Overview
overview
7Static
static
1SWIFT_MT10...12.vbs
windows10-2004-x64
5SWIFT_MT10...12.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...56.vbs
windows10-2004-x64
5SWIFT_MT10...56.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...52.vbs
windows10-2004-x64
5SWIFT_MT10...52.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...25.vbs
windows10-2004-x64
5SWIFT_MT10...25.vbs
windows11-ltsc_2024-x64
5hqDQjP/56737352.pdf
windows10-2004-x64
3hqDQjP/56737352.pdf
windows11-ltsc_2024-x64
3hqDQjP/Log...ed.msi
windows10-2004-x64
7hqDQjP/Log...ed.msi
windows11-ltsc_2024-x64
7hqDQjP/install.vbs
windows10-2004-x64
7hqDQjP/install.vbs
windows11-ltsc_2024-x64
7Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_59643712.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_59643712.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_98064256.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_98064256.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_56737352.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_56737352.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
SWIFT_MT103_PAYMENT_04.pdf _05987725.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SWIFT_MT103_PAYMENT_04.pdf _05987725.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
hqDQjP/56737352.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
hqDQjP/56737352.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
hqDQjP/LogMeInResolve_Unattended.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
hqDQjP/LogMeInResolve_Unattended.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral13
Sample
hqDQjP/install.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral14
Sample
hqDQjP/install.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target hqDQjP/install.vbs
- Size 7KB
- Sample260730-rnrvxstvbx
- SHA256 66cd2d2a533b9ac820fd8c760e8390274e02ca0c96c3646786383102f2b76545
- MD5 d2567038bfcd724a1992159cba3f6f55
- SHA1 79a2f57da31229293cbdbccd1eae0a67751e472e
- SHA512 d6d14d98d34f97c839a4c4400092a1ed29fd626a49df52565007bbb2cbe9d31176302f7c091cfaa8efae23f7501e65374019806650e21f86f876287c5de6ae6d
- SSDEEP 192:c1O5A2wy8J5HNBo2V+KvE+lKyFVrNPT+82OuTa4SfqPwY:cuA1bBa2MKvEYKyFVrNPT+1OmIY
- TLSH T1EDF19257BEA3433096D384A891AA0C2D96E6D727506B4492FFDC48941F18BFD93F08D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 7 IoCs
pid Process 3620 unattended-updater.exe 5952 GoToResolveUnattended.exe 2368 GoToResolveTools64.exe 5588 GoToResolveCrashHandler.exe 3548 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 600 GoToResolveCrashHandler.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral13/files/0x000700000002466a-27.dat rat_gotoresolve - Loads dropped DLL 24 IoCs
pid Process 5536 MsiExec.exe 5536 MsiExec.exe 2368 GoToResolveTools64.exe 5952 GoToResolveUnattended.exe 5952 GoToResolveUnattended.exe 5952 GoToResolveUnattended.exe 5952 GoToResolveUnattended.exe 5952 GoToResolveUnattended.exe 5952 GoToResolveUnattended.exe 5952 GoToResolveUnattended.exe 3548 GoToResolveProcessChecker.exe 3548 GoToResolveProcessChecker.exe 3548 GoToResolveProcessChecker.exe 3548 GoToResolveProcessChecker.exe 3548 GoToResolveProcessChecker.exe 3548 GoToResolveProcessChecker.exe 3548 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 2852 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe - Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\SET6BF4.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\SET6BF5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\SET6BF6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\g2rvdd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\SET6BF4.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\SET6BF5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\SET6BF6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\g2rvdd.dll DrvInst.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 2532 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM32.exe unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveTools64.log GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIscrhook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTerminal.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattendedRemover.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveServiceManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRegistryEditor.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json.tmp GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRemoteControl.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIscrhook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\WebRTC.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\libjingle.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveQuickView.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\google-flatbuffers.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe msiexec.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.cat unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\chromium-crashpad.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveNetworkChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnlock64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\Thalhammer-jwt-cpp.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\openssl-openssl.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveLoggerProcess.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveService.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveFileManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\gabime-spdlog.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\microsoft-gsl.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveExternalModuleHandler.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\legacy.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.cat unattended-updater.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI3FF2.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{323BFC02-FFF5-428A-A831-696BD6812855}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI4822.tmp msiexec.exe File opened for modification C:\Windows\Installer\{323BFC02-FFF5-428A-A831-696BD6812855}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\Installer\e583c29.msi msiexec.exe File opened for modification C:\Windows\Installer\e583c29.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI432F.tmp msiexec.exe File created C:\Windows\Installer\e583c2d.msi msiexec.exe File created C:\Windows\Installer\SourceHash{323BFC02-FFF5-428A-A831-696BD6812855} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5832 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3724 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe - Delays execution with timeout.exe 2 IoCs
pid Process 4340 timeout.exe 2412 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveProcessChecker.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveProcessChecker.exe - Modifies registry class 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqDQjP\\\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\ProductName = "LogMeIn Resolve Endpoint" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\PackageName = "LogMeInResolve_Unattended.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20CFB3235FFFA8248A1396B66D188255\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\hqDQjP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\PackageCode = "2FF0721D5660CD749B83F35AC1129B18" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\ProductIcon = "C:\\Windows\\Installer\\{323BFC02-FFF5-428A-A831-696BD6812855}\\ProductIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqDQjP\\\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Version = "19070977" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Media msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 msiexec.exe 2852 msiexec.exe 3620 unattended-updater.exe 3620 unattended-updater.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe 3292 GoToResolveProcessChecker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1908 msiexec.exe Token: SeIncreaseQuotaPrivilege 1908 msiexec.exe Token: SeSecurityPrivilege 2852 msiexec.exe Token: SeCreateTokenPrivilege 1908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1908 msiexec.exe Token: SeLockMemoryPrivilege 1908 msiexec.exe Token: SeIncreaseQuotaPrivilege 1908 msiexec.exe Token: SeMachineAccountPrivilege 1908 msiexec.exe Token: SeTcbPrivilege 1908 msiexec.exe Token: SeSecurityPrivilege 1908 msiexec.exe Token: SeTakeOwnershipPrivilege 1908 msiexec.exe Token: SeLoadDriverPrivilege 1908 msiexec.exe Token: SeSystemProfilePrivilege 1908 msiexec.exe Token: SeSystemtimePrivilege 1908 msiexec.exe Token: SeProfSingleProcessPrivilege 1908 msiexec.exe Token: SeIncBasePriorityPrivilege 1908 msiexec.exe Token: SeCreatePagefilePrivilege 1908 msiexec.exe Token: SeCreatePermanentPrivilege 1908 msiexec.exe Token: SeBackupPrivilege 1908 msiexec.exe Token: SeRestorePrivilege 1908 msiexec.exe Token: SeShutdownPrivilege 1908 msiexec.exe Token: SeDebugPrivilege 1908 msiexec.exe Token: SeAuditPrivilege 1908 msiexec.exe Token: SeSystemEnvironmentPrivilege 1908 msiexec.exe Token: SeChangeNotifyPrivilege 1908 msiexec.exe Token: SeRemoteShutdownPrivilege 1908 msiexec.exe Token: SeUndockPrivilege 1908 msiexec.exe Token: SeSyncAgentPrivilege 1908 msiexec.exe Token: SeEnableDelegationPrivilege 1908 msiexec.exe Token: SeManageVolumePrivilege 1908 msiexec.exe Token: SeImpersonatePrivilege 1908 msiexec.exe Token: SeCreateGlobalPrivilege 1908 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3776 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe 3776 AcroRd32.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1908 2532 WScript.exe 85 PID 2852 wrote to memory of 5536 2852 msiexec.exe 88 PID 2852 wrote to memory of 3620 2852 msiexec.exe 89 PID 3620 wrote to memory of 5952 3620 unattended-updater.exe 91 PID 3620 wrote to memory of 2368 3620 unattended-updater.exe 92 PID 3620 wrote to memory of 3724 3620 unattended-updater.exe 93 PID 2368 wrote to memory of 5588 2368 GoToResolveTools64.exe 95 PID 3724 wrote to memory of 4340 3724 cmd.exe 97 PID 2532 wrote to memory of 3776 2532 WScript.exe 98 PID 4692 wrote to memory of 3684 4692 svchost.exe 100 PID 3724 wrote to memory of 2412 3724 cmd.exe 101 PID 5952 wrote to memory of 3548 5952 GoToResolveUnattended.exe 108 PID 3776 wrote to memory of 2884 3776 AcroRd32.exe 110 PID 2884 wrote to memory of 3068 2884 RdrCEF.exe 113 PID 2884 wrote to memory of 940 2884 RdrCEF.exe 114 PID 2884 wrote to memory of 940 2884 RdrCEF.exe 114 PID 2884 wrote to memory of 4088 2884 RdrCEF.exe 117 PID 2884 wrote to memory of 4088 2884 RdrCEF.exe 117 PID 3292 wrote to memory of 600 3292 GoToResolveProcessChecker.exe 118 PID 2884 wrote to memory of 2144 2884 RdrCEF.exe 120 PID 2884 wrote to memory of 5640 2884 RdrCEF.exe 122 PID 2884 wrote to memory of 3952 2884 RdrCEF.exe 123 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\hqDQjP\install.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\hqDQjP\\LogMeInResolve_Unattended.msi" /quiet /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\hqDQjP\56737352.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=37C27B89B053102DA68E2CB72FF04D83 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5D4D75F2EAE1B22B515DADA0CF5A8392 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5D4D75F2EAE1B22B515DADA0CF5A8392 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:940
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B6A5A2FE2E6D591D3E1E99ECF0824588 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B6A5A2FE2E6D591D3E1E99ECF0824588 --renderer-client-id=4 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4088
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=48FAD033D65C1E20F9EF0F14074AB5D2 --mojo-platform-channel-handle=2760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2144
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=783F96CBF841BA1C03A8D977E7D6E00B --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:5640
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16DFEC6D72F5D63BD34D3BD0159E85B4 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3952
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7DEA21FD4DED91193262E6252AAEB8492⤵
- Loads dropped DLL
PID:5536
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe"C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\hqDQjP\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{323BFC02-FFF5-428A-A831-696BD6812855}" "-MsiUiLevel" "2"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\hqDQjP\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{323BFC02-FFF5-428A-A831-696BD6812855}" "-MsiUiLevel" "2" "-installerFileName" "LogMeInResolve_Unattended.msi"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 5952 -InstallationId YGjayIPCot -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType 4 -Environment "Production" -ForceInstall 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3548
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe" -InstallVDD3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=1fcc204f10509ea3749102a9660122da --annotation=format=minidump --annotation=hostname=Meeepegr --annotation=platform=win --annotation=version=1.35.1.3628 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x3ac,0x3b0,0x3b4,0x3a0,0x3b8,0x7ff6149d04e0,0x7ff6149d04f8,0x7ff6149d05104⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5588
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:4340
-
-
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:2412
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf" "9" "4e1e440a3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3684
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType "4"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3719837408790104989 --annotation=component=Unattended --annotation=computerid=1fcc204f10509ea3749102a9660122da --annotation=format=minidump --annotation=hostname=Meeepegr --annotation=installationid=YGjayIPCot --annotation=platform=win --annotation=version=1.35.1.3628 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x7d4,0x7d8,0x7dc,0x5c0,0x7e0,0x7ffcb5f8d0a0,0x7ffcb5f8d0b8,0x7ffcb5f8d0d02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:600
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:5832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e583c2c.rbs
- Size 7KB
- SHA256 4df6ae127b4b3fdba7721fbd80dd51a87cfe2686970471a535ffd8954b9a37c2
- MD5 ebacbbcf49593ea381349c820fdba9ad
- SHA1 efffa2a7bcecd8bc3f43c181af476cc5d2d87a5d
- SHA512 70e3732563bdac31566572d6d088d4d2f2826dc25a8dab63466704a020a7177903a07fa688974756b3e33a5eda0a01f0cef59832c307c1d99b34091a5d152147
- SSDEEP 96:Bm2tKJCZpqeq2Q7Wsvd2COTlxWsvd2Cgjt5zaBTl9a9x5wyijKHw5Cqplj9rOFyI:82QJje2aIlG2Il/BazBscqpuH
- TLSH T144F132812B0A51E3E9976B39D71707583B72E3985351230B09CE94386E67FC51F982BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\371983~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll
- Size 21.8MB
- SHA256 20cd98d5a5bedea833d1c20b7ce2fe665fdc2c740629324a4fc2585cd01a5c3a
- MD5 0b375ad0157c3eead2199bf5565938a1
- SHA1 a368cfc599abf914bb66c743c5e593d91a14a905
- SHA512 0b495ab3b748f2a47107c053487d9296ff9d5d2d368e38fb2f1581fc3eec342b1a46e8a622b91c07113e7f7a23a9bb766e44968889a8ac0986f14360f6b0b5bc
- SSDEEP 196608:8OrKh6nE8gTUY7CuDuzCKFdu9CwJsv6tANNVYX1k:8yi6nE8U5wCKFdu9CwJsv6tCNVYXi
- TLSH T1DD377C17A3E91189E4BAD1B99B979A17EB7138050330A7DF02A067252E37EF45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe
- Size 826KB
- SHA256 cd5ada0836e9e4466ff525dbf972cf29de2690b61cc9ce7ebf550e2ce06b5a17
- MD5 42314c843984d071d72dc54b2c769cb3
- SHA1 adeeb591a11e12d8ecc68d2a73bdd58bcc7cc251
- SHA512 b5b204c85de66307cddfc99f9950c07993250618ee168580fec06b8a3a69a92d3af53d52e5a16c70a8650eed6de7b8d0b0c5da20d86b698daad746cd7d2dcf11
- SSDEEP 24576:/6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji3y:/6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmaP
- TLSH T10D056C5BB77801F9C177D138D643A907E6B6740B43B09ADB13A043AA2F13AD4AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe
- Size 507KB
- SHA256 24f7e0c91b7b521f3321938c8986f33f3c3ee2946e378247572823e882ec15ec
- MD5 ae023ee79a3ea796b4b53fb4b79f4260
- SHA1 b1f61e3ce7c6e4288289835a829a9962dd2b7fe5
- SHA512 11df906b40e49e8f4f6dcd60c3d953bd9a8b0ec98386b4fee2a54fcbd05dabcebebe34f40fc1a8a1603381985d9e3342a39d4100b2a5cfd9f7e965ae256a3246
- SSDEEP 6144:wfParRr/K3cCXAzucWHF5HKIFnWmfug+PU4QvLd7TaPq9/ZZ/xHl+ka:ePIyX/8INjd+PcK69xHLa
- TLSH T168B48D19A29841F9F16BE138C9424906E7B2BC051361D7CF43E4BAB66F736E05E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe
- Size 5.9MB
- SHA256 356e761c251a98e8a0af5ad2c4bad44ab3b9e252c3d268397171fe17a44ecd1f
- MD5 2c1a898bb8acdaab4796757cc668d48e
- SHA1 6d16d667474822ec0b2ee4827144e3546610bacb
- SHA512 48c99339f94cdb539bcb4c562c3f90a0b085d87054133cd11e601947336b95f439be16d21d7708f4cd75e68de09882b4f322c82f977d853d41b52a5053b1b7fa
- SSDEEP 49152:Lw5aohMFAdaHprhYIzBZ03lICHAnK0ChBaBT6W09tOvF149dliWNCMOhYWdV1SNZ:LUaUw6gCUFRS3KFdu9CwJsv6tusNB
- TLSH T119567C17A2E60194D9BAD078CA679547FB727C0613306BDF02A0A2566F73AF01E7F325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe
- Size 507KB
- SHA256 11637654df7de141c9de1116a173551e7da1c3733fe9067bcd040e38ddd16863
- MD5 de2e7785c1e0151d69a888ed8c5696dc
- SHA1 7eb58839351ab1b045d0ffc62db7f1e8e97b0ec3
- SHA512 5caaa1f4a2c3cc8b00cdca42a74689c90ef56061eff2fb4e87d32f19e3842312e6c38a1a2c7ca9363ae834e22e70cc74453651e4fb29be481ae732c5d281be59
- SSDEEP 6144:T7Ha7RI0KXcyXzjucWHF5HyIFnWmfuQ+PIOXvLd7TyrjOqW/3hNl+k:PH6iXO0INj9+PB28/3XL
- TLSH T10DB47D19A29841F9F16AE139C9434906E7B2BC051360D7CF43E4BAB62F736E05E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll
- Size 32.1MB
- SHA256 b15588151ccf2d07516ee19d957718ce3e068b408c17c63fda93f5edd6e2fa86
- MD5 e524f49f427d2be159246456d7b31d2d
- SHA1 bfec33ebcea2655d1b82b8e3032847c0140d1b81
- SHA512 ae7d237bc6f8502703fd95833c8b64cb810f241fd546f0af620ecbcdcf8b33e5a3f842fc7e75d71ccd2d84a2762970593c09b7b36b504b918864445690e82214
- SSDEEP 393216:qElh/Awgyaq4ZxCyb1Etcc8BOKycRC0YCQW3KRJKFdu9CwJsv6thBI5:pay1yfhyPCf3KRPI5
- TLSH T108778C07A1FA05D8C1B6E0BCEA679907FBB1340513356BEB05A882B52F63BE1593F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll
- Size 19.1MB
- SHA256 7bb0b7e3c14c894ee616d7ea8a6c116980b6d60d3c92694c5a7d1219295203ea
- MD5 de032df65adf5b44fe98c0599db7d082
- SHA1 41fccab2887234b1bba1502f78a30fed60cc9183
- SHA512 28e91b73595ecb717cac0f902b9de006e3e82cd28ff60de022fa6dccf78360274733df7d7536c0c803714b1ce397e1ad72e5c50043693a2eb10a12665b51569d
- SSDEEP 393216:dJ2WV0i6tBoTFcma5bWSqT1sz6DxYLa1y5aLdbM/eO3Gg:2mCN3Gg
- TLSH T1C7178E4BE29250F8D45BD474975BAA22FA24384E472469EB17D08B703E73BE07B39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll
- Size 3.5MB
- SHA256 2e365cdef412cc390835cd4c61c20f0e440d5905e538085b9d51310f1b9ca005
- MD5 189b1106d32bf5e9a68bcc3f908311bf
- SHA1 1976fb83a614ef8a1638589d1f6d8bf2eb303e25
- SHA512 531a7ccd3f642df626ea0c52f99aff98ed05641f01db1eb4f521b195892b4ab56204882c88c3ea88f31753ade20958ebf3c4df0e2123e0dea49ad303bc7eb7d8
- SSDEEP 49152:BGtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvmf:PS+ZC+b65hmMorxeNNg
- TLSH T1C4F59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log
- Size 7KB
- SHA256 ba8430cc44236cf679a8129d4e01b1893674bbda5bb4a80b1304d40362c2c682
- MD5 0317cd6fc540fa663a6ef5a2617f775e
- SHA1 65f5043a71447fe85bb7b80cf939b4fb12137765
- SHA512 28f06857fecb3448c5f9dd691c11b1c550228d6372bbac85f291cd9ba20b4e99f2e7f0db4dbe2e4fe23a9acdd50e78572f3b2d628283d8d59b2a1fe953a14641
- SSDEEP 96:oQ8eeR/X3wLHiiHoX2fYbKOjfkXjAZU/X3wLHiiHoX2fhkFo:+eev3KHijz+cuEGv3KHijK
- TLSH T164F124D908563CF62369AA28FE450ADEC1F1645C89B864E1DBC875271BCFF2633D7024
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll
- Size 7.6MB
- SHA256 74e3692327b1abea5677f988055c2e7d729f4379f86f8050a47a2469b84bedc6
- MD5 ec1d4b202d12844b64bd059f00cfce72
- SHA1 279d010ed1b2c82dda3d0db5dcbb62d03c5a9e65
- SHA512 5500fb42e465ce718e33d5b4b69b508dbff62caa9a148e621fa500d032f3b2956c746718d02c6fa90c23e1a3e233a896395d3acac40ff8bb5263882521e9bd77
- SSDEEP 196608:S3ETkrsM90J73luZRReAoh1CPwDvt3uFA0Cv:S3ETkrsM90l3luZR0Dh1CPwDvt3uF3Cv
- TLSH T119867B6DA6BC0149E8BA82BDC2875627D771B91907B013CF196196F80F23FD92B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll
- Size 1.9MB
- SHA256 ae8980a3d38dcb847d8ab544f344028268ea42602ba5c4dcd4706828022b2280
- MD5 12ef49f3d71a1b606a1b8b28fcd586b8
- SHA1 3b882419990319263e877b413165e2c704fe9575
- SHA512 ae9830ca8ae86ffd1caee068db6b86e4872c4d96d0be0101fd2c25157843b9a91519bde9868447908504aef51a3f108077eda6c05fd3d5643513ef8940a41560
- SSDEEP 24576:psETwcxJHIqeZDxTNZiQtdwCKlDABwZeVp4r2WTLHghrRg5aYsK:uETwcxJHIqiNZ7rKlD0RrRg5aYsK
- TLSH T1B0957C5AA7B81199E4F7D13CC6478B17D6B2B8192370A7CF06A086B91F23BD9173E344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json
- Size 1KB
- SHA256 e9411338dd2ea5b960dc31880ae3b16def309f72ea332a3ce1a52ee2b4f8daaa
- MD5 395ff14ec18c3bc5c8f7eb43a4041045
- SHA1 56d46a38a6f8564b03deb9f29c4617e504bbfeb2
- SHA512 9bde2c6a6b47ae9bf91148ce244eb195d36f3c5ea404c9c2fa53b13fbc0943c42808d94b37c208476466874f9a2c49b40e2ea21fdf959c719ad21baf61c64e1d
- TLSH T1D8210FD0C9522DBB3701A5949D3917863271417B5DD830E2BB89191E1F8FE2F22B313D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 699B
- SHA256 7c2bdcd023ef2fb0b87dde5b93af983a4f0a91937b94076557d7ff7ce907052a
- MD5 e313b0c3b67285c850787557e93afcd5
- SHA1 73465defdedf030767487d0e6bb3b7d17c7d690d
- SHA512 2e4b482f6422ad8886d49bd15604042655bd816db50c843b72c27ad947774dd85b44e81a6c1a82bcaa521104cb3e8e67a441296374df6b7b9f26e20ad26991b1
- TLSH T1E70170E60EF6357907037ED8CC5E645EE1A5486224C8A8E3AD0D2E1A1493FA72187478
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 800B
- SHA256 2a1b87b934b7c7ae93dfa7c5ac6cd9f3cbf40fca0b4418435e9fed915ebede37
- MD5 cc6336fbf8e7773e158563462d54aa13
- SHA1 199f1c3a6b9a4e4a2e25b9ad2392b6fd3b8898e0
- SHA512 0032af6fba75dd0ea8ae30946372d00e212a371f544f842367ae6bcd893bfb05b0c9cc5c1e8790f5beaad6fa1df985515214434ef5cc73544c46fb4801a549e9
- TLSH T112016BE1CCA12E770B0199D8CC29244EB22148730C84B8E6BB0D191E1F9BE6F32B213C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 1KB
- SHA256 69bd76edd82b4e2fc7849ae35fb0d1b290dd9dd721d247dc4d13d78f2b622f81
- MD5 f4bb1b3997a5f2c6a0232260be71d8f8
- SHA1 7aae1e5468b6f67f999ff55637e09aa2550e58b1
- SHA512 253cc1208e1a91d44e871c0bb64318230751cf8853356594cb964c0aa9fd2a5e9aa86f4e56322ba4d6c5f1c992d0f7e354fefe69973cddacb6e2c117de292700
- TLSH T1BA11D0E1CC512DB71701A9D49C1A168A727185770C5474D6BB4D0A1E1F8FE6F32B316C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
- Size 35.4MB
- SHA256 60ceca48a2fb947a3e7dbc6baad3fe932fcde53fa86227c0b945785f399e095d
- MD5 af07cc0219f4604dc6cf3113d74dd2eb
- SHA1 bac921238605100beb64d9ca320a41f6083065e4
- SHA512 ad697c7f325ce4eede31eb6bf747feece86bd874b27066c1837f5fef886222e5683bec4c939ca1320e42fbf85159173ff6237a41865f01dc344fff16ac47a17a
- SSDEEP 786432:b1zCb7Tze8zqub4cXFVY0KWsFbXqTboVpWWqeq:btCb7f0c1VY0jyb64QWY
- TLSH T15087121BA2E501A4D5BAC078CA6BA547FB723C06133067DF02A4A6565F73AF05E3F325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 56KB
- SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
- MD5 752a1f26b18748311b691c7d8fc20633
- SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
- SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
- SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
- TLSH T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 64KB
- SHA256 8179b54bbb08e50d887a938dc56d48ac3ad76a71b34a02885a19d1ac42251c8b
- MD5 0bf0dadcf4d1101de634e9355b29583c
- SHA1 92b3bc6f0ee1c4876870de132e78c414d63b2bfd
- SHA512 98fc3991310de4f4c8c4821c713a1c289d8cc847f7814b4ec3dc420a350634f9c0f64673081efa11be430a16e084e77f88776729ad44515279ede27b096d9fde
- SSDEEP 384:yegdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:z+eUZsLQCZsL3hUS4
- TLSH T1F753CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI3FF2.tmp
- Size 5.7MB
- SHA256 4841eaaef07e56daef05eb61a2ce9acb023316ef0816aa32204c40c6176a56c3
- MD5 1252e6ad04195c9225dc094815c411c9
- SHA1 b9cef1939e8a83518b0d46e2659ebd7ec8e1666d
- SHA512 65072cd6513c5dab9099810f6fd204f17d0fca3da551030d21c93f7aa0f4850dca3e13baf2b340b48da4faaa0e3be1d03b25a6c82f3b5638ba170d6f7e88558a
- SSDEEP 49152:Mbj9ysbs9yIG1gDOAFhUHU/w5UT8UtAue32O8QXWFvTPrH9/nr3DEBWSMd2Ewrj5:MbN2QjmFracF5cKFdu9CwJsv6tMhG
- TLSH T1EA567C17A2EA0158D9BAC178CA6B9547FB723C0653306BDF02A0A6556F73BF01A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e583c29.msi
- Size 37.2MB
- SHA256 16f92782bd3b522b24ea25c3c0707f75d538d49a99b490ed3c24124a6d586535
- MD5 61a515dee5380a93bd5afe980d7dd1e7
- SHA1 0ba0a003eaebd19967bd9c031c8271d709743a82
- SHA512 78b0e3b5d77409b363da181db5e1012e7fff15fdca0cc775b601edfe732c6e221cdc0082ca2725a3644f2518505bce3f1f64bc3d8a1d3ccb998d7e00a62765e9
- SSDEEP 786432:6dwm/GCb6M1VN4OkZVIpkOs0om4B+vf74BALjAZ:62meCbpKVokOsVRBO02j
- TLSH T1EC872217A2EA0164D9BAC138CB6BA546FB723C0513306ADF02A4B6556F73BF05A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{7293d9be-28a1-9040-9bac-91b289c46928}\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 14fc4a36941bb2e4fc1ba2e1f4941ed7f4dc3ff71db504f5c57e35e71fee0e4f
- MD5 01ba6db664825c80c61aa7ffd5b1b0aa
- SHA1 288279294b014366e6ab2e320a929dfe087f5d46
- SHA512 a30cfc8282a67606921da58931bde85f4855a41d08634ff37a9f4fc98a849f4fc6c04fe74913fcddd0c13b458882ad273e48b626b619a4b7fef7442e9d99fd73
- TLSH T1C001108339AB19B03A8C45B8CD84929DA0E764582ECB1E9AD43524CCD467627BEB3015
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 727B
- SHA256 69cad82266bfddce643a6c2f6b909e66ca584e262e386baf7cac191b590e3e7b
- MD5 4d499bc7c90c822986626d7c897f3e4e
- SHA1 06a61a84fd1be62166fa7139655310f1f535fe1c
- SHA512 6c928ede4eb78c96107f7f0e04afb283a652ad734d1e3d888390db74c1731cec598dd3ef6e547b6e7e6648c5ce6bce69bdf98977ea3879a079f914167e0615de
- TLSH T108011503AB6A8E801B5C8D558FE2B665BED5023446E8554F516715847B876721602A60
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 130ebda3445c34bd893b472678e5453af70e930a594b51a0aa3593c541181f77
- MD5 6826c0fbb583d8be1eb0a530126268e0
- SHA1 34abcf3fd18d7af15f402a905c2b71b26a6c8a50
- SHA512 f2ec2023ca9dd09a914db59b8c85e2fba3b18c5d18739f2282ce1b9415018bad0151fd3578236d6110646ef4b54a3ba7b7d5fb824e951f41b82acd8413e4a0af
- TLSH T1D9E0C0151EF2012DF3E7CA798FC175524849F1539C0087A50FD0094CCE08B004D528B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 408B
- SHA256 b595a9b0989da3461783f52f49ee5b548c97ad0fe95ce422c474bb2b877ff0d8
- MD5 55c8127dfb744811623426b14364bf6e
- SHA1 a5ec21ef9e29714a9d44250198ebed38f3d133c5
- SHA512 505b36250c643898ae8aad1d14cda26e4de2daf62da8d9fb5c6136c93a1228fc7171ebd672cb062e57ddd6ee520c3b33bf76a3ee40bbd2fad1ca525ec02101d6
- TLSH T102E0C634B2FD008DF1F4E4B882F698326C8EF2263442C2A60D808785AB28B401CA2225
- MD5 SHA1 SHA512 TLSH