Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 00:32
Behavioral task
behavioral1
Sample
admin%20collaboration.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
admin%20collaboration.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target admin%20collaboration.exe
- Size 23.3MB
- Sample260730-av5a6ahd97
- SHA256 09fff8e6de043b59e70953603c69723028535c435e62c1c8253b981bba55b199
- MD5 20a1c93f85b8ee0825868c4a2d4cc343
- SHA1 6c547fc0047da7d46ee9ee406f6a7248eed4a3aa
- SHA512 4d9ea674581623b857b9563603f61a8947bb3f655465b9d9d8ef1300fcc3365427c6223f024d14866ff5cd556a6a8b853f54fb0812f80eaebdabc976b8de125d
- SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpK:q9WtLzgOTbjZvk/ekS/mcpK
- TLSH T13337333132568471DC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveQuickView.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000d00000001c4ef-101.dat rat_gotoresolve - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\GoTo Resolve_Reboot_z3bkuOFzxn = "\"C:\\Program Files (x86)\\GoTo Resolve Unattended\\711050222054191376\\GoToResolveProcessChecker.exe\" -Rebooted -ApplicationType 4" GoToResolveProcessChecker.exe - Drops file in System32 directory 28 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E GoToResolveProcessChecker.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_4dd0e6d66a75bb7e\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_39696ccdf1e382c7\c_display.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_191a331ccc578de7\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\SET14A9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c5d85eade837b122\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_ad2569d6b92e9e9a\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\SET1499.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\SET1499.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E GoToResolveProcessChecker.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\SET1498.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\SET1498.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{19f6562b-f039-c94f-9706-7c7f6943269a}\SET14A9.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnattendedUi.exe admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\mandatory.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveFileManager.log GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\112357ef-af15-4c84-87bd-8756cde45216.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveTerminal.exe admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\LMIFilterHook32.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\LMIFilterHook64.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\LMISupport7x32.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\legacy.dll admin%20collaboration.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\LoggerProcessCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\NetworkCheckerCrashReportDB\settings.dat GoToResolveNetworkChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveTerminal.log GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveServiceManager.log GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedUiCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\PasswordPrivacyDll.dll admin%20collaboration.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveLoggerProcess.log GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\76692553-67c2-4b8c-5a10-7342b70c3bd0.run.lock GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ServiceManagerCrashReportDB\settings.dat GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\8acc94a3-66b1-479a-619f-e9db2177a74d.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RegistryEditorCrashReportDB\settings.dat GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveRemoteControl.log GoToResolveRemoteControl.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\TerminalCrashReportDB\settings.dat GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveExternalModuleHandler.exe admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\LMIInputHook32.dll admin%20collaboration.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedUpdaterCopy.csv GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\Logs\FileManager-2026-07-30T00-34-40-703Z.log GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\CrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\76692553-67c2-4b8c-5a10-7342b70c3bd0.run.lock GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RemoteControlCrashReportDB\settings.dat GoToResolveRemoteControl.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\112357ef-af15-4c84-87bd-8756cde45216.run\session.json GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\TerminalCrashReportDB\settings.dat GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\5ec3c8c9-7b1e-482f-99f7-2ded504198ac.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\libssl-3-x64.dll admin%20collaboration.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\unattended.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedCrashReportDB\settings.dat GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveQuickView.log GoToResolveQuickView.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\8acc94a3-66b1-479a-619f-e9db2177a74d.run\session.json GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnlock64.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\76692553-67c2-4b8c-5a10-7342b70c3bd0.run.lock GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\112357ef-af15-4c84-87bd-8756cde45216.run.lock GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RegistryEditorCrashReportDB\settings.dat GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveLoggerProcess.exe admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\x86\g2rvdd.cat admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\x86\g2rvdd.inf admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\lmiscrhook64.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\libssl-3.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\5ec3c8c9-7b1e-482f-99f7-2ded504198ac.run.lock GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\QuickViewCrashReportDB\settings.dat GoToResolveQuickView.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\112357ef-af15-4c84-87bd-8756cde45216.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\x64\g2rvdd.dll admin%20collaboration.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\LMISupportM32.exe admin%20collaboration.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\LoggerProcessCrashReportDB\settings.dat GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\5ec3c8c9-7b1e-482f-99f7-2ded504198ac.run.lock GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\.sentry-native\eb2308eb-c133-4df0-4e03-5f466d6735a1.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveTools64.exe admin%20collaboration.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Executes dropped EXE 30 IoCs
pid Process 4120 GoToResolveUnattended.exe 2012 GoToResolveTools64.exe 5500 GoToResolveCrashHandler.exe 836 GoToResolveProcessChecker.exe 4844 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 4476 GoToResolveCrashHandler.exe 1508 GoToResolveUnattended.exe 4248 GoToResolveProcessChecker.exe 4616 GoToResolveLoggerProcess.exe 1524 GoToResolveCrashHandler.exe 1204 GoToResolveExternalModuleHandler.exe 4520 GoToResolveFileManager.exe 5880 GoToResolveQuickView.exe 4444 GoToResolveTerminal.exe 4876 GoToResolveServiceManager.exe 3260 GoToResolveRemoteControl.exe 1692 GoToResolveCrashHandler.exe 2376 GoToResolveCrashHandler.exe 1520 GoToResolveRegistryEditor.exe 3540 GoToResolveUnattendedUi.exe 3768 GoToResolveNetworkChecker.exe 4232 GoToResolveCrashHandler.exe 4812 GoToResolveCrashHandler.exe 2292 GoToResolveCrashHandler.exe 1100 GoToResolveCrashHandler.exe 5316 GoToResolveCrashHandler.exe 5156 GoToResolveCrashHandler.exe 2428 GoToResolveCrashHandler.exe 4088 GoToResolveCrashHandler.exe - Loads dropped DLL 64 IoCs
pid Process 2012 GoToResolveTools64.exe 4120 GoToResolveUnattended.exe 4120 GoToResolveUnattended.exe 4120 GoToResolveUnattended.exe 4120 GoToResolveUnattended.exe 4120 GoToResolveUnattended.exe 4120 GoToResolveUnattended.exe 836 GoToResolveProcessChecker.exe 836 GoToResolveProcessChecker.exe 836 GoToResolveProcessChecker.exe 836 GoToResolveProcessChecker.exe 836 GoToResolveProcessChecker.exe 836 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 4248 GoToResolveProcessChecker.exe 1508 GoToResolveUnattended.exe 4248 GoToResolveProcessChecker.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 4248 GoToResolveProcessChecker.exe 1508 GoToResolveUnattended.exe 4248 GoToResolveProcessChecker.exe 4248 GoToResolveProcessChecker.exe 4248 GoToResolveProcessChecker.exe 4616 GoToResolveLoggerProcess.exe 4616 GoToResolveLoggerProcess.exe 4616 GoToResolveLoggerProcess.exe 4616 GoToResolveLoggerProcess.exe 4616 GoToResolveLoggerProcess.exe 4616 GoToResolveLoggerProcess.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 4520 GoToResolveFileManager.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 5880 GoToResolveQuickView.exe 4520 GoToResolveFileManager.exe 1204 GoToResolveExternalModuleHandler.exe 5880 GoToResolveQuickView.exe 4520 GoToResolveFileManager.exe 4520 GoToResolveFileManager.exe 4520 GoToResolveFileManager.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 4520 GoToResolveFileManager.exe 5880 GoToResolveQuickView.exe 3260 GoToResolveRemoteControl.exe 3260 GoToResolveRemoteControl.exe 3768 GoToResolveNetworkChecker.exe 3260 GoToResolveRemoteControl.exe 3260 GoToResolveRemoteControl.exe 3260 GoToResolveRemoteControl.exe 3768 GoToResolveNetworkChecker.exe 3540 GoToResolveUnattendedUi.exe 3768 GoToResolveNetworkChecker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2940 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRegistryEditor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveFileManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveTerminal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language admin%20collaboration.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveServiceManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRemoteControl.exe - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveQuickView.exe - Delays execution with timeout.exe 3 IoCs
pid Process 3368 timeout.exe 5592 timeout.exe 992 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveProcessChecker.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3540 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 admin%20collaboration.exe 5064 admin%20collaboration.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 1204 GoToResolveExternalModuleHandler.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 5880 GoToResolveQuickView.exe 2156 GoToResolveProcessChecker.exe 2156 GoToResolveProcessChecker.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe 1508 GoToResolveUnattended.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3540 GoToResolveUnattendedUi.exe - Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeShutdownPrivilege 4120 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 4120 GoToResolveUnattended.exe Token: SeShutdownPrivilege 836 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 836 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 2156 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 2156 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 1508 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 1508 GoToResolveUnattended.exe Token: SeShutdownPrivilege 1204 GoToResolveExternalModuleHandler.exe Token: SeCreatePagefilePrivilege 1204 GoToResolveExternalModuleHandler.exe Token: SeShutdownPrivilege 4520 GoToResolveFileManager.exe Token: SeCreatePagefilePrivilege 4520 GoToResolveFileManager.exe Token: SeShutdownPrivilege 5880 GoToResolveQuickView.exe Token: SeCreatePagefilePrivilege 5880 GoToResolveQuickView.exe Token: SeShutdownPrivilege 3260 GoToResolveRemoteControl.exe Token: SeCreatePagefilePrivilege 3260 GoToResolveRemoteControl.exe Token: SeShutdownPrivilege 3768 GoToResolveNetworkChecker.exe Token: SeCreatePagefilePrivilege 3768 GoToResolveNetworkChecker.exe Token: SeShutdownPrivilege 3540 GoToResolveUnattendedUi.exe Token: SeCreatePagefilePrivilege 3540 GoToResolveUnattendedUi.exe Token: SeShutdownPrivilege 4444 GoToResolveTerminal.exe Token: SeCreatePagefilePrivilege 4444 GoToResolveTerminal.exe Token: SeShutdownPrivilege 4876 GoToResolveServiceManager.exe Token: SeCreatePagefilePrivilege 4876 GoToResolveServiceManager.exe Token: SeShutdownPrivilege 1520 GoToResolveRegistryEditor.exe Token: SeCreatePagefilePrivilege 1520 GoToResolveRegistryEditor.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe 3540 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4120 5064 admin%20collaboration.exe 89 PID 5064 wrote to memory of 2012 5064 admin%20collaboration.exe 90 PID 5064 wrote to memory of 2940 5064 admin%20collaboration.exe 91 PID 2940 wrote to memory of 3368 2940 cmd.exe 93 PID 2012 wrote to memory of 5500 2012 GoToResolveTools64.exe 94 PID 2940 wrote to memory of 5592 2940 cmd.exe 96 PID 2940 wrote to memory of 992 2940 cmd.exe 97 PID 4120 wrote to memory of 836 4120 GoToResolveUnattended.exe 98 PID 4120 wrote to memory of 2156 4120 GoToResolveUnattended.exe 101 PID 2156 wrote to memory of 4476 2156 GoToResolveProcessChecker.exe 102 PID 2156 wrote to memory of 1508 2156 GoToResolveProcessChecker.exe 103 PID 1508 wrote to memory of 4616 1508 GoToResolveUnattended.exe 106 PID 1508 wrote to memory of 1524 1508 GoToResolveUnattended.exe 107 PID 1508 wrote to memory of 1204 1508 GoToResolveUnattended.exe 109 PID 1508 wrote to memory of 4520 1508 GoToResolveUnattended.exe 110 PID 1508 wrote to memory of 5880 1508 GoToResolveUnattended.exe 111 PID 1508 wrote to memory of 4444 1508 GoToResolveUnattended.exe 112 PID 1508 wrote to memory of 4876 1508 GoToResolveUnattended.exe 113 PID 1508 wrote to memory of 3260 1508 GoToResolveUnattended.exe 114 PID 4616 wrote to memory of 1692 4616 GoToResolveLoggerProcess.exe 115 PID 1204 wrote to memory of 2376 1204 GoToResolveExternalModuleHandler.exe 116 PID 1508 wrote to memory of 1520 1508 GoToResolveUnattended.exe 117 PID 2156 wrote to memory of 3540 2156 GoToResolveProcessChecker.exe 118 PID 1508 wrote to memory of 3768 1508 GoToResolveUnattended.exe 119 PID 4520 wrote to memory of 4232 4520 GoToResolveFileManager.exe 120 PID 5880 wrote to memory of 4812 5880 GoToResolveQuickView.exe 121 PID 3260 wrote to memory of 2292 3260 GoToResolveRemoteControl.exe 122 PID 3768 wrote to memory of 1100 3768 GoToResolveNetworkChecker.exe 123 PID 3540 wrote to memory of 5316 3540 GoToResolveUnattendedUi.exe 124 PID 4444 wrote to memory of 5156 4444 GoToResolveTerminal.exe 125 PID 4876 wrote to memory of 2428 4876 GoToResolveServiceManager.exe 126 PID 1520 wrote to memory of 4088 1520 GoToResolveRegistryEditor.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\admin%20collaboration.exe"C:\Users\Admin\AppData\Local\Temp\admin%20collaboration.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnattended.exe" -regsvc2⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 4120 -InstallationId z3bkuOFzxn -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376" -ApplicationType 4 -Environment "Production" -ForceInstall 03⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe"C:/Program Files (x86)/GoTo Resolve Unattended/711050222054191376/GoToResolveProcessChecker.exe" "-ApplicationType" "4"3⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x79c,0x7a0,0x7a4,0x73c,0x7a8,0x706a6fac,0x706a6fbc,0x706a6fcc4⤵
- Executes dropped EXE
PID:4476
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/711050222054191376/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "2156" "-InstallationId" "z3bkuOFzxn" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_711050222054191376" "-LogLevel" "2"4⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 1508 -CompanyId 711050222054191376 -InstallationId z3bkuOFzxn -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376" -Environment Production -ApplicationType 4 -HostId 219683967e6f20fdebd8bbdc138a73ae -LogLevel 2 -SessionType Unattended5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x704,0x708,0x70c,0x570,0x710,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1692
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x794,0x798,0x79c,0x758,0x7a0,0x706a6fac,0x706a6fbc,0x706a6fcc5⤵
- Executes dropped EXE
PID:1524
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveExternalModuleHandler.exe" -InstallationId z3bkuOFzxn -CompanyId 711050222054191376 -publickey c0f0ca666cda2fe11f4a4317f64167bde59953e23667d9a93b67f91232215c0e -LogLevel 2 -Environment Production5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x740,0x744,0x748,0x718,0x74c,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:2376
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveFileManager.exeGoToResolveFileManager.exe -CompanyId 711050222054191376 -Environment Production -InstallationId z3bkuOFzxn -LogLevel 25⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x828,0x82c,0x830,0x7c0,0x834,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:4232
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveQuickView.exeGoToResolveQuickView.exe -InstallationId z3bkuOFzxn -LogLevel 2 -Environment Production5⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x710,0x714,0x718,0x6ec,0x71c,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:4812
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveTerminal.exeGoToResolveTerminal.exe -CompanyId 711050222054191376 -Environment Production -InstallationId z3bkuOFzxn -LogLevel 25⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x824,0x828,0x82c,0x5cc,0x830,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:5156
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveServiceManager.exeGoToResolveServiceManager.exe -CompanyId 711050222054191376 -Environment Production -InstallationId z3bkuOFzxn -LogLevel 25⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x824,0x828,0x82c,0x764,0x830,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:2428
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveRemoteControl.exeGoToResolveRemoteControl.exe -CompanyId 711050222054191376 -InstallationId z3bkuOFzxn -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376" -Environment Production -ApplicationType 4 -LogLevel 25⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x76c,0x770,0x774,0x6d4,0x778,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:2292
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveRegistryEditor.exeGoToResolveRegistryEditor.exe -CompanyId 711050222054191376 -Environment Production -InstallationId z3bkuOFzxn -LogLevel 25⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x81c,0x820,0x824,0x7b8,0x828,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:4088
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId z3bkuOFzxn -CompanyId 711050222054191376 -Environment Production5⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x768,0x76c,0x770,0x744,0x774,0x706a6fac,0x706a6fbc,0x706a6fcc6⤵
- Executes dropped EXE
PID:1100
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/711050222054191376/GoToResolveUnattendedUi.exe" "-CompanyId" "711050222054191376" "-InstallationId" "z3bkuOFzxn" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=installationid=z3bkuOFzxn --annotation=version=1.27.1.3232 --initial-client-data=0x770,0x774,0x778,0x578,0x77c,0x706a6fac,0x706a6fbc,0x706a6fcc5⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:5316
-
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveTools64.exe" -InstallVDD2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wlqwinku --annotation=version=1.24.0.142 --initial-client-data=0x328,0x32c,0x330,0x324,0x334,0x7ff6b84fbaf8,0x7ff6b84fbb10,0x7ff6b84fbb283⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5500
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\admin%20collaboration.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\admin%20collaboration.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3368
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5592
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:992
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{82f1d95c-8980-f94e-9772-08d5bf8ed43b}\g2rvdd.inf" "9" "422efdcff" "0000000000000190" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\x64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1372
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376" -ApplicationType "4"1⤵
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4844
-
C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe" -Rebooted -ApplicationType 41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4248
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\GOTORE~1\711050~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\711050~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\FileManager.dll
- Size 16.2MB
- SHA256 fa0b23cbb92d9f312e07fd34e9cca29f7f07f857c66437eac688884982c9772a
- MD5 a4f290656640bf413f90120e3a5adce1
- SHA1 1bea9cd003199b7be94f2bb971fcbb7e62d1b31d
- SHA512 d6a4fafb33407f0cbf502e3f83d4bde2d4b35c984793defdc1126b38ab7aea6b31c74c7dd40aa55e538aeaed0efa3ea05bd11b2d8b74981e5e8ea6187bd73331
- SSDEEP 393216:t8NxtVeLf7nCAArnTkXFVtci38fEhJdcJsv6tWKFdu9CErs3ba:t8Nx/eLf7YnTkVci3mE1ruba
- TLSH T12C07BFA2B1639135DD863172792EF73F5E288A244F2644C7925C3DD9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveCrashHandler.exe
- Size 652KB
- SHA256 a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635
- MD5 9574719cdf372198425169af317b0eb4
- SHA1 36cd0b6410d0ee3fe0622d6378b62160baf17c51
- SHA512 629d13ef185ddb14f2abaa385ace9bd201cf35de2f9822112f9f212cd684c8facce1164190f669633acc566964df8346acff6a8077797b324e7b1f02fa5966ab
- SSDEEP 12288:hipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e9:hipIc72CJhxGfRBYcRXHTqM8JMfqPwh2
- TLSH T113E4B011B1818032F5B222B2A9BDBF7059FCB52647BB09D773C44A3B9B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveProcessChecker.exe
- Size 409KB
- SHA256 7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd
- MD5 1de89cd290b4ecba1d834275e914f850
- SHA1 5c204a50b53e1b5ead77b3d0d6335f103074ab29
- SHA512 6247f45e385bd08c7cc926d2f92aba203dcf8f5e95c2d6ed67315b2902c840ae4b0bf973d2081b76732f99c456fdbee6f7ba9e4c44ae13198a92b9566921a2f2
- SSDEEP 6144:7vxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAODiY3Qv6EVZ5:7vxwI7an+olyUan4hNy/jWSEV
- TLSH T1F2949D127AC1D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1
- MD5 4256b14af65b85bf6f7d7a76d63c52e1
- SHA1 f0f6192dd2bfc55fb9608a25207068de48e30023
- SHA512 3833dbadc17d2ac7a56f174b0752f5a67770b8413dad87a248ef5502e323e0345282eac136b2e0467d5bdee088e53287e18ad6804c91a30fde6d45c26f39a560
- SSDEEP 24576:L8d+H5/wzK0K+3AOzTORk0U1BPfypVXISyXthAeagonjfQVp:QGRwO0KYfPORkrHyXCXthzagmQ
- TLSH T1CA558D1A626C41F9D1BFE17C89878A4AE7B17806037187EF13A8475A2F276E15F7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\GoToResolveUnattended.exe
- Size 409KB
- SHA256 3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9
- MD5 bf5b71caaa5051900504a20a670981aa
- SHA1 747defaa7994ef6a9b9b736def73d8e53ff9f0e3
- SHA512 0ebf2412628bdab69e99d2acef8a17005d82c8ae4192e03e3c60eef9e2cd09beaaa1ea294c2bee7bfc4be04c8e783a5af61b348957984b84b915acea384f76bb
- SSDEEP 6144:/vFwjIKCan+HIlnusRWaUnox9CdER02gOu6+nbjAOdBIa3Qv6EVZo:/vFwkLan+olus6nox5ybjySEVG
- TLSH T1AF949D127A81D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\LibGoToResolve.dll
- Size 19.5MB
- SHA256 ddf3244decb29688d6a1972d3004f92bd365700bc77606efce8013a3677c6a83
- MD5 d7a242def5ff195ea246e33e28413999
- SHA1 3ba086b87fc81c21673252b70f8d29bb91d45a56
- SHA512 659e016968f18af79df9a513d972dda79bc84d16f4aad9023df238c4fde946ca46ae856b60234a49a587aa002153097a44855100dc88bc6a22ba9a8319acbf70
- SSDEEP 196608:muMIO5dY3td4PLTm1lW3ILzUmMcBs0Qooa4C7Gs8Jsv6tWKFdu9C5qhnjxFJoHI:ZZiMYmh3H7H8Jsv6tWKFdu9Ckh1oo
- TLSH T13727AFD27147C0F1E98A11B9A53AAB3F8678A8504B2954D797EC3E1D99301D33F37A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\MediaClientLib.dll
- Size 14.0MB
- SHA256 16729d5e7273b72c0fa05d08734f558c9da7f939900dcf38c1356edbbdade0c5
- MD5 99c94e16cc0b360eea8164a74972092b
- SHA1 280cd506fa6e0e1a586fbfc6265f43ab40eea2bc
- SHA512 d6e6ac52ba9d8ac4faf718897ea2b33a690b2f757c688072ca628eee03a50b374ba777641620f4e0310fa82453b1de6a1cb4e88bdb0d58f9c5f899ca0a075d51
- SSDEEP 196608:nVf8Kglmgw143el82aJdnv4KMGx715CARN775eciChoUCCp1kxJ3gF:nVf8vRC4HnhMc5Co5F8GkxJ3gF
- TLSH T16DE6AFC1E1625174C9461870AD3DAA3E6E28025D87B089F7BBD85CA07BF37D0377A786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100
- MD5 acf440dd02b14609359844366e281ef9
- SHA1 288190791a137dec98109104392a13eba4ae6abc
- SHA512 4d7b7b09903145319ea1509c56cd60fcfcf932fbf9396697ac3ecfb8bd9e7f8e3453579954812f8b58f38f9971627b4dd252deb172f085f4aec5c364e0ebce6f
- SSDEEP 24576:4ZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr54:lYM801G81cOS5TI1hr54
- TLSH T1C9458C03BAC189B1F5AE06B448B6B33C897EBD704734C5C75BC8688969715C1BB3B396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 26ef547a3826662bad9ca7fc66afca44115c5559c087d294715a874a990f8331
- MD5 f84c70161db46cda3cb7e6fc325220ef
- SHA1 ff37568ab12d3152259c54acc5f42d751ed7d63e
- SHA512 1ccc3e85e357755da2b9ef40106f6ada2041baa2a34c1153eda8d5eb84c9fa0f73a521137eff5c49cfa9ae258c569c45d01d8c99ffc1f281ba0bf680931df30f
- SSDEEP 48:ozpyOY7yh0f4q4kiL5PYUziiUC5ph7B1Ybuei3XqPYUziip5pPH7B1Yb8Zei3X9w:o5mGe45BiXI1Ywcie1Y2XQxNYfblg/kK
- TLSH T1DEA13398085531B62371A69DFE971C46D1F22D4EBCB8A6741FC959460ACFF2573E3430
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\appdata\GoToResolveUnattended.log
- Size 3KB
- SHA256 c0796612995822ae151d94d5928fd868b596f717696d61304d6b499cdfd8b8c9
- MD5 3edd0d156296e973a6c5b33a151475be
- SHA1 e1c4527f0eee6c0447a84b6cd88dfceddfe76814
- SHA512 482c9e66a04713391a9d0d829df67f73e1b7512833a89c1aaf5db61fca4de0d76445582871c58802f1082df665606c0437dac393f23d876113c88fe565c253a0
- TLSH T16D719DD5080A34F382612125BE46AEC9F0A76F7FACD88C60A6F14D5C274BE0B9797561
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 7667612b7ee8efd38b87050f6a58b291831a90310c9a72b08179e66eec55b9d0
- MD5 afc23696090bbe82aae9e8b108d6cbd2
- SHA1 73d749b6ea4ce572cdf921c2f0fb210c7cc0d4c0
- SHA512 52ad3b9ccc99db60ef72adf786e6018a21edbc252bffd384e5a0540d845da4e826bb4f477b01121b3114e34fb84628a7776f66e877a5a86c28bbc35ca91b11fd
- SSDEEP 98304:SD+fVjyaabqoQPk1p7huA0F19IuPj1CPwDvt3uFlDCM:E+1yaabxyshuAkrIu71CPwDvt3uFlDCM
- TLSH T133567C6EA7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\libcrypto-3.dll
- Size 4.2MB
- SHA256 20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a
- MD5 e2d7132d06648c344f851a16d2830964
- SHA1 153034cc90a84282c15ca91b401f120a516435cf
- SHA512 552e4eb9bdd888ce2a177e795aeed88bcce2ab6f2c71617a6e8354d4d7c4ef6b51517172c1451a7be43a32a1a7a97fb9febe5222f519a3ed99c13f19d5e8eeac
- SSDEEP 49152:Fyx0uEV3rsWweF37k5FyOgvMbziX+cg1CPwDvt3uFlDCPSmFzO2rnd:w0uEiGNOhKX+P1CPwDvt3uFlDC7
- TLSH T12B26BF12FB936591E8CF927D12EEA33F0E3D5B14872489D38EA615E9C8256C0773E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\libssl-3.dll
- Size 1.1MB
- SHA256 9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf
- MD5 753cfc508dcc0883db50d5069cd81a4f
- SHA1 c8193d2556392324007f6a4e916620b85600c24b
- SHA512 3137c88fe025ff3e3bf068f23b31ab7d3a468c5fee172726e25351aa83c4b5cdb89b000d03b829c35cba0f13d0d5783e11a6db3c29da23a81b57158d725f9ff9
- SSDEEP 12288:OasfmiM1aHnChqPS3/pziY7g6X5zTR4bQT6clxHlhhNFXN2WcrFe9XbOz5:tsfmL5VbRl/f0WcrFe9XbOz5
- TLSH T10135AF11BA814970DCE661BE06EDB77E473DA2601318C9C78F8559FADE206C16B3A3CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\mandatory.json
- Size 1KB
- SHA256 f35ead210077a1d8ef3dda3f096525cc4faf87eec0d12e6238848624dd5622e0
- MD5 a42a9a6efe360f3eb8c88445d862e796
- SHA1 3aa1ae3e4ad58488706c7c0903e6a083110c35a0
- SHA512 194934432577c9d1e56b4380f8ff0c3f5d4753c0a6a4f1b98f88e3589d6d5a1875bbabb4abbcf5b645151d41d5acd41d91b68d8db72c50a82a0dbc6faf88f1d7
- TLSH T1C511F0B0D8601D7A2751ADD0CC31594A72624E678C88B4E5BB4D1A0E0F8FE7F31B257C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\unattended.json
- Size 1KB
- SHA256 801e9b3ce7268033bd1cb8a29c13413a789286abddfc311835edcf78ed1b9c6b
- MD5 f92568f6162795af75f469b3a080fba6
- SHA1 26cbd782c48afad0ba21306f73014ae1fff5bb94
- SHA512 aaffded2d83288e4e1f07dab49190a443bcc4b4c63680870e4e1bb1bb2026b240527bf59e5bd351122da63818ed92691b1f10f537238bad2849e490769281fc4
- TLSH T17021D0A0C8912D762711ACD0DC29154AB2624A674C88B4D57B491E0F0F8FEBF31B297C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\unattended.json
- Size 698B
- SHA256 3dc857e1bdd9fb874053aa3e2f6885cf134f936c3f1a9597ce7175da7aae820a
- MD5 f198eec9b97de2d142b562758407dd7a
- SHA1 071fe2821b7edb9308e8c94911019da0b05b3fd1
- SHA512 e8c6ef30f23429f01b3cc7bded98c5472166fd4e43b30a0deafde17fe08a9d27e6f97f93314919c576038dac1a5347d53b3cbde23ec46623af9f9410e51e47b1
- TLSH T1D601C0A11AF5213C1713BDC8CC6E544EE1E20C8124C8F8D6D90D2E0F04D3EE33146434
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\unattended.json
- Size 1KB
- SHA256 b1339e053e2c83626665fa612aba08480ae3a21b5a7760b1b9d280f87ff3774e
- MD5 3d51a256ff59fda8f2d3f4a83563d235
- SHA1 5abc0795080d5c021b33260bbc66f1af13b89d59
- SHA512 5acf1d0da49224a3b292d96fefc3041326c27d0698519abf3ad738b80b8d11f66c894fe19393f45b1306ebc984586f8d34cc9d5016fe8c9a36692a0d5bd64620
- TLSH T1B111D0A0C8902D7A2711ACD0DC25154A72624A674C88B4D57B490A0E0F8FEBF31B257C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\711050222054191376\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 14fc4a36941bb2e4fc1ba2e1f4941ed7f4dc3ff71db504f5c57e35e71fee0e4f
- MD5 01ba6db664825c80c61aa7ffd5b1b0aa
- SHA1 288279294b014366e6ab2e320a929dfe087f5d46
- SHA512 a30cfc8282a67606921da58931bde85f4855a41d08634ff37a9f4fc98a849f4fc6c04fe74913fcddd0c13b458882ad273e48b626b619a4b7fef7442e9d99fd73
- TLSH T1C001108339AB19B03A8C45B8CD84929DA0E764582ECB1E9AD43524CCD467627BEB3015
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 727B
- SHA256 5243e5da020288a8b375aca9c508da399bfd91a3e5ebcb4841c472ba5a7c8d00
- MD5 76c2f553b48bed59d978a1e0d25de104
- SHA1 efd59b554e8fc4e54b0b8953f3f03484891ac882
- SHA512 d42f3066b4295e2837100345bd86408c23fc101d56a891f9e50fb4e298eca464aac4ee1d84d0ee8d1915e363eb8fed972643bc4dcfac1f15e837af8dfe190655
- TLSH T18C0194606C742380E4B2484D4EECAB1D3F0C8A5620D1003B3B7613AEF4E3A121FE53A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 0962cbeabb3d1b4bedffaa0aa58d015ab53ec3b3206b2a4e7ba79f686730c9b5
- MD5 5eae5ded22b073bfccd7de2ac2835b55
- SHA1 bbb98fc05d94b364efc83090d1ee9382fdb0d82c
- SHA512 47d70df96a2c8357ec60c67dcdf7cc8699c4a605141081883a3a589b4e72ebd5f0df0423a1488e85306db585eb2f51aa0d21fa48d57eceb707e21f08665253bf
- TLSH T1D3E0C0251DF1026DF3BACA759FC2B5535809F1539C00C7A80F90054CDA08B100E528B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 993b6bfae14ff26807a5905c68b9075c014ef4c7bbeee4cbd5111ef837ddae2d
- MD5 ab73eaf50a72a929876130f48d888c45
- SHA1 5db36c11808556ddffddad132e2157470cdea0ba
- SHA512 67cdbbf0010a1fdd17333766e331a885fdfb25825b41d894a389e3ac4f7fe1088ed726ff7df3b7a34f7d5d0e0ec85c2519476e26054f1c4762439f3f16c16540
- TLSH T16EE0C63422FA441EF0F4E13402FA68221E09F2670801CBAC2AC02629AA24A804DE2AB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\admin%20collaboration.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini
- Size 413B
- SHA256 bfedfc8db45c1c48eab6b5a5de23aa6034c124328941ce876c61fd8635c479c3
- MD5 e7ad932c89a96c7ea594c01d0365b43f
- SHA1 bfbfd9634444e9b7ccd64ae591c444d6f4d398b7
- SHA512 afa121fc91607ab3ad40f37cc83a78031a80cbdc0de332cea95d270a8f078d2b66d2f1a4e150a0cb67defb32a9d06a791829d2278ca0bec0134fb9dc6a4bd0df
- TLSH T158E0ED0B70B486ED720899009B0B2B6AF8A9F20B24E4A2D2B2B09C00070AD12FF69504
- MD5 SHA1 SHA512 TLSH