24bc1eab602d600ef8ae3c224813abf9b211fa1c4818a0a1325e9569024c189d

Analysis

max time kernel
300s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Official_Invitation_Record_20264864847548.vbs
Size 5KB
Sample260527-vb61vsfs6s
SHA256 24bc1eab602d600ef8ae3c224813abf9b211fa1c4818a0a1325e9569024c189d
MD5 5ab200dfca01b17bf78dbcabfa6a2e78
SHA1 9b302bfb5b54ae738333c1866ab23730653230ef
SHA512 09baccbc69c37145bb770ed26b52ac42ef17b8b100076b7ce5cb1e5a090ed8c84cc5bd0fa1ca0b8ba977fe99b0354abe0ad86d00b788ce669e0efc77934fd4e3
SSDEEP 96:BZi5BiAcnDShChZ8D8bHB+lAFPwE6ARu5EzADd0tJhNV0Nyjjkg/x28/s21Roc:65BiAcAaDDB+lKYGlzIepN2NYl/x28/h
TLSH
T1B7C1993FDC0F55B2A63746A3D4636C58EFF11623106604A5BE0C8AE01F7C59EA9B56CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution persistence rat

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
98	792	powershell.exe
137	4792	msiexec.exe
138	4792	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
792	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
900	unattended-updater.exe
1564	GoToResolveUnattended.exe
8	GoToResolveTools64.exe
3660	GoToResolveCrashHandler.exe
5076	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
2872	GoToResolveCrashHandler.exe

GoToResolve remote administration tool 1 IoCs

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x001900000002b568-760.dat	rat_gotoresolve

Loads dropped DLL 27 IoCs

pid	Process
1096	MsiExec.exe
1096	MsiExec.exe
8	GoToResolveTools64.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
1564	GoToResolveUnattended.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
5076	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveProcessChecker.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\g2rvdd.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\SET4C82.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ddafac63f34fa55b\rdpidd.PNF	GoToResolveTools64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	GoToResolveUnattended.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\SET4C71.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\SET4C82.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_346f3764318c1681\vrd.PNF	GoToResolveTools64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645	GoToResolveUnattended.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	GoToResolveUnattended.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\g2rvdd.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_2a9c012705b571c0\displayoverride.PNF	GoToResolveTools64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645	GoToResolveUnattended.exe
File created	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\SET4C70.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\SET4C71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\g2rvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_38452bb97e6ec2c3\wvmbusvideo.PNF	GoToResolveTools64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_afb8b1a6452c68d5\virtualdisplayadapter.PNF	GoToResolveTools64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_3ae9c622a9f0ce68\c_display.PNF	GoToResolveTools64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\SET4C70.tmp	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\Tencent-RapidJSON.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnattendedRemover.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveNetworkChecker.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMIInputHook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveServiceManager.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe	msiexec.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMIscrhook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x86\g2rvdd.cat	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x86\g2rvdd.inf	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x64\g2rvdd.cat	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\chromium-crashpad.txt	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json.tmp	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveLoggerProcess.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x86\g2rvdd.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\libjingle.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\openssl-openssl.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\libssl-3-x64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnlock64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveTerminal.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\CrashReportDB\metadata	GoToResolveCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\GoToResolveUnattended.log	GoToResolveUnattended.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMIInputHook32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMISupport7x64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\Thalhammer-jwt-cpp.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveRemoteControl.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnattended.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\GoToResolveProcessChecker.log	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\MediaClientLib.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\PasswordPrivacyDll.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveExternalModuleHandler.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\FileManager.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\google-flatbuffers.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUi.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveRegistryEditor.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x64\g2rvdd.inf	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\mandatory.json.tmp	GoToResolveUnattended.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\pc.json.tmp	GoToResolveProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\microsoft-gsl.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMIFilterHook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveCrashHandler.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveTools64.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\WebRTC.txt	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\ProcessCheckerCrashReportDB\metadata	GoToResolveCrashHandler.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveService.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMIFilterHook32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMISupportM32.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\licenses\gabime-spdlog.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\CrashReportDB\settings.dat	GoToResolveTools64.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\GoToResolveProcessChecker.log	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\legacy.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\libcrypto-3-x64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x64\g2rvdd.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveProcessChecker.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnattendedUi.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMISupport7x32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LMISupportM64.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveTools32.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveFileManager.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json.tmp	GoToResolveUnattended.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToResolveProcessChecker.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2726.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7D305B5422CB46ED.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F0E4B20F10B3A4E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5BF2781467DB8580.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF5DBC275F8EA5DD9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5921d6.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B4D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5921da.msi	msiexec.exe
File created	C:\Windows\Installer\{C58446FA-0DC7-459D-98E2-14C4ECB1F4E8}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GoToResolveTools64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Installer\e5921d6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B9C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C58446FA-0DC7-459D-98E2-14C4ECB1F4E8}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{C58446FA-0DC7-459D-98E2-14C4ECB1F4E8}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3788	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4380	msedge.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GoToResolveTools64.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveProcessChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveProcessChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveProcessChecker.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3696	timeout.exe
756	timeout.exe
1216	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToResolveUnattended.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GoToResolveUnattended.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134243742078051118"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{AC2AE1B4-ECCC-4F77-B2FA-33EE691D1919}	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\Version = "18939904"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList\PackageName = "paperlessvitssetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\ProductName = "LogMeIn Resolve Unattended"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\AF64485C7CD0D954892E414CCE1B4F8E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF64485C7CD0D954892E414CCE1B4F8E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\PackageCode = "DD91203985DB3B046BED4457FF5DCCF4"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\ProductIcon = "C:\\Windows\\Installer\\{C58446FA-0DC7-459D-98E2-14C4ECB1F4E8}\\ProductIcon"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF64485C7CD0D954892E414CCE1B4F8E\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF64485C7CD0D954892E414CCE1B4F8E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
792	powershell.exe
792	powershell.exe
4792	msiexec.exe
4792	msiexec.exe
900	unattended-updater.exe
900	unattended-updater.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe
3948	GoToResolveProcessChecker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	powershell.exe
Token: SeShutdownPrivilege	4060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4060	msiexec.exe
Token: SeSecurityPrivilege	4792	msiexec.exe
Token: SeCreateTokenPrivilege	4060	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4060	msiexec.exe
Token: SeLockMemoryPrivilege	4060	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4060	msiexec.exe
Token: SeMachineAccountPrivilege	4060	msiexec.exe
Token: SeTcbPrivilege	4060	msiexec.exe
Token: SeSecurityPrivilege	4060	msiexec.exe
Token: SeTakeOwnershipPrivilege	4060	msiexec.exe
Token: SeLoadDriverPrivilege	4060	msiexec.exe
Token: SeSystemProfilePrivilege	4060	msiexec.exe
Token: SeSystemtimePrivilege	4060	msiexec.exe
Token: SeProfSingleProcessPrivilege	4060	msiexec.exe
Token: SeIncBasePriorityPrivilege	4060	msiexec.exe
Token: SeCreatePagefilePrivilege	4060	msiexec.exe
Token: SeCreatePermanentPrivilege	4060	msiexec.exe
Token: SeBackupPrivilege	4060	msiexec.exe
Token: SeRestorePrivilege	4060	msiexec.exe
Token: SeShutdownPrivilege	4060	msiexec.exe
Token: SeDebugPrivilege	4060	msiexec.exe
Token: SeAuditPrivilege	4060	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4060	msiexec.exe
Token: SeChangeNotifyPrivilege	4060	msiexec.exe
Token: SeRemoteShutdownPrivilege	4060	msiexec.exe
Token: SeUndockPrivilege	4060	msiexec.exe
Token: SeSyncAgentPrivilege	4060	msiexec.exe
Token: SeEnableDelegationPrivilege	4060	msiexec.exe
Token: SeManageVolumePrivilege	4060	msiexec.exe
Token: SeImpersonatePrivilege	4060	msiexec.exe
Token: SeCreateGlobalPrivilege	4060	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe
Token: SeTakeOwnershipPrivilege	4792	msiexec.exe
Token: SeRestorePrivilege	4792	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2460	1708	WScript.exe	80
PID 2460 wrote to memory of 4816	2460	wscript.exe	81
PID 4816 wrote to memory of 3692	4816	msedge.exe	82
PID 4816 wrote to memory of 4380	4816	msedge.exe	83
PID 4816 wrote to memory of 2704	4816	msedge.exe	84
PID 4816 wrote to memory of 2704	4816	msedge.exe	84
PID 4816 wrote to memory of 2704	4816	msedge.exe	84
PID 4816 wrote to memory of 2640	4816	msedge.exe	86
PID 4816 wrote to memory of 2640	4816	msedge.exe	86
PID 4816 wrote to memory of 2228	4816	msedge.exe	88
PID 4816 wrote to memory of 2228	4816	msedge.exe	88
PID 4816 wrote to memory of 2228	4816	msedge.exe	88
PID 4816 wrote to memory of 2576	4816	msedge.exe	87
PID 4816 wrote to memory of 2576	4816	msedge.exe	87
PID 4816 wrote to memory of 2576	4816	msedge.exe	87
PID 4816 wrote to memory of 1528	4816	msedge.exe	89
PID 4816 wrote to memory of 2372	4816	msedge.exe	90
PID 4816 wrote to memory of 1528	4816	msedge.exe	89
PID 4816 wrote to memory of 1528	4816	msedge.exe	89
PID 4816 wrote to memory of 1372	4816	msedge.exe	91
PID 4816 wrote to memory of 2372	4816	msedge.exe	90
PID 4816 wrote to memory of 2372	4816	msedge.exe	90
PID 4816 wrote to memory of 1372	4816	msedge.exe	91
PID 4816 wrote to memory of 1372	4816	msedge.exe	91
PID 4816 wrote to memory of 2536	4816	msedge.exe	92
PID 4816 wrote to memory of 2536	4816	msedge.exe	92
PID 4816 wrote to memory of 2536	4816	msedge.exe	92
PID 4816 wrote to memory of 4596	4816	msedge.exe	94
PID 4816 wrote to memory of 4596	4816	msedge.exe	94
PID 2460 wrote to memory of 792	2460	wscript.exe	95
PID 4816 wrote to memory of 4488	4816	msedge.exe	97
PID 4816 wrote to memory of 4488	4816	msedge.exe	97
PID 4816 wrote to memory of 2604	4816	msedge.exe	99
PID 4816 wrote to memory of 4548	4816	msedge.exe	100
PID 4816 wrote to memory of 2604	4816	msedge.exe	99
PID 4816 wrote to memory of 4548	4816	msedge.exe	100
PID 4816 wrote to memory of 2412	4816	msedge.exe	102
PID 4816 wrote to memory of 3188	4816	msedge.exe	103
PID 2412 wrote to memory of 1332	2412	msedge.exe	104
PID 4816 wrote to memory of 756	4816	msedge.exe	105
PID 4816 wrote to memory of 756	4816	msedge.exe	105
PID 4816 wrote to memory of 4616	4816	msedge.exe	106
PID 4816 wrote to memory of 4616	4816	msedge.exe	106
PID 4816 wrote to memory of 724	4816	msedge.exe	107
PID 4816 wrote to memory of 724	4816	msedge.exe	107
PID 4816 wrote to memory of 4060	4816	msedge.exe	108
PID 4816 wrote to memory of 4060	4816	msedge.exe	108
PID 4816 wrote to memory of 3128	4816	msedge.exe	109
PID 4816 wrote to memory of 3128	4816	msedge.exe	109
PID 4816 wrote to memory of 1276	4816	msedge.exe	110
PID 4816 wrote to memory of 1220	4816	msedge.exe	111
PID 4816 wrote to memory of 1364	4816	msedge.exe	112
PID 4816 wrote to memory of 4244	4816	msedge.exe	113
PID 4816 wrote to memory of 4244	4816	msedge.exe	113
PID 2460 wrote to memory of 4060	2460	wscript.exe	117
PID 4792 wrote to memory of 1096	4792	msiexec.exe	119
PID 4792 wrote to memory of 900	4792	msiexec.exe	120
PID 900 wrote to memory of 1564	900	unattended-updater.exe	121
PID 900 wrote to memory of 8	900	unattended-updater.exe	122
PID 900 wrote to memory of 4728	900	unattended-updater.exe	123
PID 8 wrote to memory of 3660	8	GoToResolveTools64.exe	125
PID 4728 wrote to memory of 3696	4728	cmd.exe	126
PID 4208 wrote to memory of 1712	4208	svchost.exe	128
PID 4816 wrote to memory of 5116	4816	msedge.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Official_Invitation_Record_20264864847548.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Official_Invitation_Record_20264864847548.vbs" /elevated
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paperlesspost.com/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fffdfc4c188,0x7fffdfc4c194,0x7fffdfc4c1a0
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,4031714402912953272,10121175929003345891,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6449652904397044805,3665300227951682662,262144 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,14435854640218859565,10726465082408510054,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15776379777037137670,5292115938657163773,2097152 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,15574149800891743792,10251818592481550134,2097152 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,16396406442304229103,983031046882928601,2097152 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,17368196952335998352,1022665015823086494,2097152 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4356,i,16754249886345443973,1665836074440981102,2097152 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4380,i,10100175628437039681,4944424726319840282,2097152 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,6060677741713101753,595185359304676422,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,1103109579183931354,8996491966780817594,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6543449619939889283,14950130643065400473,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,639110992487631020,7295979565196365382,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2772023712679977524,15725853627002683289,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
      4⤵
      PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,9973460319189638054,768710484888916850,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2772023712679977524,15725853627002683289,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,10310556436366957513,7550465791602272077,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,5213564380746319373,17558590706869176353,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,14281754177033298309,10122418242071244247,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11333423951201018387,2812991886789356018,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,3151700771784775648,2137377423500174297,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,7913649842455965780,15053642300100847664,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,17709011659236815912,12253087407939851196,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,2739584787070469355,16773962490268522092,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,6722737502262209924,18280459605635446059,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,2569439897875018493,7563691994607860421,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4824,i,10562858691646956099,830335397087003606,262144 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:10
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16506477660487637118,8506274729202545603,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,12328975670171415648,16472217663917353278,524288 --field-trial-handle=2172,i,14099229986921114760,3696587889789234042,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "Invoke-WebRequest -Uri 'https://ebertnetcom.com/agency/LogMeInResolve_Unattended.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\paperlessvitssetup.msi'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\paperlessvitssetup.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5072

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DFF979B15B79A7B1D62DA884042AC80D
  2⤵
  - Loads dropped DLL
  PID:1096
- C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
  "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\paperlessvitssetup.msi" "-MsiInstanceGuid" "{C58446FA-0DC7-459D-98E2-14C4ECB1F4E8}" "-MsiUiLevel" "2"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnattended.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\paperlessvitssetup.msi" "-MsiInstanceGuid" "{C58446FA-0DC7-459D-98E2-14C4ECB1F4E8}" "-MsiUiLevel" "2" "-installerFileName" "paperlessvitssetup.msi"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    PID:1564
  - - C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveProcessChecker.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 1564 -InstallationId y3P7sQ4EjZ -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416" -ApplicationType 4 -Environment "Production" -ForceInstall 0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      Checks processor information in registry
      Modifies data under HKEY_USERS
      PID:5076
- - C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveTools64.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveTools64.exe" -InstallVDD
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveCrashHandler.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=91214de46368872f509ee809d0c08198 --annotation=format=minidump --annotation=hostname=Ggmlpskm --annotation=platform=win --annotation=version=1.27.1.1320 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\externalmodulehandler.json" --initial-client-data=0x344,0x348,0x34c,0x340,0x350,0x7ff6c819f8a8,0x7ff6c819f8c0,0x7ff6c819f8d8
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\timeout.exe
      timeout /T 3
      4⤵
      Delays execution with timeout.exe
      PID:3696
  - - C:\Windows\system32\timeout.exe
      timeout /T 3
      4⤵
      Delays execution with timeout.exe
      PID:756
  - - C:\Windows\system32\timeout.exe
      timeout /T 3
      4⤵
      Delays execution with timeout.exe
      PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x64\g2rvdd.inf" "9" "494110323" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1712

C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveProcessChecker.exe
"C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416" -ApplicationType "4"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3948
- C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveCrashHandler.exe
  "C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=4874518131362028416 --annotation=component=Unattended --annotation=computerid=91214de46368872f509ee809d0c08198 --annotation=format=minidump --annotation=hostname=Ggmlpskm --annotation=installationid=y3P7sQ4EjZ --annotation=platform=win --annotation=version=1.33.0.2326 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\externalmodulehandler.json" --initial-client-data=0x5b0,0x594,0x5a4,0x790,0x578,0x7fffc5784e30,0x7fffc5784e48,0x7fffc5784e60
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2872

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe
1⤵
- Launches sc.exe
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5921d9.rbs

Path C:\Config.Msi\e5921d9.rbs
Size 7KB
SHA256 fb5799ebd940b8b1df8067737e0e906a0a40063db928f0df9f408cc5adb0beef
MD5 bf84fc2129fe9ca1fad072ead523cb1d
SHA1 699fa57cdc59bd5a50bc2c8d07ef03bbb0203bbd
SHA512 fce9662c00551519672e447360331b9e17087a80904b27096bde0e16eb096d153cbf146c2e576988f5ce4b152f411e7a1b0e959b5fe3ef4a2acba4009f667418
SSDEEP 192:xl0CxqNfCeGACe+mgUjZvYLi9pC1wpNQcZH+5W0J:xlZqdC2CnmgOFYLi9pC0QcZH+5W0J
TLSH
T101F1EE41B20482E2FEAA6739C71717513FB2D3A95314274B4CDDA4B45F6378C2F98A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2rvdd.dll

Path C:\PROGRA~2\GOTORE~1\487451~1\x64\g2rvdd.dll
Size 141KB
SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
MD5 e00f914a13981678cc130f7c65807f03
SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
TLSH
T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileManager.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\FileManager.dll
Size 19.9MB
SHA256 a9b14532355e26af06eda08f9f3edd1d2e84cea096f539f839e95f258d9d493d
MD5 1f4e46b845373eef7cd0d4cf19669a28
SHA1 5d99be897bd1d35028838b3af82de6bf4d07f59e
SHA512 150f927733d58c7721c23425a0c62fc849b09e34c707fbd4672807dda11af0db4ea0b2a55f54ca2c47e4a0e11a379560167a78a5541a089557d408025092224b
SSDEEP 196608:nmCrEXOTtU5KvyT+Pp+M/ajDDUKFdu9CwJsv6tJHy:nmC4OxU5Uj+MiUKFdu9CwJsv6tU
TLSH
T1BC277C27A3E91189E4BAD1799B579A26FB713809033466CF029067292E37FF45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveCrashHandler.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveCrashHandler.exe
Size 826KB
SHA256 fdb9ba099fd465bfcd623a4547050fce45e60e71c6bc39a064d65bae01b7472b
MD5 41ab22e13e6beffa7f413a6b09b9abdb
SHA1 7bc568ffa72bfd7fed3dd635d85e84bbd09b6853
SHA512 cdff1fa978d4b00501d75feb66e945e76ddec02af1ba40ef52705565814dec86e220e9d45ecffeff905efe27ca7379c408ca45d57ab799bfd6ccc1630008ef3b
SSDEEP 24576:a6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji34:a6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmaZ
TLSH
T1C6056D5BB77801F9C177D138D643A907E6B6740B43B09BDB13A042AA2F13AD4AE7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveProcessChecker.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveProcessChecker.exe
Size 537KB
SHA256 1e2375ad4de96a68a1f259fc49207a6d3e9e6fd0e88839e11b30b35941ba024a
MD5 633c551a927dbc6a7cd3265c9b7b53b5
SHA1 d0f469f9ec9f03fc5f181cba33ee499d494ea046
SHA512 649436354b465bac40cc2ad5dd51e73bc12e811b5ec4b3fe7733a11d8f1d7a0b408ddb434f2d706c3a3dc09996e7f54f6aed2794d0382757938cc74739645cb5
SSDEEP 12288:whBk685Y4nJCtSMB1eGbnA0e/UX3GX+hH71efDVhqCKxZNJwup6oX9:++/F8CKxNwup6M9
TLSH
T1A6C48D59A39842F4F167A13888865606E7B17C56236186CF43F0A67A1F377F26E3F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveTools64.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveTools64.exe
Size 1.3MB
SHA256 28077c3e164d2cbefc51ca668e16721819fe64cbd054df3dfd9fcd0d68bf4649
MD5 13ef79d70526f53e04622f488d9d19e5
SHA1 9a6267635535b6a12dcb82aa0157f5f748b6e7d3
SHA512 445891cfba83bec2e1b0717600854aeb956bae3c945a30df29bb8cf5b88f11bbc2556defcade79063a1ec6b004f61eff39e96b192d3c5dfea896960899c811f0
SSDEEP 24576:UPJ9T605srQiAfXFOmesUvLTTQlxwF2UM6eXzbaOCFL2KFhH4zx:297LiAfXFasUTTTuxA21X/aO4hH4V
TLSH
T109558D1B62AC41F8D0BFE17C8946890AE7B1780643729BEF13A8475A1F276E15F7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveUnattended.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\GoToResolveUnattended.exe
Size 538KB
SHA256 07ef2a4ea325967ad2e48f2dfc9e983b682bbc1b1cea8584fcbdf05ed9859967
MD5 c39b64527103623686b8daaea74243a8
SHA1 1173ac26b8076ff2941f82ab6ff9f07e465116e1
SHA512 9bf1d868046bc670ac78878cfd4a7984ab117dd67f39102fdc2759b41254275b88b13a018b1fd55d67c83ada0c8f7e6757a5a6f2e702499a5463411b82aa6252
SSDEEP 12288:ofik6s5Y4nJCtSMB1eGbnA0e/Un0GX+hE71ePDVhqCKxZNJwW5yoD9:on/V8CKxNwW5yw9
TLSH
T1B4C48D59A39842F4F167A13888865606E7B17C56236186CF43F0A67A1F377F26E3F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibGoToResolve.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\LibGoToResolve.dll
Size 30.9MB
SHA256 022c445373754509e55fa82254e69dab73ca0de65a3595cf30e571a7c651c278
MD5 82b52b5b3a2e3d5a8a9c4c108b65895b
SHA1 45ab7ac9644a3f292aad495e8ad3e54d8448a658
SHA512 323973f0ad80b31adede6aaa69ab4c11139f3026d61e0de91082aeab94944ef29367baece1c24ca3b155b5bfab2db52734d1f78046f31eb23c00f60432ad2038
SSDEEP 393216:fCpwmlVSOv89YZo7yJp6EGPQfVb3p8Lb8/3LYCQW3KQiKFdu9CwJsv6tZp1ogX2n:fCpwAVS1Gh1JYLIcCf3KQ4p1oXL
TLSH
T17E679D0762E501D8C5BAD0BCCB578A0BEBB174051335A7EB15A496AA2F33BF1593F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MediaClientLib.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\MediaClientLib.dll
Size 19.0MB
SHA256 99d72b74b7b8fba07cf3ee871c9dc43a982c545fa1ea54788ba74cb172dc17e6
MD5 18d5334e8d19ed7da52a865b25dcf50f
SHA1 0d5c80d689d1fda409be98214f04ebe9379b18c7
SHA512 4247261e7dae76c438ce6cb3367663b4684384ec349fb91e9c46bd0ba678b126a09b50ace79d8a1c2c92692d47c471da64a64ab74826ea40a5e4be52c7a56d46
SSDEEP 393216:uEQL4c3gMb/o8owkOjBWe4e1vaRp45lph5AaZKTnqF5eMT:KkOd8DMT
TLSH
T16C177E4BE29350E8D41BD474976BAA22FA24384E476469EB17D08B303E77BD07B39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PasswordPrivacyDll.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\PasswordPrivacyDll.dll
Size 3.5MB
SHA256 577c31f91d636eccc59f7e0f72f7f3e28aded2bd00e4b415b6e12b43891988fc
MD5 a5f824ed829a1221b626be596660e170
SHA1 06d9c81cba1af43317335bab46436e115d343b33
SHA512 a751d550c25275b5634c573690deeddf048a1e664a12859899f59c689a26ede897f5c51e475fa4e60443aada307f8891df62af33fb8021d411b38bc03cb17513
SSDEEP 49152:dGtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvmA:TS+ZC+b65hmMorxeNNL
TLSH
T1EFF59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\libcrypto-3-x64.dll
Size 5.8MB
SHA256 149493927ef9c9000d8275055e4065f75c94e59a1ca72de48077a55af25219b5
MD5 b29cb0afd3ad510c8078f652c06cff69
SHA1 5774fde89965f1e3ca057d17cf3dd87f24373213
SHA512 ddaf02f17b88c53514ca30897cefb48f02e75bfff38bd866d8746908a919d2d007da2baf18c22076a901ea61b31a167f487a09926dca6ec840da89e96a9d07cb
SSDEEP 98304:3D+MvNWXWHmW4CY5C1DnaRXQScEPsMBf1CPwDvt3uFlDCrsJ:zV1MWHmWHDnalQScEEMBf1CPwDvt3uFr
TLSH
T1F2567B6AB7A81149E0BAD13CC6574A23D6B1F81647B093CF09A596B90F33FD92B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\libssl-3-x64.dll
Size 1.4MB
SHA256 c1ae87afb03e73925c2770300034a12b80dc9da1951d6d4f2f9e3a504bb3e4e7
MD5 3dda268db5eb70c445cc9d3e3217ef6e
SHA1 7a9b59a4fb0cd9d2d2dd5bdbc9b71206bbeb6bb2
SHA512 ee876d4fe141bb8be9a721a57fbcb10f81eec194a69c4f297490d76dab6d38f8d046c187879489e6b08c18bbbc0605f926730d8cc0f5cf80e6a292e9547faa24
SSDEEP 12288:Xu4n171QPhXS4txeYzIDrJHNF69nxV93qb8b41SPERTvG1s6Fe9XbS:XuO7OhXS3hNF69nxVGu41ScRK1Fe9XbS
TLSH
T1D4658D6973A80599E5B7D13DCA838F17E6B2F4151730E7CB06A08A791F23BD81A3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unattended.json

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json
Size 699B
SHA256 e683b02cf5b81b7e4c021ebc82168685441e70df3d2045b3ffc150bedf000ec3
MD5 42b37aee64f01eed1e590e25a34d51be
SHA1 7925587d92f9f2cc66862aedcfe3f2f00eab621e
SHA512 4f3731d69aad30f5d9247b9f97d39569b8b2f01d69b7daadee6cb97ad42957d26cf3e020deb1769a7ca6ba48cec6496cd2f902ddd1f8e5171380174af01e0ae9
TLSH
T1190170A60EF625380723BDD8CC5D645FD2B54CA524D8B9E2A90D7E1E04D3FE32147478
MD5 SHA1 SHA512 TLSH

Submit Download

unattended.json

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\unattended.json
Size 800B
SHA256 3dc37bdff730d4dfd6401a709e14369e763efee962ce15d99dcc03d8a3d71808
MD5 5a5152a722d4e991fec20c79e05d1116
SHA1 f9b765c92a590ee750473103d56ec395b063bb4e
SHA512 5fdada3474d6f2d5e817521ea92c7ab74517f55600812f5fc0a8f6ba846936b2adb16b5e08ed1ec9a7a209625323367cfc7dc5e4f2224575bc74c6fafdcb3c7a
TLSH
T13E014EA1CDB52D370B1199C4DC65240EA22549B75C98B8E6770C1A1D0FDFEAF31B253D
MD5 SHA1 SHA512 TLSH

Submit Download

g2rvdd.inf

Path C:\Program Files (x86)\GoTo Resolve Unattended\4874518131362028416\x64\g2rvdd.inf
Size 3KB
SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
MD5 79c299099a8f43e1a94047355ebdf1cc
SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
TLSH
T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
MD5 SHA1 SHA512 TLSH

Submit Download

unattended-updater.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
Size 33.6MB
SHA256 8bc2a940508fe6480628a16cf57db82fc70acf2475b18f194071eef77b4ebcee
MD5 29bc85ee6cc7750f373f0774d4ca0d8a
SHA1 578ff81b0b9f489ef98ce06a91fed1f01c6f31c4
SHA512 7bf3d4e0a2ae5b52b3325160667c5d49ab50d49d9eaaadf6b0f3ed545a933fe2d10c2ec88bfe02c8ead5bc505d76cb8fd41158ed499b2a8e5c89f861c620b0dc
SSDEEP 786432:8KaijpvXvoxGg450kvHArz+JR4FXkNnP9:faCfoxvCgrz4R4mF
TLSH
T1A6771217A3E60198D5BAC0788A679547FBB23C0603306BDF12A4A65A5F73AF05E7F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unattended-updater.exe.cmd

Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
Size 537B
SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
TLSH
T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98ade942a8747b838525fab33e985cdad967132f18099e1927edd4ddcf705c
MD5 f204288b44f873d17a6ceedad1591584
SHA1 24474f57edf00bb3bed673ea9c6fbba1c2d5706d
SHA512 218a8f5b6756a36d75649cbf0e80cab71506f3cef44c8b62b5d9685a2a249d10ca13547cc8a461116e8dbf2c2b9cddc73426ef41d645a31b93a43585aab2d6c6
TLSH
T169D09B30F7995053D1411131DC915F506655499528AB86815331444CE959094E3D7146
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 97f833705836c3d59a745b5af832794b145a017560c75f927ded539f268ccb70
MD5 b508eefa91f5be03639b0e73cc153160
SHA1 ce3ca26f25027620b3cfc2e4d07245a7f1c7e7f0
SHA512 ed6f9a23466e7e97fe26efe9b9fe4429cf02408abf78160231a1ac01e3ea809293daf0521b9105fd3182d702e0b2d1c9a6d2632bb7ad2a077f73f74b95780a7b
TLSH
T1F881FB010262FC5BDB910D334CE30A0A7B7A8046094F6F964E5B6835AE3AB51F247FF6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 670580a6fb9f397070207ae7f366c0a499283c9cfc8d4cc6cdeabcf063424f41
MD5 8eedea3c4954921fe1aab8c61b15a665
SHA1 d7554f6e89efa83863480ba9a8393d460cea57cc
SHA512 8d65a221d73aa78db75679c62b138ba306f475fa2d69c3a4bd1786c86daf9f10328e93d3ca7278179de7ce2374039f28e35a855bc31ce67828bf54a3ec7b4185
TLSH
T1587190F7C3E58A6DCE1155F1AA146E27CF6D0510836C3D95C4E8BF0BA3F2461E24198E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eb215f432281ce4668e153f866fa6c571ee15364250fe3253b9054c2c95d79a5
MD5 cf08553100163fa98a856ecb4ed66223
SHA1 1d116edefa75477bc4798cdbaed994311f47527d
SHA512 f1a0e715c74ea87ada062dc42a3076bc8867ecbaecc06b5cc1c7ddc113aa3c1298f3a407477308c36d767427ecc4983ed710e9f7a552c248d39446b25d393bc6
SSDEEP 192:sxZPR5yM/jK1Ml8McL/ftsPFGEiJd6Idpuw/W6+WNLIE/Y0oZeOoOSlIg4J:sxZPh0L/ftstGEKX/b//5NFc
TLSH
T15E52E806BA345977CCDBD209BA55BF53D6F91562A2940D489EFCCB1C01E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9cb10a74bb25a46f4bbbc94aaa570e2a0558323adf6fa1522be5b78d22abc8d3
MD5 31b82c9f758a240458183a763689ab73
SHA1 60d6a094dca5593650805521b585f8fae0915a90
SHA512 83f9529f4d7a254e9246f41f4093b6b4e5993ba9676dd6d688e89bcdf08a8f86a804b31376f0ceb069004afacb7b4bde1060d2b374e96979bdd0c3517fc01bbe
SSDEEP 192:sxZPR5yM/jK1Ml8UQpcL/ftsJFJEiJd6Idpkw/W6+WNL0DJY0oZUDoOSlIg56J:sxZPhq+L/ftsTJEKl/bEJ5fKE
TLSH
T1B262E906BA345977CCDBD209FA51BF53D7F91562A2940D489AFCCB0C01E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e743426088821d96b725ae0d076156f37c869b7ad4be876e32874efe62bbc4ce
MD5 d7c1fcd7f010112aff4a5482a3c27e0e
SHA1 d9f3ecd687c1f66717f2648f4256fbfe9471eca1
SHA512 6b4c645d9933817e900863696396afc3fc15ba871efd4ca98b292bafc5cb56d9b92e88cb72699c63c376f0f1a8b0174da76360e22fe90c97459b28e5a56b3d90
SSDEEP 48:KYbIhKYwkTyVZINKqgQ/ygAHkA6SSuQC51IbBdKica3d2PNhsxb:KYbSKYw6WZ+KqgKWRQK5CV
TLSH
T12A913982B0B712623D7D6559B3B4B7562A42B1733018647F3BA810B19E2BE210DFDEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecb4333c-c1a4-4427-b122-5e54ac761693.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecb4333c-c1a4-4427-b122-5e54ac761693.tmp
Size 36KB
SHA256 46ade283b27dc7df1dcb6ca3300f29b9ddaaf9c1bd986b44a0b8501e889ce7ac
MD5 655f3abce406534288204aa15aca10f9
SHA1 b8e960d2d04fd95e64f2161bc04dd2550484ba98
SHA512 0c3e2587c7d45559b16398f4dd26510e5d239af45ecc2f71d3ea054d3fbd6028d6125a1a98cf979caaa7d0c616502e3d50a91ee0d9c3afe53f69c01d85fd2914
SSDEEP 768:Xpc0s8Ww2tg7pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3YlvOLlL:Xpc0s8Ww2tsEX/fWRm/JQg1u1jaKYlvq
TLSH
T13F030B3B6C4CCB7E4F844E9CED26BE9A6DE8028B6698895447FE440C03C66EB15161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97ac2503-056a-4645-be30-66c877776325.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\97ac2503-056a-4645-be30-66c877776325.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7711c3d56ae636d6477b5f320a9201eebadc1400c460d948c2370db212c9bddf
MD5 d953980def3521a6b3aeb4964f4cfdf6
SHA1 b901092fe66f29ce20dbbfccbcf60ef5350e871e
SHA512 b2a2370a4150cc8e9e10225a758da12580306da18d3f14f5087e5efad757cbf1e4341aca556e389ec37c3048a70da167122d51d06de13b4522260bc1efee0a4f
SSDEEP 384:nJtNnNnb9z8NpEL66UuUu8Yhusy1CuBmVo9dYkPjFk:JjZbhjKCh1yCWmsYkPJk
TLSH
T146926C315C39AD67DEE26609F10A36539F7414ABAD853F84DAEC5F0D00DB69C230AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 f3fa1c7aa6c9643d21002b34404a5b0726c977321ba0d3b9b3cfef672e393875
MD5 a1c5b8a35a4e8c7d974203c8f4b81276
SHA1 aee709941c8b2d339a16000fdd12a7866a8a5641
SHA512 5b49614be81850ce15fcfe4ebd873c22412bda00affef3c7e46532d576435efeee31cc4890d525282c66e4766a565328d4f4e0b9580f3ac8e0f1f782dd31f202
SSDEEP 384:nriF4tNnNnb9I8NL8TUNTUlIlrL6i+tUuqDf0/u8Yhusy1CuHAmVo9dYkPjFk:GF4jZbWKwgt+tr/Ch1yC4AmsYkPJk
TLSH
T166D293F198E79937E9AE4787A33E7D429ABCC15378885984BBD81D0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d95251d1c5e45174c7ecf5295a2b05541203d0516a2b06b204e0087fd2df7d0e
MD5 312c6304bbc61dde43e9e0006fbeb7f1
SHA1 53b95057ce918c8437bf0433b0efa507d0989dfa
SHA512 1066fc0e7a70d6316d8a6ef86da9c9bcf3f6d397430b82b83fad3f195395f0eab50e638cadd4c5954f1c630fc994d1d744c1e393d0bd5f395869b5535a0c4bda
SSDEEP 192:XGN+6jCQmiUyRIkf4SufoPxzY2Sus6f13Sn/z1U6:XGN+6qmDfju8Yhusy1oL1U6
TLSH
T10E02D835AC687C6B9FA36E45FA8737139FA4212BA9952F44CAFC1F1C00D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 158a148b91fd5e6d0aa36b9eb73490118ce323ee22bb59d9d33f281dbec11ff1
MD5 8d7d15d04d05d37b57f65f0342e1df80
SHA1 e5099dfca2e40d41703fe768e621eb4eb4b29c66
SHA512 1a00f0a006aa0db88c72be005ed2388d6ec261090983bce3837359112e1a72f0c1e0c8b5a3b2546d0455f4d27d28e9c279a7a5d5648f8cab3b81fb928317c0c5
SSDEEP 192:XGNU6jYQmiUyOk/4SufoPxzY2Sus6f1XSugYxKOM5/JKU6:XGNU6U4/ju8Yhusy1CuMmU6
TLSH
T1CC12F9759868FC27AEA36554FA8732539FA42137AD856F44DAF81F0C00DB68C330AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f1bee14ebb0024eafbd47d5d959b916a315e4355f8ec2fbebd27256fe665fa1a
MD5 97e99a7163360706f92217ec469ec483
SHA1 fc68a9d2c0b4873e0ade17fd3c8000a98df96930
SHA512 f8c10d757be471f1f69a2a7737c56155d4e1a1f83587984d9b6b7bff411e95f7ff0cf233fc21992a166b6ccc692b0ba5b6478c9b954fd83e2dd0f9e6e84b964f
SSDEEP 384:nQtNnNnb9z8NprL66UuUu8Yhusy1CuBmVo9dYkPjFk:QjZbh4KCh1yCWmsYkPJk
TLSH
T1D6926C315839AD67DEE36605F10A36539F7414ABAD853F44DAEC5F0D00DB69C230AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b330262d255db6ea43f9ef0a7a33c75300261e911d0c00701b4641ba87f29186
MD5 14a45900f23e6f90e5869d123981783d
SHA1 422058dbbd35228b4339f7e3d501655522ad3f25
SHA512 eb507860605f65246941df0018e397859d4c6b84314961362235119a599b0c7109cd30588c6cf50da8c8dfbd3e9d6957418d6713499a6755ef4c0273877c64e5
SSDEEP 384:nriF1tNnNnb9Q8NQ8TUNTUlIlrL4i+tUuqDf0/u8Yhusy1CusmVo9dYkPjFk:GF1jZbujwgf+tr/Ch1yCHmsYkPJk
TLSH
T1ECD2A3F198E79937E9AE4783A33E7D429ABCC15778885984BB981D0CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c6ddb359-7a46-4319-8e4a-c3cd458fd469.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c6ddb359-7a46-4319-8e4a-c3cd458fd469.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

42940904-b0ef-4c0b-9858-c585acce27ed.tmp

Path C:\Users\Admin\AppData\Local\Temp\42940904-b0ef-4c0b-9858-c585acce27ed.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xm5q33kc.jeq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xm5q33kc.jeq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e13906d8-ffc8-4963-8948-10e6df0115cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\e13906d8-ffc8-4963-8948-10e6df0115cd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

paperlessvitssetup.msi

Path C:\Users\Admin\AppData\Local\Temp\paperlessvitssetup.msi
Size 35.4MB
SHA256 b57509b6e9f1e5e7aa37663d7b6288d171ddc4d86dbc80a1e45fc8ecea27a35c
MD5 46f0bf4aa4f9beb548f21b4c7bb94d43
SHA1 03695bce8cff59f2b4e36c50a048880ccf583795
SHA512 b71c69040bb868c602c72d14a90297ebdfc720125b91c78b039cbaa72ec7fdf7e41b6b90f6045457dfbc52b06bc17385ef7fbacf453b8a74cdcac9d900e700b3
SSDEEP 786432:kfBBz66DIpCRkxjRlKjP1UrZ21G7KulNNm:kfBF66iGkxCtyZ2E7KN
TLSH
T1E7872217A2E61154D8BAD138CA6B9647FB723C06433066DF12A4B61A6F73BF01A7F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4816_1756711098\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

668cc993-727d-4b0d-9f0a-9574341e96f6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4816_634336206\668cc993-727d-4b0d-9f0a-9574341e96f6.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbs_debug.log

Path C:\Users\Admin\AppData\Local\Temp\vbs_debug.log
Size 136B
SHA256 6f9eed61f276033388d7934976501e423a2e426a83be9985b3e2cfa46cdc5b18
MD5 ce1ffc724999fc5e0cdd84ba2cce5bb0
SHA1 023a276eff79da26d26bd13be9e5498351893c05
SHA512 9e3f8c812643f90e2f489605716c78e5d2aaf625837b381f85a95b91c695b07557936497940ab3e1b5d610d0224692262333607d259200a69c86d0a3daa4db59
TLSH
T1C7C00C4402DDB445899270B6F9B515C3303151E3415441D87958732555259AAA7CA145
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2726.tmp

Path C:\Windows\Installer\MSI2726.tmp
Size 5.6MB
SHA256 88c6663a1fe9ec375042eb424055ce66bb1405dbf0bd839f5cfc8d61c458ea07
MD5 039fff83a732134bb4a2c35a67c24706
SHA1 0601a887222d9d9e99030278aa6193c2301c5c1d
SHA512 212434499996708e007c4dc1a159659cc5f6a7840d57304c807d31a0dd6dea38196db08491e28a140c379f663efe62be2b8be63c38510cdd57ba07596a7473ac
SSDEEP 49152:cGJ+lqh+k/eDljulYvJ65tYYGtxcYL8+LoAvi65fvJ0L4TNEYTAwGVkBm66irB5x:rcRrfSn66EPKFdu9CwJsv6t+B7oN
TLSH
T1D4568D17A2EA1154D9FAD0788A6B9547FB723C0653306BDF42A0A2166F73BF01A7F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2rvdd.cat

Path C:\Windows\System32\DriverStore\Temp\{2d7e08d2-50ca-6242-afec-1f19189bda6b}\g2rvdd.cat
Size 10KB
SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
MD5 8d2c58325f63af51d37693e7ffbdbc4d
SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
TLSH
T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 46b34be6c31dcaa21d19d6f9de978250879f3fcd6cbeb58431fe8a9fcfc4080c
MD5 f4bb275e16339f91b0649406f71a2854
SHA1 c3518a929ec42e0300fcd94e7e50c57f643bdbdc
SHA512 fee3b1d592c86b1389c7cb2a918e5c39b4de0d40e6b65a08044a78d976fa3ec465e580d16abd73eb8476bc1009926b18494b9027f517e12423a952d6d297aa44
TLSH
T1620110831A66F9147C36594C7AD4842C60D3E53664C7768BFAAE0D084816B3A7F39026
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
Size 727B
SHA256 8cc3558ada831d383c4d1c342fde266a664d2ac9cfeda50fa7a54720bc15d8b7
MD5 336fe353d77af3359d96d64f0e306615
SHA1 75569242bbe8bcd267fe15efa58c690704902591
SHA512 2a4412a4b2b46d447b3358aae12c513e5574d7f308e05fc92493d5c080234c224ac4d4a388428f409f712ec43186e70c69f6d051ce6c2255567c757e85ca0675
TLSH
T11B01441FDBB297C812935B9D9F9C8BB13657C0187B5BBA6D25621697A2047C00813792
MD5 SHA1 SHA512 TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 2915a5a28c22b127231f0a5fbf5173127ea76547741a585512da7f737da887f7
MD5 ccfc4f9f46a2f9e06011c972feccace4
SHA1 3d8f896225e6ba19b8e9e5e8b335aeb07306b65c
SHA512 a098adbfd9dcb92b89208758e24dee4125c3bf2f6407eab75323b06df90d2bb526847db173ce1d3aa089e5c3343519b4173e1577b28042c188e71ec1baecb783
TLSH
T1F1E0262D2EFA007EF3A7CA755FD5FA56A849F2525CA087A71C904A08BA11B144E924B8
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
Size 408B
SHA256 834de85c752f5717a4f0fd230c3b6d20bc87b1768ced082d37b375f24348ade7
MD5 467a2dac63fd803475780cdf41e7d86f
SHA1 6f878d0bb38ac2e90fb8f766b5a10906cf756142
SHA512 3f3c62af9f3800ff29f45e4d93758b0ebad88424737d5a86d799774970e197c423fa756099e52cf5d78d4bda84d8a80fafcd83e6e0851c9479c1936152d1caa5
TLSH
T1CBE0C63832F8016EF1E2E4B842F9AE22789AF2622641C2A600802796FA20B005CD2620
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-683-0x0000023CF8C30000-0x0000023CF8CED000-memory.dmp

Download

memory/792-666-0x0000023CF8C30000-0x0000023CF8CED000-memory.dmp

Download

memory/792-650-0x0000023CF8C30000-0x0000023CF8CED000-memory.dmp

Download

memory/792-47-0x0000023CF92B0000-0x0000023CF92D2000-memory.dmp

Download

memory/792-701-0x0000023CF8C30000-0x0000023CF8CED000-memory.dmp

Download

memory/1564-1008-0x00000276CE290000-0x00000276CE610000-memory.dmp

Download

memory/1564-946-0x00000276CE7C0000-0x00000276CFC2D000-memory.dmp

Download

memory/1564-945-0x00000276CE290000-0x00000276CE610000-memory.dmp

Download

memory/1564-1009-0x00000276CE7C0000-0x00000276CFC2D000-memory.dmp

Download

memory/3948-1016-0x00000229A1630000-0x00000229A19B0000-memory.dmp

Download

memory/3948-1017-0x00000229A1AB0000-0x00000229A2F1D000-memory.dmp

Download

memory/3948-1063-0x00000229A1AB0000-0x00000229A2F1D000-memory.dmp

Download

memory/3948-1068-0x00000229A1630000-0x00000229A19B0000-memory.dmp

Download

memory/3948-1069-0x00000229A1AB0000-0x00000229A2F1D000-memory.dmp

Download

memory/4792-838-0x000001EC73420000-0x000001EC73EE2000-memory.dmp

Download

memory/5076-1004-0x0000022155670000-0x00000221559F0000-memory.dmp

Download

memory/5076-1005-0x0000022155B40000-0x0000022156FAD000-memory.dmp

Download