
- MD5 07d07dec1fe6ee95098dcb2892872f08
- SHA1 0a561a6d076e80ce391cdb7872ee5a7f1c3822a4
- SHA512 665be4e5fde63b538d2c44711fc0f7b3e97eb449d7abb004215693726f1075f52468f8ca39101aec85b6130dfc9ddd502db8acb62681081a062a7d0a1bd5cf9e
- TLSH T1AF01990C189CF5C0963CC948DDACFA7176B31F22838D58BA201D295044C37A03E18FBC
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 01a34af1e77b189da9ef4c508a1ec9b6cfa14763a79910a1cb07aa2e9cc40677
- MD5 7598f4dc360cb0d9f60047f98451c5aa
- SHA1 6cd5a1b28b7ce48a26a1a4acfb95170ae29db82e
- SHA512 91954954289fc974fdbb10b3506bf3f7f46cd3502c8fa922d564675debbc5cd1357e45bb2f2bbec6defd595b449f5e31e83fd8968fcca24270dc516f4996c8b6
- TLSH T17CE0C6242EF200BFF3BBCA395AC2B952980AF202586887A408908A4CAA01F000E534B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 408B
- SHA256 f7eae005f23100ecaa34e8834cacd430475784b985f518398fee9a46e07bb6e2
- MD5 0be31b8e958a5a414d9d92e05f8666c4
- SHA1 2dc35264b4d1ddd86a41e12c104c3d442ecf33fb
- SHA512 4361c71cbd264d85ff2eebb151ed6df8f3ca78454bf1454e554f9f005dbdb57f854e981fe0caa17238b1a31ebdd3e7288ad0b0e961540456bb34b1fac1981e20
- TLSH T1CAE0C03472FD005DF2F0F4B846E55D11580AF2261551C27501809A95FA50F001CE2720
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\f495aa2ce479c68f7355dcd52ec2bfe01a2e326b8274c67ecd4a631a9c704adb\yhelksvi.j4p
- Size 1B
- SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
- MD5 93b885adfe0da089cdf634904fd59f71
- SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
- SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
- MD5 SHA1 SHA512
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WinGet\Settings\defaultState\rest_information
- Size 1KB
- SHA256 ac6b77e64100f3e66e55b453510d541b429a73219da8c4ee45634b29ff177b16
- MD5 0e58ba266435f228af5e9ed1c6a53cc4
- SHA1 7df3122260c4db835276c0c75d7da0326626efcf
- SHA512 be8970438ca571132b11d0b4c65c6a0314eb3c4e971791cc6262e8aadf83bbbb742ac3b0a30da3ed7ab29bec3587cdb39cbd0ca8dc895325b477ca8ef84dbdd2
- TLSH T18B21DA14445DA459C17013748BC640D50A41CEBC9D79C2CCF77ADFFE99AD34080E4775
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WinGet\Settings\defaultState\sources_metadata
- Size 514B
- SHA256 e82b0f8f58624f388b43b6088ed1cdac7744b46b0a921de1c073fbe670237a5c
- MD5 86e22ec88bf6fcc338ccf021dbc3f393
- SHA1 ca750e5f45a165d4e219d490a66d7d2a31dec4b3
- SHA512 ddf92937393c17b359ea2248f850de4146aa167cc616ec8cd7e4bcc6c5e50f6232db27ea3a4613eedede901d59481ad3f2f374e9be143fa0e9ec2e4bfd890bb1
- TLSH T182F012C1FD26B0908E348ABDE7110B06E7482D7DB219ECACD7D8AA0661B9F45020D213
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\WinGet\State\defaultState\Microsoft.PreIndexed.Package\Microsoft.Winget.Source_8wekyb3d8bbwe\source.msix.dnld.msix
- Size 2.9MB
- SHA256 fb360bd0e56fff8ca5e574bd6d076ed119a17ea50b81ca7623b4cf2b0807ee06
- MD5 8c23c4cb52ecd1a16c524dfa246a7a07
- SHA1 9545ab06d1ae4aaf813689dee75148d61c8417c3
- SHA512 aaca21b4090d888faac5e1b542320e57b31ee4a796d786aee31a75bb2b21819e022eed1b73c29ba1df5cd1407518d5c1aa88162faab001f0df6287c84a098bb4
- SSDEEP 49152:0C6NnwShoom5Gu8iYaBsOnMxX5+UWkqtj37UBYvVI7HIgoTQETy35OfBMGy84tjL:owShoom0urYaBZsJ+UWkCjrUBcVI7ogR
- TLSH T1EAE53385F08A671CE4620A72598C53A4233E47571CF5B57ECC41BF6BF85A883B8EBD90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\APPX.5p8fkhh6hos984rp0q8wq5dcd.tmp
- Size 2KB
- SHA256 53498402f05fd93622c50ee9402c40eefeb3444be6d3c33147c6a78499e44bcb
- MD5 d86ffe06bf67c2024346aa7145dde8b5
- SHA1 666ac5c08c110706cd28f26932a6d07a206cee46
- SHA512 2bb4f72fc9a81480d81ccfedb27548a8991f3d280a6bc0225f108b992737eb73224eab08600c5d67125faaaf7b8d3e7a948f0398c09574f0f3970aac83c21e34
- TLSH T19B41265B90C81A544136D626FB265342FB38528734594994F8BCA10FBF733DF132315D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\APPX.dh_xfp7k74ofqtoztsv6rzgvf.tmp
- Size 10KB
- SHA256 b3c1e574b61591d8dbb3abc41d7026beb23b95d1e48d4c500bbd327a218a49bb
- MD5 06bf5f1dad7bfa242051bc964ad6c242
- SHA1 e3ef5e1ba8ef503b84b1348ffcbb8ab5a274827e
- SHA512 ebc2e86394661b88127694bf0cdbf5733782aeadd599b22c47e7f37096e223685fa26f7aba19a78978edd675386079c693b362d7c9077e385ec69983f5a134cb
- SSDEEP 192:2H0ZuQ0Oxll4zTukVqile79dVu1xUJ+7Cl3/NGXkmAY90cTSxTJzpanjWYp8IMx6:aOuQK/uaQlG7Cl3/4Ud6fOdHTIMqV
- TLSH T18A32C490147DBE3B819D4BBD9F24F5042C299827A36B2E5F9C4E94F2186F6724F230D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\APPX.pxy4nlzbm9x0iegnokl3tya7.tmp
- Size 11KB
- SHA256 71afd1b5b909d20f793449b039c1d7af9fd75f03d84f9fbae4f5a5df515ca454
- MD5 4dff5fc602c8b3ad9a323a400d0670a0
- SHA1 aa534a467c18e95fa7f3a75bf554afdf92a8f823
- SHA512 fa17ba6c6900ce993282c4da1792199fe483a2fe9cca6771477efeae57481d6ba5a1537b53998157f3144cdabfc70839223b82a71c3d294cd44bc7911bbf7fce
- SSDEEP 192:OztbIpnywiJFg9cbCzwgLC5tiJRZzCgrbuK/X01k9z3AlfWklEPF:wdwywi3g9cb8P25EJRdZriSR9z0fWk+9
- TLSH T167423AD5CF789187EA8BAD5053ECED973C3D47C71950A4A20AB6F5880D837C6EB0852D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\WinGet\defaultState\cache\V2_M\Microsoft.Winget.Source_8wekyb3d8bbwe\manifests\m\Microsoft\PowerShell\7.6.1.0\f297
- Size 4KB
- SHA256 3a0200d901420cdfe8b888eef21c31d32d542392357e715ff48d18d0f28891f4
- MD5 8334f9f9957dd1ec98557d8382e0d1d4
- SHA1 1b9e23f82b2849c30a4fd0fd4ebc1757eb365bd2
- SHA512 83d0a3eb29faf3fe09368f4afb7599ea1047b186d4584c043432956b806180e2c0c501740a1017c1221216314c3d5382401c9f571ee32b409b9bd48cc7a54075
- SSDEEP 96:kDZD+9eyYzAyYz2yYzYbLS6sI/AkAn3OEn8XMKciW2DFoGd:zgyY8yYyyYY2uNYc/
- TLSH T1D69165FE976807A96F3F1A8FD95E0128FA627340D1099DFAB3D61C0441514608B5E75F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\WinGet\defaultState\cache\V2_PVD\Microsoft.Winget.Source_8wekyb3d8bbwe\packages\Microsoft.PowerShell\8681f93d\versionData.mszyml
- Size 4KB
- SHA256 8681f93d9135752b929150dbe8d30d8eea840cbbb69ba6536e47e6257ff11b15
- MD5 14ea8915d64b2532e8cf7900a5539e72
- SHA1 08013083f4de988bdcec059f3bbb32ec9cf67137
- SHA512 1105405421133d7dfd6a8e18e927903bf55aa5d951e2164c24bbb0fa15288009809b04bf8ec8913a9e37ab7e22beb8258ecb3bf74391fecaefd0b701864623c3
- SSDEEP 96:9pFbSgw2iRBHbKxBsgNDleH8VDO9NBzmtPTyfHBda7+Q4xyaZHIv+Lm2dXauD+:tbMHisFQK9APTsw7+Q4Mso2aSXaS+
- TLSH T18E914CF0AAAC98948CB7EA6869E5C4E880034B19F13C22A4657DC93F44F612745BD4B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\WinGet\defaultState\{4EE5DE52-01BD-48B9-AA48-BAF223DAA5F2}
- Size 6.8MB
- SHA256 471b676d3fa922e01cc070b7a39550a6505d7e814160e87e8925b03184ddb781
- MD5 b3ce349c52d780eeaf26f0d973a1a242
- SHA1 562369a71d7490630dceb1a69071e79813555565
- SHA512 75bd4ffabdc932e1f70bcf299f1b898cfde5aa578749a67eec6f319dec6aacdd73e9f57f3e8e1515b6611b3229e31cd444f2656a8f77d0e5116d6ffa29aae493
- SSDEEP 49152:HctitLtCTv0fnW4ZVt/Dte9wBG0hYA+hTkYgLRpRkx+2KhsGmtOh6PX8vziqTlCc:N6DmLDSEEG8Oh6PMvz9MZK
- TLSH T1EC76065B05952AEEEFC1CC7BB3645BF344D31BEAA0814290D5078F90A509F9562FEAC3
- MD5 SHA1 SHA512 SSDEEP TLSH