Overview
overview
7Static
static
1SWIFT_MT10...97.vbs
windows10-2004-x64
5SWIFT_MT10...97.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...31.vbs
windows10-2004-x64
5SWIFT_MT10...31.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...80.vbs
windows10-2004-x64
5SWIFT_MT10...80.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...67.vbs
windows10-2004-x64
5SWIFT_MT10...67.vbs
windows11-ltsc_2024-x64
5lhEHkL/60442180.pdf
windows10-2004-x64
3lhEHkL/60442180.pdf
windows11-ltsc_2024-x64
3lhEHkL/Log...ed.msi
windows10-2004-x64
7lhEHkL/Log...ed.msi
windows11-ltsc_2024-x64
7lhEHkL/install.vbs
windows10-2004-x64
7lhEHkL/install.vbs
windows11-ltsc_2024-x64
7Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_89259697.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_89259697.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_07131031.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_07131031.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_60442180.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_60442180.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
SWIFT_MT103_PAYMENT_04.pdf _73189367.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SWIFT_MT103_PAYMENT_04.pdf _73189367.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
lhEHkL/60442180.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
lhEHkL/60442180.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
lhEHkL/LogMeInResolve_Unattended.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
lhEHkL/LogMeInResolve_Unattended.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral13
Sample
lhEHkL/install.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral14
Sample
lhEHkL/install.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
General
- Target lhEHkL/install.vbs
- Size 7KB
- Sample260730-rr253aah27
- SHA256 66cd2d2a533b9ac820fd8c760e8390274e02ca0c96c3646786383102f2b76545
- MD5 d2567038bfcd724a1992159cba3f6f55
- SHA1 79a2f57da31229293cbdbccd1eae0a67751e472e
- SHA512 d6d14d98d34f97c839a4c4400092a1ed29fd626a49df52565007bbb2cbe9d31176302f7c091cfaa8efae23f7501e65374019806650e21f86f876287c5de6ae6d
- SSDEEP 192:c1O5A2wy8J5HNBo2V+KvE+lKyFVrNPT+82OuTa4SfqPwY:cuA1bBa2MKvEYKyFVrNPT+1OmIY
- TLSH T1EDF19257BEA3433096D384A891AA0C2D96E6D727506B4492FFDC48941F18BFD93F08D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 7 IoCs
pid Process 2152 unattended-updater.exe 2656 GoToResolveUnattended.exe 4956 GoToResolveTools64.exe 4592 GoToResolveCrashHandler.exe 3444 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 1216 GoToResolveCrashHandler.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral13/files/0x00070000000245c9-27.dat rat_gotoresolve - Loads dropped DLL 24 IoCs
pid Process 468 MsiExec.exe 468 MsiExec.exe 4956 GoToResolveTools64.exe 2656 GoToResolveUnattended.exe 2656 GoToResolveUnattended.exe 2656 GoToResolveUnattended.exe 2656 GoToResolveUnattended.exe 2656 GoToResolveUnattended.exe 2656 GoToResolveUnattended.exe 2656 GoToResolveUnattended.exe 3444 GoToResolveProcessChecker.exe 3444 GoToResolveProcessChecker.exe 3444 GoToResolveProcessChecker.exe 3444 GoToResolveProcessChecker.exe 3444 GoToResolveProcessChecker.exe 3444 GoToResolveProcessChecker.exe 3444 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4812 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe - Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe - Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232 GoToResolveUnattended.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\SETDC51.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\SETDC52.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\SETDC53.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\SETDC51.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\SETDC53.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\g2rvdd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\g2rvdd.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\SETDC52.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232 GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4520 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIscrhook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveFileManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\google-flatbuffers.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnlock64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.cat unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\chromium-crashpad.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\gabime-spdlog.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe msiexec.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveExternalModuleHandler.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRegistryEditor.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM32.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\microsoft-gsl.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveEventViewer.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\WebRTC.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json.tmp GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\openssl-openssl.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\legacy.dll unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveService.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRemoteControl.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.inf unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveQuickView.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveNetworkChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\libjingle.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.cat unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveTools64.log GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattendedUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTerminal.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveServiceManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\Thalhammer-jwt-cpp.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBF93.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIC188.tmp msiexec.exe File created C:\Windows\Installer\{323BFC02-FFF5-428A-A831-696BD6812855}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIBAC0.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{323BFC02-FFF5-428A-A831-696BD6812855} msiexec.exe File created C:\Windows\Installer\e58b6bc.msi msiexec.exe File opened for modification C:\Windows\Installer\{323BFC02-FFF5-428A-A831-696BD6812855}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\Installer\e58b6b8.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\e58b6b8.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2860 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2032 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe - Delays execution with timeout.exe 2 IoCs
pid Process 2824 timeout.exe 2228 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveUnattended.exe - Modifies registry class 25 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\ProductIcon = "C:\\Windows\\Installer\\{323BFC02-FFF5-428A-A831-696BD6812855}\\ProductIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\PackageName = "LogMeInResolve_Unattended.msi" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhEHkL\\\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\ProductName = "LogMeIn Resolve Endpoint" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Version = "19070977" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\lhEHkL\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhEHkL\\\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20CFB3235FFFA8248A1396B66D188255\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\PackageCode = "2FF0721D5660CD749B83F35AC1129B18" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Language = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Media msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 msiexec.exe 4812 msiexec.exe 2152 unattended-updater.exe 2152 unattended-updater.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe 4424 GoToResolveProcessChecker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1664 msiexec.exe Token: SeIncreaseQuotaPrivilege 1664 msiexec.exe Token: SeSecurityPrivilege 4812 msiexec.exe Token: SeCreateTokenPrivilege 1664 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1664 msiexec.exe Token: SeLockMemoryPrivilege 1664 msiexec.exe Token: SeIncreaseQuotaPrivilege 1664 msiexec.exe Token: SeMachineAccountPrivilege 1664 msiexec.exe Token: SeTcbPrivilege 1664 msiexec.exe Token: SeSecurityPrivilege 1664 msiexec.exe Token: SeTakeOwnershipPrivilege 1664 msiexec.exe Token: SeLoadDriverPrivilege 1664 msiexec.exe Token: SeSystemProfilePrivilege 1664 msiexec.exe Token: SeSystemtimePrivilege 1664 msiexec.exe Token: SeProfSingleProcessPrivilege 1664 msiexec.exe Token: SeIncBasePriorityPrivilege 1664 msiexec.exe Token: SeCreatePagefilePrivilege 1664 msiexec.exe Token: SeCreatePermanentPrivilege 1664 msiexec.exe Token: SeBackupPrivilege 1664 msiexec.exe Token: SeRestorePrivilege 1664 msiexec.exe Token: SeShutdownPrivilege 1664 msiexec.exe Token: SeDebugPrivilege 1664 msiexec.exe Token: SeAuditPrivilege 1664 msiexec.exe Token: SeSystemEnvironmentPrivilege 1664 msiexec.exe Token: SeChangeNotifyPrivilege 1664 msiexec.exe Token: SeRemoteShutdownPrivilege 1664 msiexec.exe Token: SeUndockPrivilege 1664 msiexec.exe Token: SeSyncAgentPrivilege 1664 msiexec.exe Token: SeEnableDelegationPrivilege 1664 msiexec.exe Token: SeManageVolumePrivilege 1664 msiexec.exe Token: SeImpersonatePrivilege 1664 msiexec.exe Token: SeCreateGlobalPrivilege 1664 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5108 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe 5108 AcroRd32.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4520 wrote to memory of 1664 4520 WScript.exe 85 PID 4812 wrote to memory of 468 4812 msiexec.exe 88 PID 4812 wrote to memory of 2152 4812 msiexec.exe 92 PID 2152 wrote to memory of 2656 2152 unattended-updater.exe 95 PID 2152 wrote to memory of 4956 2152 unattended-updater.exe 96 PID 2152 wrote to memory of 2032 2152 unattended-updater.exe 97 PID 4956 wrote to memory of 4592 4956 GoToResolveTools64.exe 99 PID 2032 wrote to memory of 2824 2032 cmd.exe 100 PID 3004 wrote to memory of 3068 3004 svchost.exe 103 PID 4520 wrote to memory of 5108 4520 WScript.exe 104 PID 2032 wrote to memory of 2228 2032 cmd.exe 105 PID 5108 wrote to memory of 2956 5108 AcroRd32.exe 111 PID 2956 wrote to memory of 5020 2956 RdrCEF.exe 112 PID 2956 wrote to memory of 5020 2956 RdrCEF.exe 112 PID 2956 wrote to memory of 3752 2956 RdrCEF.exe 113 PID 2956 wrote to memory of 1664 2956 RdrCEF.exe 114 PID 2956 wrote to memory of 3900 2956 RdrCEF.exe 115 PID 2956 wrote to memory of 4444 2956 RdrCEF.exe 116 PID 2956 wrote to memory of 2260 2956 RdrCEF.exe 117 PID 2956 wrote to memory of 2260 2956 RdrCEF.exe 117 PID 2656 wrote to memory of 3444 2656 GoToResolveUnattended.exe 119 PID 4424 wrote to memory of 1216 4424 GoToResolveProcessChecker.exe 121 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lhEHkL\install.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\lhEHkL\\LogMeInResolve_Unattended.msi" /quiet /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lhEHkL\60442180.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DF19C24C892C9711AE5E0A4344B8EA84 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DF19C24C892C9711AE5E0A4344B8EA84 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:5020
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DDFAFDA05B803BB0BC8E40C4C4E9B83F --mojo-platform-channel-handle=1864 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3752
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2AA2C7786789987758D5EA4A8574E1CE --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E0FC6732B4E95AC5BAE70277FC8C2320 --mojo-platform-channel-handle=2004 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3900
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8058F29660E44F9B2259883E22145697 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4444
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4FA52B9AC8CE62C06563C0459EF42B4E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4FA52B9AC8CE62C06563C0459EF42B4E --renderer-client-id=7 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:2260
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 4E19D79E6C06BC6DF7EF4CC1C37305D52⤵
- Loads dropped DLL
PID:468
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe"C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\lhEHkL\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{323BFC02-FFF5-428A-A831-696BD6812855}" "-MsiUiLevel" "2"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\lhEHkL\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{323BFC02-FFF5-428A-A831-696BD6812855}" "-MsiUiLevel" "2" "-installerFileName" "LogMeInResolve_Unattended.msi"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 2656 -InstallationId nootjs8rR6 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType 4 -Environment "Production" -ForceInstall 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3444
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe" -InstallVDD3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=eb20b1e653db2a9e2f6bea1a3db8913c --annotation=format=minidump --annotation=hostname=Epsydafz --annotation=platform=win --annotation=version=1.35.1.3628 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x3b0,0x3b4,0x3b8,0x3a4,0x3bc,0x7ff738b404e0,0x7ff738b404f8,0x7ff738b405104⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4592
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:2824
-
-
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:2228
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf" "9" "4e1e440a3" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3068
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType "4"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3719837408790104989 --annotation=component=Unattended --annotation=computerid=eb20b1e653db2a9e2f6bea1a3db8913c --annotation=format=minidump --annotation=hostname=Epsydafz --annotation=installationid=nootjs8rR6 --annotation=platform=win --annotation=version=1.35.1.3628 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x7d4,0x7d8,0x7dc,0x744,0x7e0,0x7ff9121bd0a0,0x7ff9121bd0b8,0x7ff9121bd0d02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1216
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:2860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58b6bb.rbs
- Size 7KB
- SHA256 7cc4ad3e66566e475508c4e087588c1ffe926a960bbb50757c475b3c82537776
- MD5 f73b2dceca28e01cb601502eea61982d
- SHA1 3df2f3c9c174913893ba4577f72b29b475d5d4b7
- SHA512 498c580a1645c4426bbe12c62cff3afc22b309ace307856b3c7af6b3b392d6189ad4bfce15a7bca0e910366394397e8f75329c9029ae95020129665c43543a98
- SSDEEP 96:bm2tKJCZpqe2dQ7WsXd2COTlxWsXd2Cgjt5zaBTl9a9x5wyijKHw5Cqplj9DOFKg:S2QJjefaglG2gl/BazBscqpWH
- TLSH T17EF112812B0951E3E9976B39D31717583772E3A85351230B09CD90786E67FC51F982AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\371983~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll
- Size 21.8MB
- SHA256 20cd98d5a5bedea833d1c20b7ce2fe665fdc2c740629324a4fc2585cd01a5c3a
- MD5 0b375ad0157c3eead2199bf5565938a1
- SHA1 a368cfc599abf914bb66c743c5e593d91a14a905
- SHA512 0b495ab3b748f2a47107c053487d9296ff9d5d2d368e38fb2f1581fc3eec342b1a46e8a622b91c07113e7f7a23a9bb766e44968889a8ac0986f14360f6b0b5bc
- SSDEEP 196608:8OrKh6nE8gTUY7CuDuzCKFdu9CwJsv6tANNVYX1k:8yi6nE8U5wCKFdu9CwJsv6tCNVYXi
- TLSH T1DD377C17A3E91189E4BAD1B99B979A17EB7138050330A7DF02A067252E37EF45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe
- Size 826KB
- SHA256 cd5ada0836e9e4466ff525dbf972cf29de2690b61cc9ce7ebf550e2ce06b5a17
- MD5 42314c843984d071d72dc54b2c769cb3
- SHA1 adeeb591a11e12d8ecc68d2a73bdd58bcc7cc251
- SHA512 b5b204c85de66307cddfc99f9950c07993250618ee168580fec06b8a3a69a92d3af53d52e5a16c70a8650eed6de7b8d0b0c5da20d86b698daad746cd7d2dcf11
- SSDEEP 24576:/6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji3y:/6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmaP
- TLSH T10D056C5BB77801F9C177D138D643A907E6B6740B43B09ADB13A043AA2F13AD4AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe
- Size 507KB
- SHA256 24f7e0c91b7b521f3321938c8986f33f3c3ee2946e378247572823e882ec15ec
- MD5 ae023ee79a3ea796b4b53fb4b79f4260
- SHA1 b1f61e3ce7c6e4288289835a829a9962dd2b7fe5
- SHA512 11df906b40e49e8f4f6dcd60c3d953bd9a8b0ec98386b4fee2a54fcbd05dabcebebe34f40fc1a8a1603381985d9e3342a39d4100b2a5cfd9f7e965ae256a3246
- SSDEEP 6144:wfParRr/K3cCXAzucWHF5HKIFnWmfug+PU4QvLd7TaPq9/ZZ/xHl+ka:ePIyX/8INjd+PcK69xHLa
- TLSH T168B48D19A29841F9F16BE138C9424906E7B2BC051361D7CF43E4BAB66F736E05E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe
- Size 5.9MB
- SHA256 356e761c251a98e8a0af5ad2c4bad44ab3b9e252c3d268397171fe17a44ecd1f
- MD5 2c1a898bb8acdaab4796757cc668d48e
- SHA1 6d16d667474822ec0b2ee4827144e3546610bacb
- SHA512 48c99339f94cdb539bcb4c562c3f90a0b085d87054133cd11e601947336b95f439be16d21d7708f4cd75e68de09882b4f322c82f977d853d41b52a5053b1b7fa
- SSDEEP 49152:Lw5aohMFAdaHprhYIzBZ03lICHAnK0ChBaBT6W09tOvF149dliWNCMOhYWdV1SNZ:LUaUw6gCUFRS3KFdu9CwJsv6tusNB
- TLSH T119567C17A2E60194D9BAD078CA679547FB727C0613306BDF02A0A2566F73AF01E7F325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe
- Size 507KB
- SHA256 11637654df7de141c9de1116a173551e7da1c3733fe9067bcd040e38ddd16863
- MD5 de2e7785c1e0151d69a888ed8c5696dc
- SHA1 7eb58839351ab1b045d0ffc62db7f1e8e97b0ec3
- SHA512 5caaa1f4a2c3cc8b00cdca42a74689c90ef56061eff2fb4e87d32f19e3842312e6c38a1a2c7ca9363ae834e22e70cc74453651e4fb29be481ae732c5d281be59
- SSDEEP 6144:T7Ha7RI0KXcyXzjucWHF5HyIFnWmfuQ+PIOXvLd7TyrjOqW/3hNl+k:PH6iXO0INj9+PB28/3XL
- TLSH T10DB47D19A29841F9F16AE139C9434906E7B2BC051360D7CF43E4BAB62F736E05E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll
- Size 32.1MB
- SHA256 b15588151ccf2d07516ee19d957718ce3e068b408c17c63fda93f5edd6e2fa86
- MD5 e524f49f427d2be159246456d7b31d2d
- SHA1 bfec33ebcea2655d1b82b8e3032847c0140d1b81
- SHA512 ae7d237bc6f8502703fd95833c8b64cb810f241fd546f0af620ecbcdcf8b33e5a3f842fc7e75d71ccd2d84a2762970593c09b7b36b504b918864445690e82214
- SSDEEP 393216:qElh/Awgyaq4ZxCyb1Etcc8BOKycRC0YCQW3KRJKFdu9CwJsv6thBI5:pay1yfhyPCf3KRPI5
- TLSH T108778C07A1FA05D8C1B6E0BCEA679907FBB1340513356BEB05A882B52F63BE1593F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll
- Size 19.1MB
- SHA256 7bb0b7e3c14c894ee616d7ea8a6c116980b6d60d3c92694c5a7d1219295203ea
- MD5 de032df65adf5b44fe98c0599db7d082
- SHA1 41fccab2887234b1bba1502f78a30fed60cc9183
- SHA512 28e91b73595ecb717cac0f902b9de006e3e82cd28ff60de022fa6dccf78360274733df7d7536c0c803714b1ce397e1ad72e5c50043693a2eb10a12665b51569d
- SSDEEP 393216:dJ2WV0i6tBoTFcma5bWSqT1sz6DxYLa1y5aLdbM/eO3Gg:2mCN3Gg
- TLSH T1C7178E4BE29250F8D45BD474975BAA22FA24384E472469EB17D08B703E73BE07B39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll
- Size 3.5MB
- SHA256 2e365cdef412cc390835cd4c61c20f0e440d5905e538085b9d51310f1b9ca005
- MD5 189b1106d32bf5e9a68bcc3f908311bf
- SHA1 1976fb83a614ef8a1638589d1f6d8bf2eb303e25
- SHA512 531a7ccd3f642df626ea0c52f99aff98ed05641f01db1eb4f521b195892b4ab56204882c88c3ea88f31753ade20958ebf3c4df0e2123e0dea49ad303bc7eb7d8
- SSDEEP 49152:BGtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvmf:PS+ZC+b65hmMorxeNNg
- TLSH T1C4F59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 cf19c3e572b6d750929629dc1de5f0c3f400033cdd9f959c8164ffb54f220482
- MD5 623618313c10b30b759485dc8d7c0caa
- SHA1 b2ecf1bc4d32420abdc3af2cfbed8ca469fbed86
- SHA512 e08be3098afca8a190309dc541f9273de03a7594ba437a755aaf237fb8fc4ec4a617ca03c14b6cdcdb2ed4af0ea3fd57c1deb1c47417248fceb7035fcf1b5eb3
- SSDEEP 48:ozpxeO2lGhfoq4tigkvPYUzvHiUC6U72buei/PYUzHC6s++nH21XM/2b8ZeiWWdw:oTQm//XLwLHOHAj2fIdlfB
- TLSH T195A1F2CA09693CF33B6DBB15EE8605C991B164A84DE824A1DBCD75171A8FF1627A3024
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll
- Size 7.6MB
- SHA256 74e3692327b1abea5677f988055c2e7d729f4379f86f8050a47a2469b84bedc6
- MD5 ec1d4b202d12844b64bd059f00cfce72
- SHA1 279d010ed1b2c82dda3d0db5dcbb62d03c5a9e65
- SHA512 5500fb42e465ce718e33d5b4b69b508dbff62caa9a148e621fa500d032f3b2956c746718d02c6fa90c23e1a3e233a896395d3acac40ff8bb5263882521e9bd77
- SSDEEP 196608:S3ETkrsM90J73luZRReAoh1CPwDvt3uFA0Cv:S3ETkrsM90l3luZR0Dh1CPwDvt3uF3Cv
- TLSH T119867B6DA6BC0149E8BA82BDC2875627D771B91907B013CF196196F80F23FD92B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll
- Size 1.9MB
- SHA256 ae8980a3d38dcb847d8ab544f344028268ea42602ba5c4dcd4706828022b2280
- MD5 12ef49f3d71a1b606a1b8b28fcd586b8
- SHA1 3b882419990319263e877b413165e2c704fe9575
- SHA512 ae9830ca8ae86ffd1caee068db6b86e4872c4d96d0be0101fd2c25157843b9a91519bde9868447908504aef51a3f108077eda6c05fd3d5643513ef8940a41560
- SSDEEP 24576:psETwcxJHIqeZDxTNZiQtdwCKlDABwZeVp4r2WTLHghrRg5aYsK:uETwcxJHIqiNZ7rKlD0RrRg5aYsK
- TLSH T1B0957C5AA7B81199E4F7D13CC6478B17D6B2B8192370A7CF06A086B91F23BD9173E344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json
- Size 1KB
- SHA256 234166cbacf0a6f276d90672f5152737e8f8ff18e58f28efed5fff6b8c1daf28
- MD5 3e8c6dd5aaf4dc813aa2ea175ee80d7d
- SHA1 e77b03015496b923c892020671c5e8c5494b0c6d
- SHA512 3965bf46d6894ce2b0301828d0729d682e9ba9aa9c2cf3ab7d5f2db7cb082eeb8ac180a4f6a10fb3605ef994f889ec2a72ca790dee23c24888c8b0da4580131d
- TLSH T1BD21EDD0C9522D7B3B01A9949D35179A22B1017B4ED830A6BB8D1D1E1F4FE6F22B317D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 699B
- SHA256 7c2bdcd023ef2fb0b87dde5b93af983a4f0a91937b94076557d7ff7ce907052a
- MD5 e313b0c3b67285c850787557e93afcd5
- SHA1 73465defdedf030767487d0e6bb3b7d17c7d690d
- SHA512 2e4b482f6422ad8886d49bd15604042655bd816db50c843b72c27ad947774dd85b44e81a6c1a82bcaa521104cb3e8e67a441296374df6b7b9f26e20ad26991b1
- TLSH T1E70170E60EF6357907037ED8CC5E645EE1A5486224C8A8E3AD0D2E1A1493FA72187478
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 800B
- SHA256 2a1b87b934b7c7ae93dfa7c5ac6cd9f3cbf40fca0b4418435e9fed915ebede37
- MD5 cc6336fbf8e7773e158563462d54aa13
- SHA1 199f1c3a6b9a4e4a2e25b9ad2392b6fd3b8898e0
- SHA512 0032af6fba75dd0ea8ae30946372d00e212a371f544f842367ae6bcd893bfb05b0c9cc5c1e8790f5beaad6fa1df985515214434ef5cc73544c46fb4801a549e9
- TLSH T112016BE1CCA12E770B0199D8CC29244EB22148730C84B8E6BB0D191E1F9BE6F32B213C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 1KB
- SHA256 2b161f83fc835656e68c78dbfd19e430b0ec053249d90a7e11a4f5f6be8e34f2
- MD5 7e2dc19f038845fea95d911344af0efd
- SHA1 68993e17271c476455d8f5c5d693d0485976b05e
- SHA512 952cb247c04d34f5bb043f414d4e95f3eeabd9058301f13c0e8a6df047db9f868c4ca989d6c42e68cb9826c2e98a23ffed9d8fb6a350263c9e5eb691a4d2724a
- TLSH T13011ADE1CC552DB72B01AAD49C19168A727185B70C94B4E6BB4D091E1F8FE6F32B316C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
- Size 35.4MB
- SHA256 60ceca48a2fb947a3e7dbc6baad3fe932fcde53fa86227c0b945785f399e095d
- MD5 af07cc0219f4604dc6cf3113d74dd2eb
- SHA1 bac921238605100beb64d9ca320a41f6083065e4
- SHA512 ad697c7f325ce4eede31eb6bf747feece86bd874b27066c1837f5fef886222e5683bec4c939ca1320e42fbf85159173ff6237a41865f01dc344fff16ac47a17a
- SSDEEP 786432:b1zCb7Tze8zqub4cXFVY0KWsFbXqTboVpWWqeq:btCb7f0c1VY0jyb64QWY
- TLSH T15087121BA2E501A4D5BAC078CA6BA547FB723C06133067DF02A4A6565F73AF05E3F325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 36KB
- SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
- MD5 b30d3becc8731792523d599d949e63f5
- SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
- SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
- SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
- TLSH T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 56KB
- SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
- MD5 752a1f26b18748311b691c7d8fc20633
- SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
- SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
- SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
- TLSH T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 64KB
- SHA256 01cc5616325179ff5f1ddb31afa289789bae5445f452f8e8bd89d2dc44737de9
- MD5 ad0c67b8586d732cbe09d01512c9a745
- SHA1 f1b308ffe4dbcdd36473b71014d1ad177792d0a6
- SHA512 16fe951e971193a5866407be06b754e14b77ff1609b743fa88bbe7c825a9ea2d375d7064880c2aca359583b988a8717d71ac9d848c3b8b04cfd450e148b990f0
- SSDEEP 384:yendThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:y+eUZsLQCZsL3hUS4
- TLSH T16E53CADB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBAC0.tmp
- Size 5.7MB
- SHA256 4841eaaef07e56daef05eb61a2ce9acb023316ef0816aa32204c40c6176a56c3
- MD5 1252e6ad04195c9225dc094815c411c9
- SHA1 b9cef1939e8a83518b0d46e2659ebd7ec8e1666d
- SHA512 65072cd6513c5dab9099810f6fd204f17d0fca3da551030d21c93f7aa0f4850dca3e13baf2b340b48da4faaa0e3be1d03b25a6c82f3b5638ba170d6f7e88558a
- SSDEEP 49152:Mbj9ysbs9yIG1gDOAFhUHU/w5UT8UtAue32O8QXWFvTPrH9/nr3DEBWSMd2Ewrj5:MbN2QjmFracF5cKFdu9CwJsv6tMhG
- TLSH T1EA567C17A2EA0158D9BAC178CA6B9547FB723C0653306BDF02A0A6556F73BF01A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58b6b8.msi
- Size 37.2MB
- SHA256 16f92782bd3b522b24ea25c3c0707f75d538d49a99b490ed3c24124a6d586535
- MD5 61a515dee5380a93bd5afe980d7dd1e7
- SHA1 0ba0a003eaebd19967bd9c031c8271d709743a82
- SHA512 78b0e3b5d77409b363da181db5e1012e7fff15fdca0cc775b601edfe732c6e221cdc0082ca2725a3644f2518505bce3f1f64bc3d8a1d3ccb998d7e00a62765e9
- SSDEEP 786432:6dwm/GCb6M1VN4OkZVIpkOs0om4B+vf74BALjAZ:62meCbpKVokOsVRBO02j
- TLSH T1EC872217A2EA0164D9BAC138CB6BA546FB723C0513306ADF02A4B6556F73BF05A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{2946fe9b-91f7-3e4d-b5b1-223084ef1d15}\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 14fc4a36941bb2e4fc1ba2e1f4941ed7f4dc3ff71db504f5c57e35e71fee0e4f
- MD5 01ba6db664825c80c61aa7ffd5b1b0aa
- SHA1 288279294b014366e6ab2e320a929dfe087f5d46
- SHA512 a30cfc8282a67606921da58931bde85f4855a41d08634ff37a9f4fc98a849f4fc6c04fe74913fcddd0c13b458882ad273e48b626b619a4b7fef7442e9d99fd73
- TLSH T1C001108339AB19B03A8C45B8CD84929DA0E764582ECB1E9AD43524CCD467627BEB3015
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
- Size 175KB
- SHA256 92a521f8cd2a6368dba30f3573f58e5c3dad4f614e708b5f429e667dafa1d5f7
- MD5 c141e40ae2d21a912789c8a0fc61f4a8
- SHA1 c601c0e2d0fc47e829a49a7a2633f7ce739c3565
- SHA512 9488ab802b1120165a1c39b9297510442852975d46949f6afa082f6091ab2f4033d009551dfc01538326222102df34950dc003201d1e317f717797ac5e766b7c
- SSDEEP 3072:G1cREnDnqZ6gxwE8TFF1lUQ8aP1ygAwJcr+wRTyy:G1tnDci7AaP1LAacrHt
- TLSH T1CB04EC288D187152E54AAD76D9CEAF9BCCB5B4C733D1954F9A500F821422FCD8FD88B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 ae36e0a0f577e7b39f072618bac126760e159c9638d9e6c62de434fae338db3c
- MD5 be7b4587dca7da5c9d9aae12b2e6f07c
- SHA1 5d4f472cd876b884e578cd2b5ab997d1eab5e3f5
- SHA512 461a0944a5260ec48efc13425276ba4c6588013f79edc687095ab9a5ada3f04866e5367615c45517bd2ef92bcaabc4feaad03f4b121948f0dcbb4a57c6015d11
- TLSH T1CEE0C0151EF1013EF3E6CF759FC375529809F1569C0087A40F90054CCB09B104D528B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
- Size 306B
- SHA256 07891ff1f438d31783468198da4c29cb6c0e12aacb8002a0ba6ec18e2a893c0a
- MD5 5494f0c4c0eefbcbaf6e8f95ee0ddf6a
- SHA1 1415ea122eb0ff82f51f3104370a9bd2d0b913b4
- SHA512 ef36657628173121c9313e48796e26a17a6919f0c822082a27158bca24deee7bc8ae959738b6372cd43b39782f12e083d19998b0d0aa1f28d51f653f307f3bdc
- TLSH T124E0A5241BD45517F1D1E57DEAF146417730FDA55543DB4D0BD0150D4835F412C3551D
- MD5 SHA1 SHA512 TLSH