d8ea1c97d9d1f7794c76a62d974df00f4d241fdc97be912d0e828528d823cc22

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 32.6MB
Sample260519-dnaprafv3x
SHA256 d8ea1c97d9d1f7794c76a62d974df00f4d241fdc97be912d0e828528d823cc22
MD5 910079df50503082fb84194e742d6aef
SHA1 d3ca9d787f7eb5a1cae6519d1b11539c7ce7e65c
SHA512 e9495a8439a18e2a81d189f16261f25bbe4efe1149070fc5df9d5c50b642b68fa360cb2f7679073191e24e9538badeeb890d327137bcc9e1b643674d9c42c9be
SSDEEP 786432:Rsv16y1mEy4ZuOStXPe9UmKqgt2O2HK4qrzaURNkYvJw6:RsN6UzZuOaXPe9PK2O2q4yzIYx7
TLSH
T1EA771217A2E60194D9BAC078CA679647FB727C0613306BDF12A4A2156F73AF01E7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoTo ResolveLeaveBehind649983349027111485 = "C:\\Users\\Admin\\AppData\\Local\\GoTo Resolve Applet\\LeaveBehindApplet\\649983349027111485\\GoToResolveProcessChecker.exe -ApplicationType \"1\" -RunOnce 1"	GoToResolveService.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645	GoToResolveProcessChecker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645	GoToResolveProcessChecker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	GoToResolveProcessChecker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	GoToResolveProcessChecker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveProcessChecker.exe

Executes dropped EXE 4 IoCs

pid	Process
4852	GoToResolveService.exe
3588	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
1888	GoToResolveCrashHandler.exe

Loads dropped DLL 24 IoCs

pid	Process
4852	GoToResolveService.exe
4852	GoToResolveService.exe
4852	GoToResolveService.exe
4852	GoToResolveService.exe
4852	GoToResolveService.exe
4852	GoToResolveService.exe
4852	GoToResolveService.exe
4852	GoToResolveService.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
3588	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveProcessChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveProcessChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveProcessChecker.exe

Modifies data under HKEY_USERS 49 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GoToResolveProcessChecker.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\gotoresolve-lb-649983349027111485\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\GoTo Resolve Applet\\LeaveBehindApplet\\649983349027111485\\GoToResolveService.exe -LeaveBehind 1 -StartedFromQuickLaunch 1 -JsonParams \"%1\""	GoToResolveService.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\gotoresolve-lb-649983349027111485	GoToResolveService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\gotoresolve-lb-649983349027111485\URL Protocol	GoToResolveService.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\gotoresolve-lb-649983349027111485\shell\open\command	GoToResolveService.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\gotoresolve-lb-649983349027111485\shell	GoToResolveService.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\gotoresolve-lb-649983349027111485\shell\open	GoToResolveService.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe
2164	GoToResolveProcessChecker.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4852	GoToResolveService.exe
Token: SeCreatePagefilePrivilege	4852	GoToResolveService.exe
Token: SeShutdownPrivilege	3588	GoToResolveProcessChecker.exe
Token: SeCreatePagefilePrivilege	3588	GoToResolveProcessChecker.exe
Token: SeShutdownPrivilege	2164	GoToResolveProcessChecker.exe
Token: SeCreatePagefilePrivilege	2164	GoToResolveProcessChecker.exe
Token: SeShutdownPrivilege	2164	GoToResolveProcessChecker.exe
Token: SeCreatePagefilePrivilege	2164	GoToResolveProcessChecker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4852	6052	2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	79
PID 6052 wrote to memory of 2488	6052	2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80
PID 4852 wrote to memory of 3588	4852	GoToResolveService.exe	82
PID 2164 wrote to memory of 1888	2164	GoToResolveProcessChecker.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveService.exe
  "C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveService.exe" -LeaveBehind 1
  2⤵
  - Adds Run key to start application
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveProcessChecker.exe
    "C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 4852 -InstallationId OZyuGWJpDO -WorkFolder "C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485" -ApplicationType 14 -Environment "Production" -ForceInstall 0
    3⤵
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe""
  2⤵
  PID:2488

C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveProcessChecker.exe
"C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485" -ApplicationType "14"
1⤵
- Drops file in System32 directory
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveCrashHandler.exe
  "C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveCrashHandler.exe" "--database=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=649983349027111485 --annotation=component=LeaveBehindAttended --annotation=computerid=036b0f6790757485cca7c9dcd64d23d0 --annotation=format=minidump --annotation=hostname=Iohdbslo --annotation=installationid=OZyuGWJpDO --annotation=platform=win --annotation=version=1.33.0.2326 "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\params.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\unattended.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\mandatory.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\pc.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\ui.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\logger.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\leavebehind.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\rc.json" "--attachment=C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\externalmodulehandler.json" --initial-client-data=0x854,0x858,0x85c,0x7a4,0x860,0x21a63cb4e30,0x21a63cb4e48,0x21a63cb4e60
  2⤵
  - Executes dropped EXE
  PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 6c1475a12cd2b0618b7864a1d02575692b3d5fa97beb6d1fde827b8c09129eaf
MD5 34e1bc8105ea614b756ac2217b4db935
SHA1 ef081f9afa167c10e9a708c605db2eee4b921fc5
SHA512 40952e1c05f1bb2c5b111e303b083a0c29dc962f561c9232928411497dc26741425bf5db3a46b62c5be359570b848f685b200ddb845fe30550ddeb3645a681fd
TLSH
T17C014EE35D3F296138349B5968848C243D97982691C70837EC204960AA5AFEC9A7FB76
MD5 SHA1 SHA512 TLSH

Submit Download

1A374813EDB1A6631387E414D3E73232

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
Size 168KB
SHA256 26b0a5654aa36df5a38ea9ddc1d4e0ef662f16bd82329d88e878f875355bea66
MD5 8d0a5938b55681d45e3a688407f2f1b6
SHA1 14e493357f3ac4ae836c8a624260865dcefa35de
SHA512 2b8ffd0d8a9d7fdfb638ee5879a99443e4985ff0a3a01da72cca83597197096b20b08710172db7f08e0368f8a9a81c7a7fb35a4d9ae06506845ef14e1cb9a1f3
SSDEEP 3072:rbyxt675qZ6gxwE8TFF1lUQ8aP1ygAwJcT+w/TaT:rbE67Gi7AaP1LAacTtm
TLSH
T1CEF3ED288D187152E54AAD76D9CEAF9BCCB5B4C733D1954F96500F822422FCD8FD88B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 ad092b2ede051d4a68407740e0d1482ff80134d3aa1b179c5d8e5c1c145abf67
MD5 afacc940ac735b087edc89cee03196f3
SHA1 df425b1a8780e33ac1d8ba057698cc7f35228651
SHA512 5d8b808bc47c0104c0a888ac575e71f69a4e751352669cb8af42fcfb9d75a360ecc943da7e392edaee375d0d87493e829955e54fc72191ca64cadc4283e543f4
TLSH
T161E028241EF5013DF357CD355FC1B412484AF1466C60CBB914D0194CBF41F040E61CB4
MD5 SHA1 SHA512 TLSH

Submit Download

1A374813EDB1A6631387E414D3E73232

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
Size 306B
SHA256 93b96801f35444b66e01ceece28c67b5355ef13c6c901f4fac6c04e273555b7e
MD5 45c7a97ec0de4b08de76ba9160e899ca
SHA1 0e6299bf3f8cd9b7abfbe35c8d5c13ca6e9951db
SHA512 3ed5b2e1fbe3ccef8876b367b5750f9abe6f2a8252002f9ccd7493d2ff0666794932f03ec715f8e1f252d580f59f5e67f9ba6b064994fb48a8b230229a6050c6
TLSH
T100E05E282BE8971BF0E252796AF08A52AB64FAA27502CF0842E0160E1C30F401C25A6D
MD5 SHA1 SHA512 TLSH

Submit Download

FileManager.dll

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\FileManager.dll
Size 19.9MB
SHA256 a9b14532355e26af06eda08f9f3edd1d2e84cea096f539f839e95f258d9d493d
MD5 1f4e46b845373eef7cd0d4cf19669a28
SHA1 5d99be897bd1d35028838b3af82de6bf4d07f59e
SHA512 150f927733d58c7721c23425a0c62fc849b09e34c707fbd4672807dda11af0db4ea0b2a55f54ca2c47e4a0e11a379560167a78a5541a089557d408025092224b
SSDEEP 196608:nmCrEXOTtU5KvyT+Pp+M/ajDDUKFdu9CwJsv6tJHy:nmC4OxU5Uj+MiUKFdu9CwJsv6tU
TLSH
T1BC277C27A3E91189E4BAD1799B579A26FB713809033466CF029067292E37FF45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveCrashHandler.exe

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveCrashHandler.exe
Size 826KB
SHA256 fdb9ba099fd465bfcd623a4547050fce45e60e71c6bc39a064d65bae01b7472b
MD5 41ab22e13e6beffa7f413a6b09b9abdb
SHA1 7bc568ffa72bfd7fed3dd635d85e84bbd09b6853
SHA512 cdff1fa978d4b00501d75feb66e945e76ddec02af1ba40ef52705565814dec86e220e9d45ecffeff905efe27ca7379c408ca45d57ab799bfd6ccc1630008ef3b
SSDEEP 24576:a6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji34:a6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmaZ
TLSH
T1C6056D5BB77801F9C177D138D643A907E6B6740B43B09BDB13A042AA2F13AD4AE7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveProcessChecker.exe

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveProcessChecker.exe
Size 537KB
SHA256 1e2375ad4de96a68a1f259fc49207a6d3e9e6fd0e88839e11b30b35941ba024a
MD5 633c551a927dbc6a7cd3265c9b7b53b5
SHA1 d0f469f9ec9f03fc5f181cba33ee499d494ea046
SHA512 649436354b465bac40cc2ad5dd51e73bc12e811b5ec4b3fe7733a11d8f1d7a0b408ddb434f2d706c3a3dc09996e7f54f6aed2794d0382757938cc74739645cb5
SSDEEP 12288:whBk685Y4nJCtSMB1eGbnA0e/UX3GX+hH71efDVhqCKxZNJwup6oX9:++/F8CKxNwup6M9
TLSH
T1A6C48D59A39842F4F167A13888865606E7B17C56236186CF43F0A67A1F377F26E3F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveService.exe

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\GoToResolveService.exe
Size 537KB
SHA256 654cc2f884dbbc1f3da4fb505b2657c939a373132b740e388f3c8651e4c0cf9e
MD5 be6f98c9c732080f6801670f33711a9c
SHA1 03ee7189d9645c4238fb086b85eb2bfd7a7f94bd
SHA512 e12c369512177d1d07aeebb1137ddc1f9be7e6f88ae857f89ee0e58bba71fe1673ec72dfc5fa2a35d8a8c5180d99bef3c98c4db4b68b166c500c65aa67dcc562
SSDEEP 12288:unfk6s5Y4nJCtSMB1eGbnA0e/Un0GX+h871ePDdZqCKxZNJwW5Fo29:ig/VkCKxNwW5F99
TLSH
T11DC48D59A39C42F4F167A13888865606E7B17C56236186CF43F0A67A1F377F26E3B360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibGoToResolve.dll

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\LibGoToResolve.dll
Size 30.9MB
SHA256 022c445373754509e55fa82254e69dab73ca0de65a3595cf30e571a7c651c278
MD5 82b52b5b3a2e3d5a8a9c4c108b65895b
SHA1 45ab7ac9644a3f292aad495e8ad3e54d8448a658
SHA512 323973f0ad80b31adede6aaa69ab4c11139f3026d61e0de91082aeab94944ef29367baece1c24ca3b155b5bfab2db52734d1f78046f31eb23c00f60432ad2038
SSDEEP 393216:fCpwmlVSOv89YZo7yJp6EGPQfVb3p8Lb8/3LYCQW3KQiKFdu9CwJsv6tZp1ogX2n:fCpwAVS1Gh1JYLIcCf3KQ4p1oXL
TLSH
T17E679D0762E501D8C5BAD0BCCB578A0BEBB174051335A7EB15A496AA2F33BF1593F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MediaClientLib.dll

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\MediaClientLib.dll
Size 19.0MB
SHA256 99d72b74b7b8fba07cf3ee871c9dc43a982c545fa1ea54788ba74cb172dc17e6
MD5 18d5334e8d19ed7da52a865b25dcf50f
SHA1 0d5c80d689d1fda409be98214f04ebe9379b18c7
SHA512 4247261e7dae76c438ce6cb3367663b4684384ec349fb91e9c46bd0ba678b126a09b50ace79d8a1c2c92692d47c471da64a64ab74826ea40a5e4be52c7a56d46
SSDEEP 393216:uEQL4c3gMb/o8owkOjBWe4e1vaRp45lph5AaZKTnqF5eMT:KkOd8DMT
TLSH
T16C177E4BE29350E8D41BD474976BAA22FA24384E476469EB17D08B303E77BD07B39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PasswordPrivacyDll.dll

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\PasswordPrivacyDll.dll
Size 3.5MB
SHA256 577c31f91d636eccc59f7e0f72f7f3e28aded2bd00e4b415b6e12b43891988fc
MD5 a5f824ed829a1221b626be596660e170
SHA1 06d9c81cba1af43317335bab46436e115d343b33
SHA512 a751d550c25275b5634c573690deeddf048a1e664a12859899f59c689a26ede897f5c51e475fa4e60443aada307f8891df62af33fb8021d411b38bc03cb17513
SSDEEP 49152:dGtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvmA:TS+ZC+b65hmMorxeNNL
TLSH
T1EFF59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveProcessChecker.log

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\appdata\GoToResolveProcessChecker.log
Size 7KB
SHA256 f0e79daedf920510cfac54050a0e63866f6080f64d3f4186a3a35860f2a7947a
MD5 1a721c02dac260b9ac73783aafd80afe
SHA1 5f2d25a446071a6f6beeea9f919a86a6f8f588f1
SHA512 bd9f648d1e90e792a0787a970aa781f669eea601ae456eec94d35da03e8507e168811ebc0358a08a950c0c1359f3b0496c6ab3c39315a9bed2d3d0dfc2dede21
SSDEEP 96:oVBwHSr57gDjiCNHZd1hCNHhSSfTZH/r57gDjiCNHZd1hCNHRrqG:6SS17ZCFZd3CFhSSl/17ZCFZd3CFRP
TLSH
T1A6F158590FED3CB71B61A6AEAE4B09DE91B164085CD5F870DB84B84605CFF2973C3264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\libcrypto-3-x64.dll
Size 5.8MB
SHA256 149493927ef9c9000d8275055e4065f75c94e59a1ca72de48077a55af25219b5
MD5 b29cb0afd3ad510c8078f652c06cff69
SHA1 5774fde89965f1e3ca057d17cf3dd87f24373213
SHA512 ddaf02f17b88c53514ca30897cefb48f02e75bfff38bd866d8746908a919d2d007da2baf18c22076a901ea61b31a167f487a09926dca6ec840da89e96a9d07cb
SSDEEP 98304:3D+MvNWXWHmW4CY5C1DnaRXQScEPsMBf1CPwDvt3uFlDCrsJ:zV1MWHmWHDnalQScEEMBf1CPwDvt3uFr
TLSH
T1F2567B6AB7A81149E0BAD13CC6574A23D6B1F81647B093CF09A596B90F33FD92B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\libssl-3-x64.dll
Size 1.4MB
SHA256 c1ae87afb03e73925c2770300034a12b80dc9da1951d6d4f2f9e3a504bb3e4e7
MD5 3dda268db5eb70c445cc9d3e3217ef6e
SHA1 7a9b59a4fb0cd9d2d2dd5bdbc9b71206bbeb6bb2
SHA512 ee876d4fe141bb8be9a721a57fbcb10f81eec194a69c4f297490d76dab6d38f8d046c187879489e6b08c18bbbc0605f926730d8cc0f5cf80e6a292e9547faa24
SSDEEP 12288:Xu4n171QPhXS4txeYzIDrJHNF69nxV93qb8b41SPERTvG1s6Fe9XbS:XuO7OhXS3hNF69nxVGu41ScRK1Fe9XbS
TLSH
T1D4658D6973A80599E5B7D13DCA838F17E6B2F4151730E7CB06A08A791F23BD81A3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mandatory.json

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\mandatory.json
Size 896B
SHA256 7a85a1f360915d043b25d48c0197b70d814ff2f548091173d5c30fb11c0287be
MD5 922cbf101a03b162f0aaa0f377218f2e
SHA1 87356737c2dc1e277a74fbdc04f1daf121f432b8
SHA512 d2d5affcb4efd6910a3c446c78d044327dbf04e91c1906748d2b11f7eccc5a41cc52cc5e1c94e4ca5563d81482a8f85345b0258fd094a179e5798ceba2307809
TLSH
T13011CC91DC996E7A1F0096C9A823610972314A571EC4F0F6BB41095F0F4FFAF32B51AC
MD5 SHA1 SHA512 TLSH

Submit Download

params.json

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\params.json
Size 755B
SHA256 088acfae12d7229390ad1c17fb58865632e8af392db30925b2a061fc86df8e1d
MD5 da5cf85e22b6fc5bd5753008342ce4d0
SHA1 06844473daf29aefc43193205e220e878fa0a068
SHA512 2cae085311250ceea59e5e95136f1d4501eb4ce2c2588a59ca4d4b81d69af0134a6c209c530679a1cb418ce6371d8275a28d1f78330a977c1a7356ffbd4c103a
TLSH
T13D016DA60EE930784B00FFC9A85B540EE1758C429AC8F5F566581E2B0693AD331991A8
MD5 SHA1 SHA512 TLSH

Submit Download

params.json

Path C:\Users\Admin\AppData\Local\GoTo Resolve Applet\LeaveBehindApplet\649983349027111485\params.json
Size 1KB
SHA256 fda4a98eb415dab8c7a65bd31a65c13b8fb50091b80830e7969f5d4034205e50
MD5 5c8a11167ad62b892e237b132f05fc99
SHA1 a403ac72bc4829b7815982c86241cb79e9be673e
SHA512 230bd9b1ab51a47287b542eec97ed26a8877f44692aa854fa6841b9f97ff683cef539df99ef1a5b2410a73205e6b7c9e9c328e34316fff2e3cf2e02df5c6b649
TLSH
T1C421C0A1DC542D770B00A9D5B867520AB231CA570EC4F5A5B744195E0F8FEAF31F52AC
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe.cmd

Path C:\Users\Admin\AppData\Local\Temp\2026-05-19_910079df50503082fb84194e742d6aef_akira_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe.cmd
Size 537B
SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
TLSH
T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2164-161-0x0000021A61ED0000-0x0000021A63E17000-memory.dmp

Download

memory/2164-179-0x0000021A61ED0000-0x0000021A63E17000-memory.dmp

Download

memory/2164-178-0x0000021A608C0000-0x0000021A61CC4000-memory.dmp

Download

memory/2164-174-0x0000021A608C0000-0x0000021A61CC4000-memory.dmp

Download

memory/2164-160-0x0000021A608C0000-0x0000021A61CC4000-memory.dmp

Download

memory/3588-148-0x0000018910700000-0x0000018911B04000-memory.dmp

Download

memory/3588-149-0x0000018911B10000-0x0000018913A57000-memory.dmp

Download

memory/4852-152-0x0000022A263C0000-0x0000022A277C4000-memory.dmp

Download

memory/4852-153-0x0000022A277D0000-0x0000022A29717000-memory.dmp

Download