Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 18:18
Behavioral task
behavioral1
Sample
Access_Documents.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
Access_Documents.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target Access_Documents.exe
- Size 23.3MB
- Sample260826-wxp5xaef88
- SHA256 9d0f757af542331cd7208026383fa2fcc8ddbf2ada37592910b96195c4a2f1c3
- MD5 f70d1bc5756a31c39525a6a09f0831a8
- SHA1 cbaf112e891d636c47846b7513bf0192bf33d693
- SHA512 fe40bf855e040f3d9d910c187a88a1e91597af2a5e6d11808cbdcc49b1ffd1a333b16ddecdd04e0f8c11cca0f0de1f76ef800132f3e58d8b436bf8569e06618b
- SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpZ:q9WtLzgOTbjZvk/ekS/mcpZ
- TLSH T12337333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveQuickView.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral2/files/0x000c00000001c5e0-91.dat rat_gotoresolve - Drops file in System32 directory 30 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_191a331ccc578de7\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\SET5079.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\SET5079.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\SET507A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\SET5078.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\g2rvdd.inf DrvInst.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_4dd0e6d66a75bb7e\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c5d85eade837b122\wvmbusvideo.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232 GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\33B65948FA5A494FD849A9882CBE888A GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\SET507A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232 GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_ad2569d6b92e9e9a\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\33B65948FA5A494FD849A9882CBE888A GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_39696ccdf1e382c7\c_display.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\SET5078.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content GoToResolveProcessChecker.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{38fab4a2-a356-8044-808d-20fdc159fc51} DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveServiceManager.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\FileManager.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3-x64.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRegistryEditor.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LMISupportM64.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnlock32.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\legacy.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\581bdcab-8f8e-4813-c373-e63942d41b96.run.lock GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2867c463-5254-4919-0906-67471c650bb1.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2867c463-5254-4919-0906-67471c650bb1.run\session.json GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveQuickView.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnlock64.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\c2a9f7bd-c539-4add-5cec-26e70e50a91f.run.lock GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\c2a9f7bd-c539-4add-5cec-26e70e50a91f.run.lock GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2867c463-5254-4919-0906-67471c650bb1.run.lock GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB\settings.dat GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveNetworkChecker.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\MediaClientLib.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveServiceManager.log GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2867c463-5254-4919-0906-67471c650bb1.run.lock GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\3bbb4f0b-6cf0-4bdc-b2a9-10602855a0a3.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64\g2rvdd.cat Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveLoggerProcess.log GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\581bdcab-8f8e-4813-c373-e63942d41b96.run\session.json GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRemoteControl.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LMISupport7x64.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\3de1f13c-7a43-4f2e-87b5-4c2471111918.run.lock GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\3bbb4f0b-6cf0-4bdc-b2a9-10602855a0a3.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUpdater.csv Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\Logs\FileManager-2026-08-26T18-21-02-551Z.log GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB\settings.dat GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB\settings.dat GoToResolveRemoteControl.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\3de1f13c-7a43-4f2e-87b5-4c2471111918.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\3bbb4f0b-6cf0-4bdc-b2a9-10602855a0a3.run\session.json GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUi.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTerminal.exe Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools32.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\Logs\FileManager-2026-08-26T18-21-07-292Z.log GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\logger.json.tmp GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LMISupport7x32.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\mandatory.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\581bdcab-8f8e-4813-c373-e63942d41b96.run.lock GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB\settings.dat GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveTools64.log GoToResolveTools64.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveTerminal.log GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveFileManager.log GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\581bdcab-8f8e-4813-c373-e63942d41b96.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveFileManager.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\3de1f13c-7a43-4f2e-87b5-4c2471111918.run\session.json GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LibGoToResolve.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\c2a9f7bd-c539-4add-5cec-26e70e50a91f.run.lock GoToResolveTerminal.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Executes dropped EXE 28 IoCs
pid Process 4676 GoToResolveUnattended.exe 2712 GoToResolveTools64.exe 3028 GoToResolveCrashHandler.exe 4476 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 3504 GoToResolveCrashHandler.exe 4608 GoToResolveUnattended.exe 1868 GoToResolveLoggerProcess.exe 4532 GoToResolveCrashHandler.exe 2496 GoToResolveExternalModuleHandler.exe 1400 GoToResolveFileManager.exe 2764 GoToResolveQuickView.exe 4296 GoToResolveTerminal.exe 2388 GoToResolveServiceManager.exe 5652 GoToResolveRemoteControl.exe 852 GoToResolveRegistryEditor.exe 5316 GoToResolveUnattendedUi.exe 1160 GoToResolveNetworkChecker.exe 5048 GoToResolveCrashHandler.exe 4612 GoToResolveCrashHandler.exe 5796 GoToResolveCrashHandler.exe 5880 GoToResolveCrashHandler.exe 2548 GoToResolveCrashHandler.exe 2412 GoToResolveCrashHandler.exe 6104 GoToResolveCrashHandler.exe 5544 GoToResolveCrashHandler.exe 2724 GoToResolveCrashHandler.exe 2312 GoToResolveCrashHandler.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2044 sc.exe - Loads dropped DLL 64 IoCs
pid Process 2712 GoToResolveTools64.exe 4676 GoToResolveUnattended.exe 4676 GoToResolveUnattended.exe 4676 GoToResolveUnattended.exe 4676 GoToResolveUnattended.exe 4676 GoToResolveUnattended.exe 4676 GoToResolveUnattended.exe 4476 GoToResolveProcessChecker.exe 4476 GoToResolveProcessChecker.exe 4476 GoToResolveProcessChecker.exe 4476 GoToResolveProcessChecker.exe 4476 GoToResolveProcessChecker.exe 4476 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 1868 GoToResolveLoggerProcess.exe 1868 GoToResolveLoggerProcess.exe 1868 GoToResolveLoggerProcess.exe 1868 GoToResolveLoggerProcess.exe 1868 GoToResolveLoggerProcess.exe 1868 GoToResolveLoggerProcess.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 4296 GoToResolveTerminal.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 4296 GoToResolveTerminal.exe 2764 GoToResolveQuickView.exe 4296 GoToResolveTerminal.exe 5652 GoToResolveRemoteControl.exe 4296 GoToResolveTerminal.exe 4296 GoToResolveTerminal.exe 5652 GoToResolveRemoteControl.exe 4296 GoToResolveTerminal.exe 5652 GoToResolveRemoteControl.exe 5652 GoToResolveRemoteControl.exe 5652 GoToResolveRemoteControl.exe 5652 GoToResolveRemoteControl.exe 2496 GoToResolveExternalModuleHandler.exe 1400 GoToResolveFileManager.exe 2496 GoToResolveExternalModuleHandler.exe 1400 GoToResolveFileManager.exe 2388 GoToResolveServiceManager.exe 1400 GoToResolveFileManager.exe 1400 GoToResolveFileManager.exe 1400 GoToResolveFileManager.exe 2388 GoToResolveServiceManager.exe 852 GoToResolveRegistryEditor.exe 5316 GoToResolveUnattendedUi.exe 852 GoToResolveRegistryEditor.exe 2388 GoToResolveServiceManager.exe 2388 GoToResolveServiceManager.exe 1160 GoToResolveNetworkChecker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5944 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Access_Documents.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRemoteControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveFileManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveTerminal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveServiceManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRegistryEditor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe - Delays execution with timeout.exe 3 IoCs
pid Process 4508 timeout.exe 2412 timeout.exe 6112 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5316 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4228 Access_Documents.exe 4228 Access_Documents.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 2764 GoToResolveQuickView.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4360 GoToResolveProcessChecker.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 4608 GoToResolveUnattended.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe 2496 GoToResolveExternalModuleHandler.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5316 GoToResolveUnattendedUi.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeShutdownPrivilege 4676 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 4676 GoToResolveUnattended.exe Token: SeShutdownPrivilege 4476 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 4476 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 4360 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 4360 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 4360 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 4360 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 4608 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 4608 GoToResolveUnattended.exe Token: SeShutdownPrivilege 2764 GoToResolveQuickView.exe Token: SeCreatePagefilePrivilege 2764 GoToResolveQuickView.exe Token: SeShutdownPrivilege 4296 GoToResolveTerminal.exe Token: SeCreatePagefilePrivilege 4296 GoToResolveTerminal.exe Token: SeShutdownPrivilege 5652 GoToResolveRemoteControl.exe Token: SeCreatePagefilePrivilege 5652 GoToResolveRemoteControl.exe Token: SeShutdownPrivilege 1160 GoToResolveNetworkChecker.exe Token: SeCreatePagefilePrivilege 1160 GoToResolveNetworkChecker.exe Token: SeShutdownPrivilege 2388 GoToResolveServiceManager.exe Token: SeCreatePagefilePrivilege 2388 GoToResolveServiceManager.exe Token: SeShutdownPrivilege 1400 GoToResolveFileManager.exe Token: SeCreatePagefilePrivilege 1400 GoToResolveFileManager.exe Token: SeShutdownPrivilege 852 GoToResolveRegistryEditor.exe Token: SeCreatePagefilePrivilege 852 GoToResolveRegistryEditor.exe Token: SeShutdownPrivilege 5316 GoToResolveUnattendedUi.exe Token: SeCreatePagefilePrivilege 5316 GoToResolveUnattendedUi.exe Token: SeShutdownPrivilege 2496 GoToResolveExternalModuleHandler.exe Token: SeCreatePagefilePrivilege 2496 GoToResolveExternalModuleHandler.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe 5316 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4228 wrote to memory of 4676 4228 Access_Documents.exe 89 PID 4228 wrote to memory of 2712 4228 Access_Documents.exe 90 PID 4228 wrote to memory of 5944 4228 Access_Documents.exe 91 PID 5944 wrote to memory of 2412 5944 cmd.exe 93 PID 2712 wrote to memory of 3028 2712 GoToResolveTools64.exe 94 PID 5944 wrote to memory of 6112 5944 cmd.exe 96 PID 5944 wrote to memory of 4508 5944 cmd.exe 97 PID 4676 wrote to memory of 4476 4676 GoToResolveUnattended.exe 98 PID 4360 wrote to memory of 3504 4360 GoToResolveProcessChecker.exe 101 PID 4360 wrote to memory of 4608 4360 GoToResolveProcessChecker.exe 102 PID 4608 wrote to memory of 1868 4608 GoToResolveUnattended.exe 105 PID 4608 wrote to memory of 4532 4608 GoToResolveUnattended.exe 106 PID 4608 wrote to memory of 2496 4608 GoToResolveUnattended.exe 108 PID 4608 wrote to memory of 1400 4608 GoToResolveUnattended.exe 109 PID 4608 wrote to memory of 2764 4608 GoToResolveUnattended.exe 110 PID 4608 wrote to memory of 4296 4608 GoToResolveUnattended.exe 111 PID 4608 wrote to memory of 2388 4608 GoToResolveUnattended.exe 112 PID 4608 wrote to memory of 5652 4608 GoToResolveUnattended.exe 113 PID 4608 wrote to memory of 852 4608 GoToResolveUnattended.exe 114 PID 4360 wrote to memory of 5316 4360 GoToResolveProcessChecker.exe 115 PID 4608 wrote to memory of 1160 4608 GoToResolveUnattended.exe 116 PID 1868 wrote to memory of 5048 1868 GoToResolveLoggerProcess.exe 117 PID 2764 wrote to memory of 4612 2764 GoToResolveQuickView.exe 118 PID 4296 wrote to memory of 5796 4296 GoToResolveTerminal.exe 119 PID 5652 wrote to memory of 5880 5652 GoToResolveRemoteControl.exe 120 PID 1160 wrote to memory of 2548 1160 GoToResolveNetworkChecker.exe 121 PID 2388 wrote to memory of 2412 2388 GoToResolveServiceManager.exe 122 PID 852 wrote to memory of 6104 852 GoToResolveRegistryEditor.exe 123 PID 5316 wrote to memory of 5544 5316 GoToResolveUnattendedUi.exe 124 PID 1400 wrote to memory of 2724 1400 GoToResolveFileManager.exe 125 PID 2496 wrote to memory of 2312 2496 GoToResolveExternalModuleHandler.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe"C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe" -regsvc2⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 4676 -InstallationId GmCm4vDIox -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -ApplicationType 4 -Environment "Production" -ForceInstall 03⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe" -InstallVDD2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=version=1.24.0.142 --initial-client-data=0x324,0x328,0x32c,0x31c,0x330,0x7ff6948abaf8,0x7ff6948abb10,0x7ff6948abb283⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2412
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:6112
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4508
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4f2d2b56-4b6c-fd48-8d83-f0fc2e9e1c20}\g2rvdd.inf" "9" "485c3f42b" "0000000000000170" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4260
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -ApplicationType "4"1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x8e8,0x8ec,0x8f0,0x870,0x8f4,0x6fa56fac,0x6fa56fbc,0x6fa56fcc2⤵
- Executes dropped EXE
PID:3504
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/4535335282478998551/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "4360" "-InstallationId" "GmCm4vDIox" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_4535335282478998551" "-Service" "-LogLevel" "2"2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 4608 -CompanyId 4535335282478998551 -InstallationId GmCm4vDIox -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -Environment Production -ApplicationType 4 -HostId d08c4b6ade4c63c1c2ca3ab25f6ccc6e -LogLevel 2 -SessionType Unattended3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x714,0x718,0x71c,0x6bc,0x720,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:5048
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x7e0,0x7e4,0x7e8,0x798,0x7ec,0x6fa56fac,0x6fa56fbc,0x6fa56fcc3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4532
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe" -InstallationId GmCm4vDIox -CompanyId 4535335282478998551 -publickey 1a1b52cf4c7aba62e657c86541120c578ceaa2b79c2365f29f3c763bedbdd8b9 -LogLevel 2 -Environment Production3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x76c,0x770,0x774,0x748,0x778,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:2312
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveFileManager.exeGoToResolveFileManager.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId GmCm4vDIox -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7c4,0x840,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:2724
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveQuickView.exeGoToResolveQuickView.exe -InstallationId GmCm4vDIox -LogLevel 2 -Environment Production3⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x720,0x724,0x728,0x6f8,0x72c,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4612
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTerminal.exeGoToResolveTerminal.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId GmCm4vDIox -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7cc,0x840,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:5796
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveServiceManager.exeGoToResolveServiceManager.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId GmCm4vDIox -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7c4,0x840,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:2412
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRemoteControl.exeGoToResolveRemoteControl.exe -CompanyId 4535335282478998551 -InstallationId GmCm4vDIox -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 13⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x77c,0x780,0x784,0x6f0,0x788,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:5880
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRegistryEditor.exeGoToResolveRegistryEditor.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId GmCm4vDIox -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x838,0x83c,0x840,0x834,0x844,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:6104
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId GmCm4vDIox -CompanyId 4535335282478998551 -Environment Production3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x7a0,0x7a4,0x7a8,0x778,0x7ac,0x6fa56fac,0x6fa56fbc,0x6fa56fcc4⤵
- Executes dropped EXE
PID:2548
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/4535335282478998551/GoToResolveUnattendedUi.exe" "-CompanyId" "4535335282478998551" "-InstallationId" "GmCm4vDIox" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Yrwkjldu --annotation=installationid=GmCm4vDIox --annotation=version=1.27.1.3232 --initial-client-data=0x760,0x764,0x768,0x738,0x76c,0x6fa56fac,0x6fa56fbc,0x6fa56fcc3⤵
- Executes dropped EXE
PID:5544
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:2044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\GOTORE~1\453533~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\453533~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\FileManager.dll
- Size 16.2MB
- SHA256 fa0b23cbb92d9f312e07fd34e9cca29f7f07f857c66437eac688884982c9772a
- MD5 a4f290656640bf413f90120e3a5adce1
- SHA1 1bea9cd003199b7be94f2bb971fcbb7e62d1b31d
- SHA512 d6a4fafb33407f0cbf502e3f83d4bde2d4b35c984793defdc1126b38ab7aea6b31c74c7dd40aa55e538aeaed0efa3ea05bd11b2d8b74981e5e8ea6187bd73331
- SSDEEP 393216:t8NxtVeLf7nCAArnTkXFVtci38fEhJdcJsv6tWKFdu9CErs3ba:t8Nx/eLf7YnTkVci3mE1ruba
- TLSH T12C07BFA2B1639135DD863172792EF73F5E288A244F2644C7925C3DD9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
- Size 652KB
- SHA256 a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635
- MD5 9574719cdf372198425169af317b0eb4
- SHA1 36cd0b6410d0ee3fe0622d6378b62160baf17c51
- SHA512 629d13ef185ddb14f2abaa385ace9bd201cf35de2f9822112f9f212cd684c8facce1164190f669633acc566964df8346acff6a8077797b324e7b1f02fa5966ab
- SSDEEP 12288:hipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e9:hipIc72CJhxGfRBYcRXHTqM8JMfqPwh2
- TLSH T113E4B011B1818032F5B222B2A9BDBF7059FCB52647BB09D773C44A3B9B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe
- Size 409KB
- SHA256 d249d6eca804d917db79144c8651b8a21e41a3489d91f7414c5663f0d4f360fd
- MD5 e48f40fd35fe3a639b1b57b6511416a4
- SHA1 6b1976946f711620d7f35e4a0a280ec90e0393b4
- SHA512 39f4c5dc095f3b6df18e1d9103bf63c2940de0b4955de81c8c783fd7c9cbe40ee7824cda0cf0c25e2e0948f13d1bb9fc5065ab808e48097c9010ddf7a8e720ce
- SSDEEP 6144:av5w/ISKan+HIl3gDcxWaUnVxUSdERk2pO+uP53jAOAMq3Qv6EVZVf5:av5wgDan+olacanVxPB3jFSEVrf5
- TLSH T124949D127AC1D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveLoggerProcess.exe
- Size 409KB
- SHA256 ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4
- MD5 47a7dd2ac70934804295fba021cc325c
- SHA1 153f964a9ec4431251b51f2194c580c87da4520f
- SHA512 a2c5cdad9dbb851bc39593b59a9b9af57caa8028222e0456331ee519b513c0d60570b370846f1658a488363f2b30ded8a1750e422c4a69e63a49f35797253f2a
- SSDEEP 6144:avxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAOcya3Qv6EVZp:avxwI7an+olyUan4hNy/jHSEVT
- TLSH T13D949E127A81D032D8B210318EA4DF756A7DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe
- Size 409KB
- SHA256 7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd
- MD5 1de89cd290b4ecba1d834275e914f850
- SHA1 5c204a50b53e1b5ead77b3d0d6335f103074ab29
- SHA512 6247f45e385bd08c7cc926d2f92aba203dcf8f5e95c2d6ed67315b2902c840ae4b0bf973d2081b76732f99c456fdbee6f7ba9e4c44ae13198a92b9566921a2f2
- SSDEEP 6144:7vxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAODiY3Qv6EVZ5:7vxwI7an+olyUan4hNy/jWSEV
- TLSH T1F2949D127AC1D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1
- MD5 4256b14af65b85bf6f7d7a76d63c52e1
- SHA1 f0f6192dd2bfc55fb9608a25207068de48e30023
- SHA512 3833dbadc17d2ac7a56f174b0752f5a67770b8413dad87a248ef5502e323e0345282eac136b2e0467d5bdee088e53287e18ad6804c91a30fde6d45c26f39a560
- SSDEEP 24576:L8d+H5/wzK0K+3AOzTORk0U1BPfypVXISyXthAeagonjfQVp:QGRwO0KYfPORkrHyXCXthzagmQ
- TLSH T1CA558D1A626C41F9D1BFE17C89878A4AE7B17806037187EF13A8475A2F276E15F7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe
- Size 409KB
- SHA256 3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9
- MD5 bf5b71caaa5051900504a20a670981aa
- SHA1 747defaa7994ef6a9b9b736def73d8e53ff9f0e3
- SHA512 0ebf2412628bdab69e99d2acef8a17005d82c8ae4192e03e3c60eef9e2cd09beaaa1ea294c2bee7bfc4be04c8e783a5af61b348957984b84b915acea384f76bb
- SSDEEP 6144:/vFwjIKCan+HIlnusRWaUnox9CdER02gOu6+nbjAOdBIa3Qv6EVZo:/vFwkLan+olus6nox5ybjySEVG
- TLSH T1AF949D127A81D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LibGoToResolve.dll
- Size 19.5MB
- SHA256 ddf3244decb29688d6a1972d3004f92bd365700bc77606efce8013a3677c6a83
- MD5 d7a242def5ff195ea246e33e28413999
- SHA1 3ba086b87fc81c21673252b70f8d29bb91d45a56
- SHA512 659e016968f18af79df9a513d972dda79bc84d16f4aad9023df238c4fde946ca46ae856b60234a49a587aa002153097a44855100dc88bc6a22ba9a8319acbf70
- SSDEEP 196608:muMIO5dY3td4PLTm1lW3ILzUmMcBs0Qooa4C7Gs8Jsv6tWKFdu9C5qhnjxFJoHI:ZZiMYmh3H7H8Jsv6tWKFdu9Ckh1oo
- TLSH T13727AFD27147C0F1E98A11B9A53AAB3F8678A8504B2954D797EC3E1D99301D33F37A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\MediaClientLib.dll
- Size 14.0MB
- SHA256 16729d5e7273b72c0fa05d08734f558c9da7f939900dcf38c1356edbbdade0c5
- MD5 99c94e16cc0b360eea8164a74972092b
- SHA1 280cd506fa6e0e1a586fbfc6265f43ab40eea2bc
- SHA512 d6e6ac52ba9d8ac4faf718897ea2b33a690b2f757c688072ca628eee03a50b374ba777641620f4e0310fa82453b1de6a1cb4e88bdb0d58f9c5f899ca0a075d51
- SSDEEP 196608:nVf8Kglmgw143el82aJdnv4KMGx715CARN775eciChoUCCp1kxJ3gF:nVf8vRC4HnhMc5Co5F8GkxJ3gF
- TLSH T16DE6AFC1E1625174C9461870AD3DAA3E6E28025D87B089F7BBD85CA07BF37D0377A786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100
- MD5 acf440dd02b14609359844366e281ef9
- SHA1 288190791a137dec98109104392a13eba4ae6abc
- SHA512 4d7b7b09903145319ea1509c56cd60fcfcf932fbf9396697ac3ecfb8bd9e7f8e3453579954812f8b58f38f9971627b4dd252deb172f085f4aec5c364e0ebce6f
- SSDEEP 24576:4ZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr54:lYM801G81cOS5TI1hr54
- TLSH T1C9458C03BAC189B1F5AE06B448B6B33C897EBD704734C5C75BC8688969715C1BB3B396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 0078b6d847862a82b015fa920ab86371a3b6089c715025116472586f9b5d3cdc
- MD5 8dae857198264b43fad70c69111fa0dc
- SHA1 7f95f8a07eb837a1f58ccf707e6fe5776c9269ea
- SHA512 ea5e0d326770b8f18418893558b7886da1ad3e9e678d92570129ee7a5cce3b659ce964ecdf5224eee566c6ac7d5f33c9f57cbef908ec8116021d71018d4a6107
- SSDEEP 96:o0itl5Bj4BxaOXi+twzoaOw+t2z+poHfzfpT7K:8Dv4faEiIkoalIidHfzxT7K
- TLSH T1A39100E90DA535FB0772AB68FE0B0C57B1712C4E59F46ABC5BC4094A19CAF1523E3230
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log
- Size 2KB
- SHA256 4bda1b849752f389ea1cdeca5dd698b5d729e9b5135ae6bd46b971a5a9953d07
- MD5 5e517823ba7d711c851860c3e4ba668c
- SHA1 fa91f268465de797b51bfb9a4f743d04f48c31f1
- SHA512 ed6d651ac1e3984939e3a808eefbb3f868b42ed414cfd6f3eb408892539aba30114d2e676b265eab411f1e68d1c6dfd5c104ed9e959543acdf3c9b8979222507
- TLSH T1DA517DE64DE734F7C51A4629B98A8E947127223FEDDC4D8852C10C4C32D9D0E17E3761
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 7667612b7ee8efd38b87050f6a58b291831a90310c9a72b08179e66eec55b9d0
- MD5 afc23696090bbe82aae9e8b108d6cbd2
- SHA1 73d749b6ea4ce572cdf921c2f0fb210c7cc0d4c0
- SHA512 52ad3b9ccc99db60ef72adf786e6018a21edbc252bffd384e5a0540d845da4e826bb4f477b01121b3114e34fb84628a7776f66e877a5a86c28bbc35ca91b11fd
- SSDEEP 98304:SD+fVjyaabqoQPk1p7huA0F19IuPj1CPwDvt3uFlDCM:E+1yaabxyshuAkrIu71CPwDvt3uFlDCM
- TLSH T133567C6EA7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3.dll
- Size 4.2MB
- SHA256 20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a
- MD5 e2d7132d06648c344f851a16d2830964
- SHA1 153034cc90a84282c15ca91b401f120a516435cf
- SHA512 552e4eb9bdd888ce2a177e795aeed88bcce2ab6f2c71617a6e8354d4d7c4ef6b51517172c1451a7be43a32a1a7a97fb9febe5222f519a3ed99c13f19d5e8eeac
- SSDEEP 49152:Fyx0uEV3rsWweF37k5FyOgvMbziX+cg1CPwDvt3uFlDCPSmFzO2rnd:w0uEiGNOhKX+P1CPwDvt3uFlDC7
- TLSH T12B26BF12FB936591E8CF927D12EEA33F0E3D5B14872489D38EA615E9C8256C0773E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libssl-3.dll
- Size 1.1MB
- SHA256 9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf
- MD5 753cfc508dcc0883db50d5069cd81a4f
- SHA1 c8193d2556392324007f6a4e916620b85600c24b
- SHA512 3137c88fe025ff3e3bf068f23b31ab7d3a468c5fee172726e25351aa83c4b5cdb89b000d03b829c35cba0f13d0d5783e11a6db3c29da23a81b57158d725f9ff9
- SSDEEP 12288:OasfmiM1aHnChqPS3/pziY7g6X5zTR4bQT6clxHlhhNFXN2WcrFe9XbOz5:tsfmL5VbRl/f0WcrFe9XbOz5
- TLSH T10135AF11BA814970DCE661BE06EDB77E473DA2601318C9C78F8559FADE206C16B3A3CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\mandatory.json
- Size 1KB
- SHA256 b130e4fbbbb0788ead7e7fb5f3be6f56c924421cfcb2fbbe4ca62addfff62d7a
- MD5 553614c76a7c30e94e8d2a93b848f71a
- SHA1 38f6cc9bc8f729236644fc742b9dc2245178f5d0
- SHA512 2c51999763a0653c33536dcb7cf9ba5a8931bd3b56e01ea84c31838fa7492ea3005c6924a20f9fba658d9f43b6e1d2f89d11133d015e4e38ed34758ff428e524
- TLSH T13B118BE1CC612E7B1611ADD8DC15190BB2218A570D5575AABF891E1E0F8FEAF22B213C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json
- Size 697B
- SHA256 232496d23b4620c969c06729b8eb50e62591b602bf337549baa9a905a5de103c
- MD5 9b14ac894b1b6bb7496ff11049bec379
- SHA1 e4b263bfdbf5d364b83afa296780694053c1a801
- SHA512 ace9d8fd2aaa6e120a1f63329b598807f9cdb0bee92eb1d570e54f7736e37ab21c45101e77e0b502bd9edca4572223ae27cbe97615ceae3a2407492e24c79860
- TLSH T1B70170E10DF635394713BEC8CC5E685FE1AA4C5125C4B9E2AC4D2E1A04D3F933146438
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json
- Size 1KB
- SHA256 19cc07df7dd98c54fff1c2e0755c75954dbab5682cad29486a2e429498c8ae64
- MD5 6c08cb350d1375f0463774ae1ffac04c
- SHA1 56292307ccecf44e4825aab5f4238ebc869b9e60
- SHA512 a2e53556e7134ca303bce51cedd6be32fbfe236929ab354ec0eee141a168a14d17cb9bbe1a80ffda1b36b8ffea280c12bb0b0a74bfa4e7785cdf08e0ac5bff34
- TLSH T12911ADE0CC612D7B0711A9D4DC152A4BB2214A675D5474AABB491E1E0FCFE6F22B213C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 7be2a0dd1ac91e6707603ee84e5daecc7f695357e9019fadc0252cd83a958608
- MD5 9ef7470601de47d54b3ef31d310355d8
- SHA1 10211343d1c4959da0dfc42db62bb7fe6b5dc2f5
- SHA512 faea7791c3df13cb0b99d6541c34203d04e6f80c09e1bbf5f516603cbf3cfcd147d020ddfa3c2c9019f33556549dc48e10846d1fdab4d63ac3d365c887eb6711
- TLSH T13A014407AC6E6DF7AE589AED0AA9A765309BA41D2CCB5042BD2D095541C161CC670485
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 727B
- SHA256 42604081637affd1b490e235289f2209046c06a98059f0171d088711b5bbb2df
- MD5 96ee136677c5a5dfbf2c6e82429d6c0d
- SHA1 7be3548b972500659547283e2493d78099945c12
- SHA512 0ac594e1cf52b1fbeb23f15abbf08dd44be00af40d686f37867756c009ca6d6ce516d53548fe44154901ea0177a008cf3167c18f7f195f7d2aa3536979049a2c
- TLSH T1BF01990752E951E83825DE28FCDCC3703B85934712CD4357261D01B9DD8C3721619FD6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 da376dead349ab97d66b942849837bc09d2c9f4417591b5dcd205521fc2ae9f3
- MD5 12a2a257669167ab095615a6b98cff4c
- SHA1 c0a1182537ea1f4b779318bac55dfe70fb868f72
- SHA512 0a704cb0f4e33db2f80f36c4773a0a7e658ca981c1fc4e22a7c632d7e2169bb323bdd52b58848587941a4179879f8f75951a754354073e531a4efba7b45ce41c
- TLSH T13FE0C0341DF6403EF366C9355BC179A29809F156D81087A10DD0050C9A05B001D524F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 e06170908786f410275a2539e0ac31ccdbd0286b3730fdf0a715f3174d501f72
- MD5 985a78751e02b2395291aa8e09f6dec4
- SHA1 e41e59f35a32ce6b817e29bc1a58c99b94e212df
- SHA512 9cd5f1651f3be69f6fdf22f6722455c07c776eaf489c84141cea99489161c5440f52c2062abcc5890c7b2e501135fd76992b22b8557294c86c696c846f7a314a
- TLSH T132E0C63822FAC08EF0F0E67402F66F220A9DF2660841C2A917D45255AA74E802ED7934
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
- Size 177KB
- SHA256 d37f8212747fc8ea036e0a15918056bd12ab96c1bf26af585f4b4eae319bd13f
- MD5 de38c5856182210f7c2e48e60905c8d6
- SHA1 9bd8ddab8bfbeaaba5d3ed5998e36fc98708088d
- SHA512 57df2356c1a55d93f9bb0b58e1d4693fb3552c2ae51a6a2ea98bdaec7119738c8834c137e28489338b3b8c03757e4d1764e2b2073809bbbaf5a1634f53d9fa7f
- SSDEEP 3072:zC/5FkbvIZEgxwE8TFF1lUQ8aP1ygAwJcJ8wDhuAl:zCrkbuo7AaP1LAacJv3l
- TLSH T1A604EC288D187152E44AAD76D9CEAF9BCCB5B4C733D1955F9A500F821422FCD8FD88B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\33B65948FA5A494FD849A9882CBE888A
- Size 929B
- SHA256 2de4eb5858dcc1f178b51a72e4bd0a56cba55be405cabd4dd9d89c351b7dae9b
- MD5 6deac7edbea2aff48d8012c692d37cfa
- SHA1 9b8b9f24664e0723e2f79d33073238f1e4b88139
- SHA512 9698a8aad534eb1450688a25b799930da41e307ba90a7c9554e90b63913f93a98106a620282ec541515958cbb5d0eb52e813cb65143bf335b1822b329a66615b
- TLSH T157119452D8F24D00CCB3BB50F441961FADE9C268584464CB261FC050CB766467FF00AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
- Size 306B
- SHA256 d5247c6652918b36c8a04887d515f9cd61a5073bf5626516823f56b69742c8d1
- MD5 8cf99d455f78b0014a20d14ca9bb1cd5
- SHA1 a854e324fd0393865e6222367c3b44c178fb13a9
- SHA512 9353f5fa67ef107566222e732408efec5e8c160749ed11580484fecdce526f20921a91d76dcaeb44af6f842a360aa41437b4128a96364376b8e18ef709eb8387
- TLSH T1C5E02B1417E4426BF1E6227E7BB046816551FD224507CE0C0F90050F5435F402D2282A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\33B65948FA5A494FD849A9882CBE888A
- Size 304B
- SHA256 81c29915a155de21ae7e7561e6d03cda4fa3d22942bed9725a07168c7317d3bb
- MD5 161c33808d131135318eca5d41756725
- SHA1 68cd5463f183846d4b418b9096c6d17b27b6e8b8
- SHA512 6fc82b555d4df022722d7d64aa3674e0e5654edf06284ac892134643211e769963cb9dfc220e2b1a1a33fa7e68a427403a39e0766972e9518e9522bc832a7d58
- TLSH T1C5E05B645BD4191BF1E26179DE704682B640B9629041CB1907E1574D687DB415C31D1D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini
- Size 413B
- SHA256 30729183f01261295364570a7a34b5961085578b340673a34768c48bb03a5ae2
- MD5 338d62092eaca60b884fb7204f67f7d0
- SHA1 f618db6dd1ae11e770c450a7d47718e1bb668d59
- SHA512 b440656dfbd27d3a065b7e8de463f2efeb42a007f441838f7cc6e053315d8f0d08c71e0d7bdd9d1c1f29fff272ea4d32fb5274ed267f2de7d8cc96431795cf94
- TLSH T18BE022AB74F44BDE6D0A1C19D12E0E2BF0BB7A08049C62E8B2509428234BD1F5BC1B27
- MD5 SHA1 SHA512 TLSH