Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 06:32
Behavioral task
behavioral1
Sample
invitaton.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
invitaton.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target invitaton.exe
- Size 23.3MB
- Sample260729-hapc7san7v
- SHA256 761c11701d6668c52b5e55020a475fde8cd428a5bcb70aeb4c7d10c58249cb09
- MD5 04eb31cc639d6539bf55e13ed3bdd05f
- SHA1 6bb022c49082ea6c07657ad5f6689be0f7b22640
- SHA512 828cd888afa107c2b542c5779563af043d9126166a906a1d2a758a68f7d59b9d410705af58d3e102548e996f68a3235cb13d2fffd7d2c0531be1f7aff6e6e81f
- SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpq:q9WtLzgOTbjZvk/ekS/mcpq
- TLSH T14A37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveQuickView.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x0007000000024689-148.dat rat_gotoresolve - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation GoToResolveUnattended.exe - Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\SET6BC6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\SET6BC6.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content GoToResolveProcessChecker.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232 GoToResolveProcessChecker.exe File opened for modification C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\SET6BB5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\SET6BD6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232 GoToResolveProcessChecker.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\SET6BB5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{66dfada5-2a6d-0449-83ed-8a06a9d58951}\SET6BD6.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveQuickView.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\pc.json.tmp GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedCrashReportDB\settings.dat GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveRemoteControl.log GoToResolveRemoteControl.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\a2687b73-937c-43ee-2788-af68e7fa5029.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUi.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\LibGoToResolve.dll invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\x86\g2rvdd.dll invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\x64\g2rvdd.cat invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\x64\g2rvdd.inf invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\LMIInputHook64.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\fa870490-7177-4197-bd03-6c05f46d3444.run.lock GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\d79a31d8-673d-4d34-fc26-c5daa8c048eb.run.lock GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\FileManagerCrashReportDB\settings.dat GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattended.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveFileManager.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\legacy.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\Logs\FileManager-2026-07-29T06-33-47-902Z.log GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\fa870490-7177-4197-bd03-6c05f46d3444.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\LMIFilterHook64.dll invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\LMIInputHook32.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\a6237f5d-dce7-4603-2aa6-4b00871edb2a.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\x64\g2rvdd.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\Logs\FileManager-2026-07-29T06-33-47-917Z.log GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\4a8ee58a-46c5-4c0c-5460-f029717f2400.run.lock GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\lmiscrhook32.dll invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\TerminalCrashReportDB\settings.dat GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattendedRemover.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveExternalModuleHandler.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnlock64.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\Logs\FileManager-2026-07-29T06-33-45-261Z.log GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\fa870490-7177-4197-bd03-6c05f46d3444.run.lock GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\RegistryEditorCrashReportDB\settings.dat GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\LoggerProcessCrashReportDB\settings.dat GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\unattended.json invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\libssl-3-x64.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\QuickViewCrashReportDB\settings.dat GoToResolveQuickView.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\NetworkCheckerCrashReportDB\settings.dat GoToResolveNetworkChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\RemoteControlCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\4a8ee58a-46c5-4c0c-5460-f029717f2400.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveLoggerProcess.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedUpdater.log invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedCrashReportDB\settings.dat GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\logger.json.tmp GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\LMIFilterHook32.dll invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\FileManager.dll invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveServiceManager.log GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveNetworkChecker.exe invitaton.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ServiceManagerCrashReportDB\settings.dat GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveTerminal.exe invitaton.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\4a8ee58a-46c5-4c0c-5460-f029717f2400.run.lock GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\a2687b73-937c-43ee-2788-af68e7fa5029.run.lock GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ServiceManagerCrashReportDB\settings.dat GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedUpdaterCopy.csv GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\unattended.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\a2687b73-937c-43ee-2788-af68e7fa5029.run.lock GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\.sentry-native\d79a31d8-673d-4d34-fc26-c5daa8c048eb.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveProcessChecker.exe invitaton.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe - Executes dropped EXE 28 IoCs
pid Process 2116 GoToResolveUnattended.exe 1132 GoToResolveTools64.exe 1484 GoToResolveCrashHandler.exe 1608 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 3616 GoToResolveCrashHandler.exe 3380 GoToResolveUnattended.exe 1748 GoToResolveLoggerProcess.exe 2416 GoToResolveCrashHandler.exe 4960 GoToResolveExternalModuleHandler.exe 1816 GoToResolveFileManager.exe 3252 GoToResolveQuickView.exe 3988 GoToResolveTerminal.exe 3940 GoToResolveServiceManager.exe 4712 GoToResolveRemoteControl.exe 2756 GoToResolveRegistryEditor.exe 2120 GoToResolveNetworkChecker.exe 3004 GoToResolveUnattendedUi.exe 1256 GoToResolveCrashHandler.exe 1636 GoToResolveCrashHandler.exe 2816 GoToResolveCrashHandler.exe 2820 GoToResolveCrashHandler.exe 2680 GoToResolveCrashHandler.exe 3828 GoToResolveCrashHandler.exe 2844 GoToResolveCrashHandler.exe 1044 GoToResolveCrashHandler.exe 3572 GoToResolveCrashHandler.exe 3336 GoToResolveCrashHandler.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4580 sc.exe 6088 sc.exe - Loads dropped DLL 64 IoCs
pid Process 1132 GoToResolveTools64.exe 2116 GoToResolveUnattended.exe 2116 GoToResolveUnattended.exe 2116 GoToResolveUnattended.exe 2116 GoToResolveUnattended.exe 2116 GoToResolveUnattended.exe 2116 GoToResolveUnattended.exe 1608 GoToResolveProcessChecker.exe 1608 GoToResolveProcessChecker.exe 1608 GoToResolveProcessChecker.exe 1608 GoToResolveProcessChecker.exe 1608 GoToResolveProcessChecker.exe 1608 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 1748 GoToResolveLoggerProcess.exe 1748 GoToResolveLoggerProcess.exe 1816 GoToResolveFileManager.exe 4960 GoToResolveExternalModuleHandler.exe 3252 GoToResolveQuickView.exe 3940 GoToResolveServiceManager.exe 3988 GoToResolveTerminal.exe 4712 GoToResolveRemoteControl.exe 1748 GoToResolveLoggerProcess.exe 1816 GoToResolveFileManager.exe 3252 GoToResolveQuickView.exe 4960 GoToResolveExternalModuleHandler.exe 1748 GoToResolveLoggerProcess.exe 3940 GoToResolveServiceManager.exe 3988 GoToResolveTerminal.exe 2756 GoToResolveRegistryEditor.exe 4712 GoToResolveRemoteControl.exe 1748 GoToResolveLoggerProcess.exe 2120 GoToResolveNetworkChecker.exe 1816 GoToResolveFileManager.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 3988 GoToResolveTerminal.exe 3940 GoToResolveServiceManager.exe 3988 GoToResolveTerminal.exe 1816 GoToResolveFileManager.exe 1816 GoToResolveFileManager.exe 2756 GoToResolveRegistryEditor.exe 4712 GoToResolveRemoteControl.exe 3252 GoToResolveQuickView.exe 4712 GoToResolveRemoteControl.exe 4960 GoToResolveExternalModuleHandler.exe 3940 GoToResolveServiceManager.exe 3988 GoToResolveTerminal.exe 3940 GoToResolveServiceManager.exe 2120 GoToResolveNetworkChecker.exe 4712 GoToResolveRemoteControl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4776 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveFileManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveServiceManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invitaton.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveTerminal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRemoteControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRegistryEditor.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe - Delays execution with timeout.exe 3 IoCs
pid Process 4056 timeout.exe 3220 timeout.exe 5112 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3004 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1680 invitaton.exe 1680 invitaton.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 4960 GoToResolveExternalModuleHandler.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 3252 GoToResolveQuickView.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 1312 GoToResolveProcessChecker.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe 3380 GoToResolveUnattended.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeAuditPrivilege 4484 svchost.exe Token: SeSecurityPrivilege 4484 svchost.exe Token: SeShutdownPrivilege 2116 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 2116 GoToResolveUnattended.exe Token: SeShutdownPrivilege 1608 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 1608 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 1312 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 1312 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 1312 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 1312 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 3380 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 3380 GoToResolveUnattended.exe Token: SeShutdownPrivilege 1816 GoToResolveFileManager.exe Token: SeCreatePagefilePrivilege 1816 GoToResolveFileManager.exe Token: SeShutdownPrivilege 3940 GoToResolveServiceManager.exe Token: SeCreatePagefilePrivilege 3940 GoToResolveServiceManager.exe Token: SeShutdownPrivilege 3988 GoToResolveTerminal.exe Token: SeCreatePagefilePrivilege 3988 GoToResolveTerminal.exe Token: SeShutdownPrivilege 4960 GoToResolveExternalModuleHandler.exe Token: SeCreatePagefilePrivilege 4960 GoToResolveExternalModuleHandler.exe Token: SeShutdownPrivilege 3252 GoToResolveQuickView.exe Token: SeCreatePagefilePrivilege 3252 GoToResolveQuickView.exe Token: SeShutdownPrivilege 2756 GoToResolveRegistryEditor.exe Token: SeCreatePagefilePrivilege 2756 GoToResolveRegistryEditor.exe Token: SeShutdownPrivilege 4712 GoToResolveRemoteControl.exe Token: SeCreatePagefilePrivilege 4712 GoToResolveRemoteControl.exe Token: SeShutdownPrivilege 2120 GoToResolveNetworkChecker.exe Token: SeCreatePagefilePrivilege 2120 GoToResolveNetworkChecker.exe Token: SeShutdownPrivilege 3004 GoToResolveUnattendedUi.exe Token: SeCreatePagefilePrivilege 3004 GoToResolveUnattendedUi.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe 3004 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2116 1680 invitaton.exe 85 PID 1680 wrote to memory of 1132 1680 invitaton.exe 86 PID 1680 wrote to memory of 4776 1680 invitaton.exe 87 PID 1132 wrote to memory of 1484 1132 GoToResolveTools64.exe 89 PID 4776 wrote to memory of 4056 4776 cmd.exe 90 PID 4484 wrote to memory of 3548 4484 svchost.exe 92 PID 4776 wrote to memory of 3220 4776 cmd.exe 95 PID 4776 wrote to memory of 5112 4776 cmd.exe 98 PID 2116 wrote to memory of 1608 2116 GoToResolveUnattended.exe 110 PID 1312 wrote to memory of 3616 1312 GoToResolveProcessChecker.exe 114 PID 1312 wrote to memory of 3380 1312 GoToResolveProcessChecker.exe 115 PID 3380 wrote to memory of 1748 3380 GoToResolveUnattended.exe 119 PID 3380 wrote to memory of 2416 3380 GoToResolveUnattended.exe 120 PID 3380 wrote to memory of 4960 3380 GoToResolveUnattended.exe 121 PID 3380 wrote to memory of 1816 3380 GoToResolveUnattended.exe 122 PID 3380 wrote to memory of 3252 3380 GoToResolveUnattended.exe 123 PID 3380 wrote to memory of 3988 3380 GoToResolveUnattended.exe 124 PID 3380 wrote to memory of 3940 3380 GoToResolveUnattended.exe 125 PID 3380 wrote to memory of 4712 3380 GoToResolveUnattended.exe 126 PID 3380 wrote to memory of 2756 3380 GoToResolveUnattended.exe 127 PID 3380 wrote to memory of 2120 3380 GoToResolveUnattended.exe 128 PID 1312 wrote to memory of 3004 1312 GoToResolveProcessChecker.exe 129 PID 4960 wrote to memory of 1256 4960 GoToResolveExternalModuleHandler.exe 131 PID 3252 wrote to memory of 1636 3252 GoToResolveQuickView.exe 132 PID 4712 wrote to memory of 2816 4712 GoToResolveRemoteControl.exe 133 PID 2120 wrote to memory of 2820 2120 GoToResolveNetworkChecker.exe 134 PID 1816 wrote to memory of 2680 1816 GoToResolveFileManager.exe 135 PID 2756 wrote to memory of 3828 2756 GoToResolveRegistryEditor.exe 136 PID 3988 wrote to memory of 2844 3988 GoToResolveTerminal.exe 137 PID 3940 wrote to memory of 1044 3940 GoToResolveServiceManager.exe 138 PID 1748 wrote to memory of 3572 1748 GoToResolveLoggerProcess.exe 139 PID 3004 wrote to memory of 3336 3004 GoToResolveUnattendedUi.exe 140
Processes
-
C:\Users\Admin\AppData\Local\Temp\invitaton.exe"C:\Users\Admin\AppData\Local\Temp\invitaton.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattended.exe" -regsvc2⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 2116 -InstallationId CbLAFnPvXL -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067" -ApplicationType 4 -Environment "Production" -ForceInstall 03⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveTools64.exe" -InstallVDD2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=version=1.24.0.142 --initial-client-data=0x328,0x32c,0x330,0x31c,0x334,0x7ff6a997baf8,0x7ff6a997bb10,0x7ff6a997bb283⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\invitaton.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\invitaton.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4056
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3220
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5112
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2f3fe06e-eaa7-a749-a18d-dd75b3453420}\g2rvdd.inf" "9" "49761d3bf" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3548
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067" -ApplicationType "4"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x8c4,0x8c8,0x8cc,0x82c,0x8d0,0x70f46fac,0x70f46fbc,0x70f46fcc2⤵
- Executes dropped EXE
PID:3616
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/2719380777784066067/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "1312" "-InstallationId" "CbLAFnPvXL" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_2719380777784066067" "-Service" "-LogLevel" "2"2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 3380 -CompanyId 2719380777784066067 -InstallationId CbLAFnPvXL -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067" -Environment Production -ApplicationType 4 -HostId bb1c17e58a9b9f4cf85238c9fe6fe199 -LogLevel 2 -SessionType Unattended3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x704,0x708,0x70c,0x6d4,0x710,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:3572
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x790,0x794,0x798,0x708,0x79c,0x70f46fac,0x70f46fbc,0x70f46fcc3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2416
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveExternalModuleHandler.exe" -InstallationId CbLAFnPvXL -CompanyId 2719380777784066067 -publickey 8f773197f438a7e69c310a0f580f3436a6cea80e3d542ffa3e34f65624e445c4 -LogLevel 2 -Environment Production3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x518,0x554,0x580,0x57c,0x558,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:1256
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveFileManager.exeGoToResolveFileManager.exe -CompanyId 2719380777784066067 -Environment Production -InstallationId CbLAFnPvXL -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x7f0,0x7f4,0x7f8,0x740,0x7fc,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:2680
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveQuickView.exeGoToResolveQuickView.exe -InstallationId CbLAFnPvXL -LogLevel 2 -Environment Production3⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x714,0x718,0x71c,0x710,0x720,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:1636
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveTerminal.exeGoToResolveTerminal.exe -CompanyId 2719380777784066067 -Environment Production -InstallationId CbLAFnPvXL -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x7e8,0x7ec,0x7f0,0x738,0x7f4,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:2844
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveServiceManager.exeGoToResolveServiceManager.exe -CompanyId 2719380777784066067 -Environment Production -InstallationId CbLAFnPvXL -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x7f4,0x7f8,0x7fc,0x740,0x804,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:1044
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveRemoteControl.exeGoToResolveRemoteControl.exe -CompanyId 2719380777784066067 -InstallationId CbLAFnPvXL -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 13⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x760,0x764,0x768,0x68c,0x76c,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2816
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveRegistryEditor.exeGoToResolveRegistryEditor.exe -CompanyId 2719380777784066067 -Environment Production -InstallationId CbLAFnPvXL -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x7f8,0x7fc,0x804,0x74c,0x808,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:3828
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId CbLAFnPvXL -CompanyId 2719380777784066067 -Environment Production3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x754,0x758,0x75c,0x69c,0x760,0x70f46fac,0x70f46fbc,0x70f46fcc4⤵
- Executes dropped EXE
PID:2820
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/2719380777784066067/GoToResolveUnattendedUi.exe" "-CompanyId" "2719380777784066067" "-InstallationId" "CbLAFnPvXL" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ocpzfhhi --annotation=installationid=CbLAFnPvXL --annotation=version=1.27.1.3232 --initial-client-data=0x7a8,0x7ac,0x7b0,0x594,0x7b4,0x70f46fac,0x70f46fbc,0x70f46fcc3⤵
- Executes dropped EXE
PID:3336
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:4580
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start GoToResolve_27193807777840660671⤵
- Launches sc.exe
PID:6088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\GOTORE~1\271938~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\271938~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\FileManager.dll
- Size 16.2MB
- SHA256 fa0b23cbb92d9f312e07fd34e9cca29f7f07f857c66437eac688884982c9772a
- MD5 a4f290656640bf413f90120e3a5adce1
- SHA1 1bea9cd003199b7be94f2bb971fcbb7e62d1b31d
- SHA512 d6a4fafb33407f0cbf502e3f83d4bde2d4b35c984793defdc1126b38ab7aea6b31c74c7dd40aa55e538aeaed0efa3ea05bd11b2d8b74981e5e8ea6187bd73331
- SSDEEP 393216:t8NxtVeLf7nCAArnTkXFVtci38fEhJdcJsv6tWKFdu9CErs3ba:t8Nx/eLf7YnTkVci3mE1ruba
- TLSH T12C07BFA2B1639135DD863172792EF73F5E288A244F2644C7925C3DD9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveCrashHandler.exe
- Size 652KB
- SHA256 a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635
- MD5 9574719cdf372198425169af317b0eb4
- SHA1 36cd0b6410d0ee3fe0622d6378b62160baf17c51
- SHA512 629d13ef185ddb14f2abaa385ace9bd201cf35de2f9822112f9f212cd684c8facce1164190f669633acc566964df8346acff6a8077797b324e7b1f02fa5966ab
- SSDEEP 12288:hipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e9:hipIc72CJhxGfRBYcRXHTqM8JMfqPwh2
- TLSH T113E4B011B1818032F5B222B2A9BDBF7059FCB52647BB09D773C44A3B9B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveLoggerProcess.exe
- Size 409KB
- SHA256 ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4
- MD5 47a7dd2ac70934804295fba021cc325c
- SHA1 153f964a9ec4431251b51f2194c580c87da4520f
- SHA512 a2c5cdad9dbb851bc39593b59a9b9af57caa8028222e0456331ee519b513c0d60570b370846f1658a488363f2b30ded8a1750e422c4a69e63a49f35797253f2a
- SSDEEP 6144:avxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAOcya3Qv6EVZp:avxwI7an+olyUan4hNy/jHSEVT
- TLSH T13D949E127A81D032D8B210318EA4DF756A7DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveProcessChecker.exe
- Size 409KB
- SHA256 7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd
- MD5 1de89cd290b4ecba1d834275e914f850
- SHA1 5c204a50b53e1b5ead77b3d0d6335f103074ab29
- SHA512 6247f45e385bd08c7cc926d2f92aba203dcf8f5e95c2d6ed67315b2902c840ae4b0bf973d2081b76732f99c456fdbee6f7ba9e4c44ae13198a92b9566921a2f2
- SSDEEP 6144:7vxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAODiY3Qv6EVZ5:7vxwI7an+olyUan4hNy/jWSEV
- TLSH T1F2949D127AC1D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1
- MD5 4256b14af65b85bf6f7d7a76d63c52e1
- SHA1 f0f6192dd2bfc55fb9608a25207068de48e30023
- SHA512 3833dbadc17d2ac7a56f174b0752f5a67770b8413dad87a248ef5502e323e0345282eac136b2e0467d5bdee088e53287e18ad6804c91a30fde6d45c26f39a560
- SSDEEP 24576:L8d+H5/wzK0K+3AOzTORk0U1BPfypVXISyXthAeagonjfQVp:QGRwO0KYfPORkrHyXCXthzagmQ
- TLSH T1CA558D1A626C41F9D1BFE17C89878A4AE7B17806037187EF13A8475A2F276E15F7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\GoToResolveUnattended.exe
- Size 409KB
- SHA256 3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9
- MD5 bf5b71caaa5051900504a20a670981aa
- SHA1 747defaa7994ef6a9b9b736def73d8e53ff9f0e3
- SHA512 0ebf2412628bdab69e99d2acef8a17005d82c8ae4192e03e3c60eef9e2cd09beaaa1ea294c2bee7bfc4be04c8e783a5af61b348957984b84b915acea384f76bb
- SSDEEP 6144:/vFwjIKCan+HIlnusRWaUnox9CdER02gOu6+nbjAOdBIa3Qv6EVZo:/vFwkLan+olus6nox5ybjySEVG
- TLSH T1AF949D127A81D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\LibGoToResolve.dll
- Size 19.5MB
- SHA256 ddf3244decb29688d6a1972d3004f92bd365700bc77606efce8013a3677c6a83
- MD5 d7a242def5ff195ea246e33e28413999
- SHA1 3ba086b87fc81c21673252b70f8d29bb91d45a56
- SHA512 659e016968f18af79df9a513d972dda79bc84d16f4aad9023df238c4fde946ca46ae856b60234a49a587aa002153097a44855100dc88bc6a22ba9a8319acbf70
- SSDEEP 196608:muMIO5dY3td4PLTm1lW3ILzUmMcBs0Qooa4C7Gs8Jsv6tWKFdu9C5qhnjxFJoHI:ZZiMYmh3H7H8Jsv6tWKFdu9Ckh1oo
- TLSH T13727AFD27147C0F1E98A11B9A53AAB3F8678A8504B2954D797EC3E1D99301D33F37A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\MediaClientLib.dll
- Size 14.0MB
- SHA256 16729d5e7273b72c0fa05d08734f558c9da7f939900dcf38c1356edbbdade0c5
- MD5 99c94e16cc0b360eea8164a74972092b
- SHA1 280cd506fa6e0e1a586fbfc6265f43ab40eea2bc
- SHA512 d6e6ac52ba9d8ac4faf718897ea2b33a690b2f757c688072ca628eee03a50b374ba777641620f4e0310fa82453b1de6a1cb4e88bdb0d58f9c5f899ca0a075d51
- SSDEEP 196608:nVf8Kglmgw143el82aJdnv4KMGx715CARN775eciChoUCCp1kxJ3gF:nVf8vRC4HnhMc5Co5F8GkxJ3gF
- TLSH T16DE6AFC1E1625174C9461870AD3DAA3E6E28025D87B089F7BBD85CA07BF37D0377A786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100
- MD5 acf440dd02b14609359844366e281ef9
- SHA1 288190791a137dec98109104392a13eba4ae6abc
- SHA512 4d7b7b09903145319ea1509c56cd60fcfcf932fbf9396697ac3ecfb8bd9e7f8e3453579954812f8b58f38f9971627b4dd252deb172f085f4aec5c364e0ebce6f
- SSDEEP 24576:4ZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr54:lYM801G81cOS5TI1hr54
- TLSH T1C9458C03BAC189B1F5AE06B448B6B33C897EBD704734C5C75BC8688969715C1BB3B396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 6513b703f71ba35157bb0711c62d27c499fc8e092708be4e02aa3caeb5960681
- MD5 2e6b540f40e60b9289c8f46d18c2d723
- SHA1 b020463df473a3850ad6149ae21bf40d27561851
- SHA512 29dd19731cb255d9e6e1bf4fc5641b83ddf431ddbd454e9d9302f0b0c96df2368773e97c02a15c5e0094a91c48eb767fbb0410cd44641a2aa10900d749f60dff
- SSDEEP 96:o2TpTdIT8IR3V4TleXUwrb/ed2rbfXduqrH9fnI8f/8FIUK:3NJIQI5V4B0Uab/8gbfXduqrH9fnI8XL
- TLSH T15F91748908B934B6D37A9A24FF4B3C5DD0A1695D88F468B14BC50A161BCBF161BF3520
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\appdata\GoToResolveUnattended.log
- Size 2KB
- SHA256 32eada21991ca828b07088cc33f07b6f68498721993427ac1fd60b8497f0e7ea
- MD5 a820556dca315702e17038de260b6ed3
- SHA1 933c461f3f9dffdc69819f66e26c34c35d952427
- SHA512 ab523dc2ac9c831f856a100873fd0e28a2bc2df762ff36bf6c4b6507a1ac45cb72646ce06184f77f0066d6a5954189d11fd1bd4cea74ca3e7f7a36b269e40f01
- TLSH T1E45189C21C6EBCF381520132BE8E7AD4E056623EACDC8D5462D14A18228DF5B2FB7671
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 7667612b7ee8efd38b87050f6a58b291831a90310c9a72b08179e66eec55b9d0
- MD5 afc23696090bbe82aae9e8b108d6cbd2
- SHA1 73d749b6ea4ce572cdf921c2f0fb210c7cc0d4c0
- SHA512 52ad3b9ccc99db60ef72adf786e6018a21edbc252bffd384e5a0540d845da4e826bb4f477b01121b3114e34fb84628a7776f66e877a5a86c28bbc35ca91b11fd
- SSDEEP 98304:SD+fVjyaabqoQPk1p7huA0F19IuPj1CPwDvt3uFlDCM:E+1yaabxyshuAkrIu71CPwDvt3uFlDCM
- TLSH T133567C6EA7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\libcrypto-3.dll
- Size 4.2MB
- SHA256 20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a
- MD5 e2d7132d06648c344f851a16d2830964
- SHA1 153034cc90a84282c15ca91b401f120a516435cf
- SHA512 552e4eb9bdd888ce2a177e795aeed88bcce2ab6f2c71617a6e8354d4d7c4ef6b51517172c1451a7be43a32a1a7a97fb9febe5222f519a3ed99c13f19d5e8eeac
- SSDEEP 49152:Fyx0uEV3rsWweF37k5FyOgvMbziX+cg1CPwDvt3uFlDCPSmFzO2rnd:w0uEiGNOhKX+P1CPwDvt3uFlDC7
- TLSH T12B26BF12FB936591E8CF927D12EEA33F0E3D5B14872489D38EA615E9C8256C0773E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\libssl-3.dll
- Size 1.1MB
- SHA256 9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf
- MD5 753cfc508dcc0883db50d5069cd81a4f
- SHA1 c8193d2556392324007f6a4e916620b85600c24b
- SHA512 3137c88fe025ff3e3bf068f23b31ab7d3a468c5fee172726e25351aa83c4b5cdb89b000d03b829c35cba0f13d0d5783e11a6db3c29da23a81b57158d725f9ff9
- SSDEEP 12288:OasfmiM1aHnChqPS3/pziY7g6X5zTR4bQT6clxHlhhNFXN2WcrFe9XbOz5:tsfmL5VbRl/f0WcrFe9XbOz5
- TLSH T10135AF11BA814970DCE661BE06EDB77E473DA2601318C9C78F8559FADE206C16B3A3CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\mandatory.json
- Size 1KB
- SHA256 2a07d0042b337f5e82e2ba687a0e16bda316cefafdb0d7f4a46fdf50492e3900
- MD5 696facc373cd92817dc6bb49730015d1
- SHA1 934930c2d666e8dc34ef8f4b86056fc4b13fddcd
- SHA512 5b3fa0045019d60ecd158eca10403918e97d549bad542b476c749e8e088aea777abc414bf0798a252ae455627dac8754a402ae7db73a1f9a155bcee8bf5a88e7
- TLSH T19011DD61D8652D7B27119DD4DC121A0B622149B34C94B4EABB492E1E0FCFE6F317153D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\unattended.json
- Size 697B
- SHA256 a273a1157ba65fefe96e273ffb582bdd948cdbc89e533c9cd359ae026feb4fde
- MD5 ad36de5e16cb06f5592c11f6416209c0
- SHA1 4effd5222161797ff101b1279a68e97dd6e8f78c
- SHA512 d0ef7841be50bd8ea82884d2ba852921c89168c9bcb8b2124be2a10911acc754247be0f487e7898639e840b6e361f63e74b8fd44ed70d69196bdb0d4242aaf8a
- TLSH T10F0170A21AF625384712BDC8CC9E541FE1A64C9255C8B8E6994D2E2A08D2FD3614A934
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\unattended.json
- Size 1KB
- SHA256 5a5c3386cf5adbf878e34d688bfa015d69098afab87c9bc55a135e71545bd576
- MD5 a6690564082d1d7f48672c958ca0d317
- SHA1 c0a09cc19adfe693bd215d1f20e9bf7e290cb9b1
- SHA512 a3dc75fb223f06537176f1bc41dd785f6cc1d66498f44f5a9486abebe95089b0396f7e8ffaf2fbabd67718ebff7bece15ecfad1a05bef0a94835df63483131c5
- TLSH T1B311DD61ECA22D771B109DD0DC561A0F61214AA74C94B4EABB491E1E0FCFE6F227552C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\2719380777784066067\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 8757184c27826a76647307a2d9630f5b3d2e7f8eff6ca587c0ff33c42d7849d9
- MD5 23a127244fd83cc5cdf498bcfcd040eb
- SHA1 ef344f9043567b8754017bfbfa87dd106b649e65
- SHA512 42cc6fa53471527d7cec3d0a9cf917d1fd9179d58170e0fa78fb2563fd75c934040bba694a0352721ff178458955616c098098595fbb242b3c9df01df4c82aca
- TLSH T19A0165B38A3A3891787A1FDE498CA4A53DC7E874B1CA3946F414509C18B7B236D12010
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 727B
- SHA256 8c4c8273c2c37080e0d1b57b9fcf4db7f0571fdc190f2b801fc703917d9fe8fd
- MD5 f08d85d3814ac3ba6f779430de9b4cdf
- SHA1 42c087efba78d6861ade34dce488a9398e05a5df
- SHA512 496143405965c9a89378afd1ae6f6652d2be6d1fbc53c6c412cc6624371b2656c01991204caf5ceadcfe0dcecc6d7875af0cd9956d6ae7dc6d70a12c1417bfd5
- TLSH T1AB0199E34DE5A7848ADD5C3D0E9963F23FA6F51119D1062AD1A31147044CE23BF41713
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 c13e2e5215a3d33b2d23d2c7542a15b7c036d8abebd3792b8998985b4d32f20e
- MD5 cca76e73e1d8eb1cc3c23e7fe851bb50
- SHA1 cfa39631aa3bc73ee424cee65d263811d3aeeaf3
- SHA512 b134eb6b951c90e0f4b8c033647ad15d0607ab303e1885e583fc8b752c81f0360e981fde61fd41a46c20073a1e10445693f2541ce3a03fa49e7911581bf729e5
- TLSH T1A8E0C0341EFA012DF3AAC9365FC17D52480DF2529840C7A60F90850C9B557004D524B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 95322388c092e2c9f2194fc881fdf1e440bc86cc37b98579067dccfd991bfeb7
- MD5 70c2d1db02b902c09b90fb49fc653d18
- SHA1 3c277abc87f9ffb1fe19d60b5fa6bf9976ddfd3f
- SHA512 3a1c9a9cb7ba7b15764567541109065ad33f22182625f06e18c588081a3d338599dc7ed17dd5dbc770fdd3d56b0b440341328625c40f2fc041a4b72872538ae4
- TLSH T180E0283C61FA855DF5F1E03C02FF68110509F2470C01C35D12C01219AEB5F405CD3930
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
- Size 6KB
- SHA256 a6966fa48f3b59111e31c8c44a9d598a6604f0d04dcc2485250454ce0b473626
- MD5 8a95c21c130022f496839b3db2ec3ff7
- SHA1 0a9150369e4fb1d04490f675e6f427e84f6fa680
- SHA512 e4c7c91cd2fb5b0029b84a4e37e0deee4d797dbbead70d46eb5a038ce3acc63d97af0edc55aa0f99dd85879f02634219fb2e86c2abd33291945d8e604f21d35e
- SSDEEP 192:GO7BWBN6QS0zj0Z0q0Vbjh0YQNQKd2Hd25d2MQ2JQ22S2rS2fS2Y02Tx2b/2z42d:wES/V6jj292r252q252m2K2Z2F2T282d
- TLSH T1EDD169F160DADAB91107BF747D031389C443A7D0E5AD70E4B3D23E994697D0A4E9CB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log
- Size 3KB
- SHA256 f42d6a828f08b1fda0a61aa985c00f23d955744987364244d52968734ca432f1
- MD5 e808805ba8af96d5cd05feace4acecf9
- SHA1 f4e85652534e458ffc4ae48a7ed395d7080c8eda
- SHA512 c9fe021983850012c4e7b817c9b4d573356f1d2ee4dcb407673cc3559bd63090f4b2ceb2f7ab1505f16515e26627ef85544c3e85c03b9d092fc46a22e42c6191
- TLSH T17581FAF1609BFAF74602C768BD4207CBE4865675C8DC9C9093C13EE8C7AEE07099D56A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\invitaton.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
- Size 175KB
- SHA256 3d95bec8bd1d5524fe56dd21c6402eeffafd29950ee651789175f7ce68cde55d
- MD5 6b9078a974a4765e2bd89a39d046c7d2
- SHA1 289eddba02d7a22701ea5b26678c22fb072ce5cf
- SHA512 d41902daecfa1460e9bcedd218747a79283420158d97482a5fc2707c56acebd7801ef1793e9b37d444e83927c63fa35c92063dab4cb5b4fb0da64b6b1f115254
- SSDEEP 3072:n/A9mBhxeZ6gxwE8TFF1lUQ8aP1ygAwJc1+wPToh:n/fBhai7AaP1LAac1la
- TLSH T1CB04EC288D187152E54AAD76D9CEAF9BCCB5B4C733D1954F9A500F821422FCD8FD88B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 3159560b084e6dc00d3cfe8190aeb15b522b5f235a98138db9d438931044a04f
- MD5 a79b6e646222b2583ff3727b44c0a17f
- SHA1 63329831c2530f4d8b420aa5fa919df3059ec14f
- SHA512 da339857cd355ed18d6ee94285b11b5d13fbc7e7fbfc86ea04f07f9b0005ebaac4291c34e65391a79e3b0614b1fd38a17e60e99e68dcd49f8a160976d7b53f1f
- TLSH T10BE0C0241EFA012DF3AAC6364FC27852590DF2139840C7A10F90850C8B457004D624B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
- Size 306B
- SHA256 c05bb6bcef424d84912c86ff389fc98ebaa28c2987b6bf92027f0652cc3698a7
- MD5 992e0278e0d91a34dc11f936efcda42c
- SHA1 ece2ffd1c1b4930f24decee910bfff4f40ebd2c8
- SHA512 5297f412223f760f6d49fdf0ad0f7491b67b52f081f51fce45123dc65c949e865893fbf9faeadb0c7522404f8599fd544b0d73565d383d81511968ca681b8a79
- TLSH T1E1E05B191BE82627F1A556795AF006817750ED675542CB094F90055F5534F401D2552A
- MD5 SHA1 SHA512 TLSH