Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 00:15
Behavioral task
behavioral1
Sample
EviteRSVP.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
EviteRSVP.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target EviteRSVP.exe
- Size 23.3MB
- Sample260828-akemrabd53
- SHA256 18984b37fd61e3f214580b2213c7f9ae3ba5e00cef4ce68e5e8bfc769c6f3e31
- MD5 df44b7b26d68ef4303f127d0a7f20696
- SHA1 65eaf11a0c832bb971c20720e1a0903f2940977f
- SHA512 2112ea523d7c35b775f98aa3357412045919719ae64131e9ddbd26db154faef5886b0eb119a94cbc8eeaa4a1a42e2bcc3220f25272f457ed1e02aa2414bf30dc
- SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpH:q9WtLzgOTbjZvk/ekS/mcpH
- TLSH T11137333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveQuickView.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x000700000002448a-132.dat rat_gotoresolve - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation GoToResolveUnattended.exe - Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\SET6985.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\SET6983.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\SET6984.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\SET6985.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content GoToResolveProcessChecker.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\SET6984.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft GoToResolveProcessChecker.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\SET6983.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveProcessChecker.exe File opened for modification C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{72116950-718d-6946-b18b-842b5964b0f8} DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveQuickView.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\libcrypto-3.dll EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\777e67e4-d37d-4343-ceac-7ec4f6a929bf.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveFileManager.exe EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\CrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ProcessCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\777e67e4-d37d-4343-ceac-7ec4f6a929bf.run\session.json GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTerminal.exe EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\lmiscrhook32.dll EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\libcrypto-3-x64.dll EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\ae565a2e-9c4a-4bcf-0028-cc0c8583089e.run.lock GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\Logs\FileManager-2026-08-28T00-16-37-582Z.log GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUpdaterCopy.csv GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\x64\g2rvdd.inf EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\FileManagerCrashReportDB\settings.dat GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUpdater.csv EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\LMIInputHook64.dll EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveUnlock32.dll EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\9e6c53b6-52f2-4aa1-17e4-78e5875289e2.run\session.json GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\FileManagerCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\ae565a2e-9c4a-4bcf-0028-cc0c8583089e.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RegistryEditorCrashReportDB\settings.dat GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveUnattendedUi.log GoToResolveUnattendedUi.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\TerminalCrashReportDB\settings.dat GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\libssl-3.dll EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveTerminal.log GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveNetworkChecker.log GoToResolveNetworkChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\ae565a2e-9c4a-4bcf-0028-cc0c8583089e.run.lock GoToResolveRegistryEditor.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\777e67e4-d37d-4343-ceac-7ec4f6a929bf.run.lock GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUiCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveExternalModuleHandler.exe EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\x64\g2rvdd.dll EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\QuickViewCrashReportDB\settings.dat GoToResolveQuickView.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\777e67e4-d37d-4343-ceac-7ec4f6a929bf.run.lock GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\15bc0901-f955-408a-1131-8953c4aad6fd.run.lock GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTools32.exe EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUpdater.log EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RemoteControlCrashReportDB\settings.dat GoToResolveRemoteControl.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\NetworkCheckerCrashReportDB\settings.dat GoToResolveNetworkChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\ae565a2e-9c4a-4bcf-0028-cc0c8583089e.run.lock GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\TerminalCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\unattended.json EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\x64\g2rvdd.cat EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\MediaClientLib.dll EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RemoteControlCrashReportDB\settings.dat GoToResolveRemoteControl.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\x86\g2rvdd.dll EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\PasswordPrivacyDll.dll EviteRSVP.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedCrashReportDB\settings.dat GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\LoggerProcessCrashReportDB\settings.dat GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\NetworkCheckerCrashReportDB\settings.dat GoToResolveNetworkChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\ae565a2e-9c4a-4bcf-0028-cc0c8583089e.run\session.json GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\1664b9b8-9b6a-4c23-7c14-1782993df4ea.run\session.json GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTools64.exe EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe EviteRSVP.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\logger.json.tmp GoToResolveLoggerProcess.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveQuickView.log GoToResolveQuickView.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\.sentry-native\15bc0901-f955-408a-1131-8953c4aad6fd.run.lock GoToResolveFileManager.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Executes dropped EXE 28 IoCs
pid Process 4412 GoToResolveUnattended.exe 1692 GoToResolveTools64.exe 1580 GoToResolveCrashHandler.exe 4988 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 2812 GoToResolveCrashHandler.exe 1764 GoToResolveUnattended.exe 1388 GoToResolveLoggerProcess.exe 784 GoToResolveCrashHandler.exe 3292 GoToResolveExternalModuleHandler.exe 2200 GoToResolveFileManager.exe 1844 GoToResolveQuickView.exe 1916 GoToResolveTerminal.exe 3856 GoToResolveServiceManager.exe 2100 GoToResolveRemoteControl.exe 3336 GoToResolveRegistryEditor.exe 3844 GoToResolveNetworkChecker.exe 548 GoToResolveUnattendedUi.exe 4824 GoToResolveCrashHandler.exe 224 GoToResolveCrashHandler.exe 3656 GoToResolveCrashHandler.exe 1468 GoToResolveCrashHandler.exe 1904 GoToResolveCrashHandler.exe 736 GoToResolveCrashHandler.exe 4976 GoToResolveCrashHandler.exe 5048 GoToResolveCrashHandler.exe 1864 GoToResolveCrashHandler.exe 4800 GoToResolveCrashHandler.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3524 sc.exe - Loads dropped DLL 64 IoCs
pid Process 1692 GoToResolveTools64.exe 4412 GoToResolveUnattended.exe 4412 GoToResolveUnattended.exe 4412 GoToResolveUnattended.exe 4412 GoToResolveUnattended.exe 4412 GoToResolveUnattended.exe 4412 GoToResolveUnattended.exe 4988 GoToResolveProcessChecker.exe 4988 GoToResolveProcessChecker.exe 4988 GoToResolveProcessChecker.exe 4988 GoToResolveProcessChecker.exe 4988 GoToResolveProcessChecker.exe 4988 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1388 GoToResolveLoggerProcess.exe 1388 GoToResolveLoggerProcess.exe 1388 GoToResolveLoggerProcess.exe 1388 GoToResolveLoggerProcess.exe 1388 GoToResolveLoggerProcess.exe 1844 GoToResolveQuickView.exe 3856 GoToResolveServiceManager.exe 2100 GoToResolveRemoteControl.exe 2200 GoToResolveFileManager.exe 3292 GoToResolveExternalModuleHandler.exe 1916 GoToResolveTerminal.exe 1388 GoToResolveLoggerProcess.exe 3336 GoToResolveRegistryEditor.exe 3844 GoToResolveNetworkChecker.exe 1844 GoToResolveQuickView.exe 3856 GoToResolveServiceManager.exe 2100 GoToResolveRemoteControl.exe 2200 GoToResolveFileManager.exe 3292 GoToResolveExternalModuleHandler.exe 1916 GoToResolveTerminal.exe 3336 GoToResolveRegistryEditor.exe 3844 GoToResolveNetworkChecker.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 2100 GoToResolveRemoteControl.exe 2100 GoToResolveRemoteControl.exe 2200 GoToResolveFileManager.exe 2200 GoToResolveFileManager.exe 1844 GoToResolveQuickView.exe 2100 GoToResolveRemoteControl.exe 2200 GoToResolveFileManager.exe 548 GoToResolveUnattendedUi.exe 3856 GoToResolveServiceManager.exe 3844 GoToResolveNetworkChecker.exe 3856 GoToResolveServiceManager.exe 3336 GoToResolveRegistryEditor.exe 1916 GoToResolveTerminal.exe 3336 GoToResolveRegistryEditor.exe 3292 GoToResolveExternalModuleHandler.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2892 cmd.exe 4624 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRegistryEditor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveFileManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EviteRSVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveTerminal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveServiceManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRemoteControl.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4816 PING.EXE - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveRemoteControl.exe - Delays execution with timeout.exe 4 IoCs
pid Process 460 timeout.exe 2788 timeout.exe 4172 timeout.exe 4812 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveRemoteControl.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5DE81D42-CE2B-4A7E-B1B7-1312FA11C82B}\INPROCSERVER32 GoToResolveUnattended.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5DE81D42-CE2B-4A7E-B1B7-1312FA11C82B} GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel GoToResolveUnattended.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{5DE81D42-CE2B-4A7E-B1B7-1312FA11C82B}\INPROCSERVER32\THREADINGMODEL GoToResolveUnattended.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4816 PING.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 548 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3976 EviteRSVP.exe 3976 EviteRSVP.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 1536 GoToResolveProcessChecker.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 3292 GoToResolveExternalModuleHandler.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1844 GoToResolveQuickView.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe 1764 GoToResolveUnattended.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeAuditPrivilege 1192 svchost.exe Token: SeSecurityPrivilege 1192 svchost.exe Token: SeShutdownPrivilege 4412 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 4412 GoToResolveUnattended.exe Token: SeShutdownPrivilege 4988 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 4988 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 1536 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 1536 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 1536 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 1536 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 1764 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 1764 GoToResolveUnattended.exe Token: SeShutdownPrivilege 2100 GoToResolveRemoteControl.exe Token: SeCreatePagefilePrivilege 2100 GoToResolveRemoteControl.exe Token: SeShutdownPrivilege 1844 GoToResolveQuickView.exe Token: SeCreatePagefilePrivilege 1844 GoToResolveQuickView.exe Token: SeShutdownPrivilege 2200 GoToResolveFileManager.exe Token: SeCreatePagefilePrivilege 2200 GoToResolveFileManager.exe Token: SeShutdownPrivilege 3856 GoToResolveServiceManager.exe Token: SeCreatePagefilePrivilege 3856 GoToResolveServiceManager.exe Token: SeShutdownPrivilege 3336 GoToResolveRegistryEditor.exe Token: SeCreatePagefilePrivilege 3336 GoToResolveRegistryEditor.exe Token: SeShutdownPrivilege 3844 GoToResolveNetworkChecker.exe Token: SeCreatePagefilePrivilege 3844 GoToResolveNetworkChecker.exe Token: SeShutdownPrivilege 3292 GoToResolveExternalModuleHandler.exe Token: SeCreatePagefilePrivilege 3292 GoToResolveExternalModuleHandler.exe Token: SeShutdownPrivilege 1916 GoToResolveTerminal.exe Token: SeCreatePagefilePrivilege 1916 GoToResolveTerminal.exe Token: SeShutdownPrivilege 548 GoToResolveUnattendedUi.exe Token: SeCreatePagefilePrivilege 548 GoToResolveUnattendedUi.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe 548 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3976 wrote to memory of 4412 3976 EviteRSVP.exe 86 PID 3976 wrote to memory of 1692 3976 EviteRSVP.exe 87 PID 3976 wrote to memory of 2892 3976 EviteRSVP.exe 88 PID 1692 wrote to memory of 1580 1692 GoToResolveTools64.exe 90 PID 2892 wrote to memory of 460 2892 cmd.exe 91 PID 1192 wrote to memory of 2504 1192 svchost.exe 93 PID 2892 wrote to memory of 2788 2892 cmd.exe 94 PID 2892 wrote to memory of 4172 2892 cmd.exe 95 PID 4412 wrote to memory of 4988 4412 GoToResolveUnattended.exe 98 PID 2892 wrote to memory of 4812 2892 cmd.exe 100 PID 1536 wrote to memory of 2812 1536 GoToResolveProcessChecker.exe 103 PID 1536 wrote to memory of 1764 1536 GoToResolveProcessChecker.exe 105 PID 1764 wrote to memory of 1388 1764 GoToResolveUnattended.exe 107 PID 1764 wrote to memory of 784 1764 GoToResolveUnattended.exe 108 PID 1764 wrote to memory of 3292 1764 GoToResolveUnattended.exe 111 PID 1764 wrote to memory of 2200 1764 GoToResolveUnattended.exe 112 PID 1764 wrote to memory of 1844 1764 GoToResolveUnattended.exe 113 PID 1764 wrote to memory of 1916 1764 GoToResolveUnattended.exe 114 PID 1764 wrote to memory of 3856 1764 GoToResolveUnattended.exe 115 PID 1764 wrote to memory of 2100 1764 GoToResolveUnattended.exe 116 PID 1764 wrote to memory of 3336 1764 GoToResolveUnattended.exe 117 PID 1764 wrote to memory of 3844 1764 GoToResolveUnattended.exe 118 PID 1536 wrote to memory of 548 1536 GoToResolveProcessChecker.exe 119 PID 1388 wrote to memory of 4824 1388 GoToResolveLoggerProcess.exe 120 PID 2100 wrote to memory of 224 2100 GoToResolveRemoteControl.exe 121 PID 1844 wrote to memory of 3656 1844 GoToResolveQuickView.exe 122 PID 3844 wrote to memory of 1468 3844 GoToResolveNetworkChecker.exe 123 PID 3336 wrote to memory of 1904 3336 GoToResolveRegistryEditor.exe 124 PID 2200 wrote to memory of 736 2200 GoToResolveFileManager.exe 125 PID 3856 wrote to memory of 4976 3856 GoToResolveServiceManager.exe 126 PID 3292 wrote to memory of 5048 3292 GoToResolveExternalModuleHandler.exe 127 PID 1916 wrote to memory of 1864 1916 GoToResolveTerminal.exe 128 PID 548 wrote to memory of 4800 548 GoToResolveUnattendedUi.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\EviteRSVP.exe"C:\Users\Admin\AppData\Local\Temp\EviteRSVP.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveUnattended.exe" -regsvc2⤵
- Checks computer location settings
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 4412 -InstallationId Jd9VlAqHtj -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709" -ApplicationType 4 -Environment "Production" -ForceInstall 03⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTools64.exe" -InstallVDD2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=version=1.24.0.142 --initial-client-data=0x32c,0x330,0x334,0x328,0x338,0x7ff76419baf8,0x7ff76419bb10,0x7ff76419bb283⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\EviteRSVP.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\EviteRSVP.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:460
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2788
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4172
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4812
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{01fb8df3-70eb-a440-936c-174dd4791a30}\g2rvdd.inf" "9" "4a1c237fb" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2504
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709" -ApplicationType "4"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x850,0x854,0x858,0x634,0x85c,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc2⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:2812
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/1153080285157970709/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "1536" "-InstallationId" "Jd9VlAqHtj" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_1153080285157970709" "-Service" "-LogLevel" "2"2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 1764 -CompanyId 1153080285157970709 -InstallationId Jd9VlAqHtj -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709" -Environment Production -ApplicationType 4 -HostId d791f81491899acec0f20da0cc4ef2c0 -LogLevel 2 -SessionType Unattended3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x75c,0x760,0x764,0x730,0x768,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:4824
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x798,0x79c,0x7a0,0x538,0x7a4,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:784
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveExternalModuleHandler.exe" -InstallationId Jd9VlAqHtj -CompanyId 1153080285157970709 -publickey 58f7eadcf9dd967df829bf24b20fc80d4285acfd610f8fe75f00dff2ed015636 -LogLevel 2 -Environment Production3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x758,0x75c,0x760,0x730,0x764,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:5048
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveFileManager.exeGoToResolveFileManager.exe -CompanyId 1153080285157970709 -Environment Production -InstallationId Jd9VlAqHtj -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x7f0,0x7f4,0x7f8,0x738,0x7fc,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:736
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveQuickView.exeGoToResolveQuickView.exe -InstallationId Jd9VlAqHtj -LogLevel 2 -Environment Production3⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x74c,0x750,0x754,0x728,0x758,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:3656
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTerminal.exeGoToResolveTerminal.exe -CompanyId 1153080285157970709 -Environment Production -InstallationId Jd9VlAqHtj -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x7ec,0x7f0,0x7f4,0x73c,0x7f8,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1864
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveServiceManager.exeGoToResolveServiceManager.exe -CompanyId 1153080285157970709 -Environment Production -InstallationId Jd9VlAqHtj -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x7e8,0x7ec,0x7f0,0x738,0x7f4,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:4976
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveRemoteControl.exeGoToResolveRemoteControl.exe -CompanyId 1153080285157970709 -InstallationId Jd9VlAqHtj -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 13⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x758,0x75c,0x760,0x690,0x764,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:224
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveRegistryEditor.exeGoToResolveRegistryEditor.exe -CompanyId 1153080285157970709 -Environment Production -InstallationId Jd9VlAqHtj -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x7ec,0x7f0,0x7f4,0x738,0x7f8,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:1904
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId Jd9VlAqHtj -CompanyId 1153080285157970709 -Environment Production3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x758,0x75c,0x760,0x72c,0x764,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵
- Executes dropped EXE
PID:1468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GoTo Resolve Unattended\cleanup9466.bat" "3⤵
- Executes a command shell one-liner
PID:4624 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4816
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveRegistryEditor.exeGoToResolveRegistryEditor.exe -CompanyId 1153080285157970709 -Environment Production -InstallationId Jd9VlAqHtj -LogLevel 23⤵PID:4760
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x7f8,0x7fc,0x804,0x740,0x808,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc4⤵PID:2732
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/1153080285157970709/GoToResolveUnattendedUi.exe" "-CompanyId" "1153080285157970709" "-InstallationId" "Jd9VlAqHtj" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Xhbczssi --annotation=installationid=Jd9VlAqHtj --annotation=version=1.27.1.3232 --initial-client-data=0x758,0x75c,0x760,0x734,0x764,0x6ffa6fac,0x6ffa6fbc,0x6ffa6fcc3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:3524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\GOTORE~1\115308~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\115308~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\FileManager.dll
- Size 16.2MB
- SHA256 fa0b23cbb92d9f312e07fd34e9cca29f7f07f857c66437eac688884982c9772a
- MD5 a4f290656640bf413f90120e3a5adce1
- SHA1 1bea9cd003199b7be94f2bb971fcbb7e62d1b31d
- SHA512 d6a4fafb33407f0cbf502e3f83d4bde2d4b35c984793defdc1126b38ab7aea6b31c74c7dd40aa55e538aeaed0efa3ea05bd11b2d8b74981e5e8ea6187bd73331
- SSDEEP 393216:t8NxtVeLf7nCAArnTkXFVtci38fEhJdcJsv6tWKFdu9CErs3ba:t8Nx/eLf7YnTkVci3mE1ruba
- TLSH T12C07BFA2B1639135DD863172792EF73F5E288A244F2644C7925C3DD9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveCrashHandler.exe
- Size 652KB
- SHA256 a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635
- MD5 9574719cdf372198425169af317b0eb4
- SHA1 36cd0b6410d0ee3fe0622d6378b62160baf17c51
- SHA512 629d13ef185ddb14f2abaa385ace9bd201cf35de2f9822112f9f212cd684c8facce1164190f669633acc566964df8346acff6a8077797b324e7b1f02fa5966ab
- SSDEEP 12288:hipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e9:hipIc72CJhxGfRBYcRXHTqM8JMfqPwh2
- TLSH T113E4B011B1818032F5B222B2A9BDBF7059FCB52647BB09D773C44A3B9B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveLoggerProcess.exe
- Size 409KB
- SHA256 ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4
- MD5 47a7dd2ac70934804295fba021cc325c
- SHA1 153f964a9ec4431251b51f2194c580c87da4520f
- SHA512 a2c5cdad9dbb851bc39593b59a9b9af57caa8028222e0456331ee519b513c0d60570b370846f1658a488363f2b30ded8a1750e422c4a69e63a49f35797253f2a
- SSDEEP 6144:avxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAOcya3Qv6EVZp:avxwI7an+olyUan4hNy/jHSEVT
- TLSH T13D949E127A81D032D8B210318EA4DF756A7DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveProcessChecker.exe
- Size 409KB
- SHA256 7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd
- MD5 1de89cd290b4ecba1d834275e914f850
- SHA1 5c204a50b53e1b5ead77b3d0d6335f103074ab29
- SHA512 6247f45e385bd08c7cc926d2f92aba203dcf8f5e95c2d6ed67315b2902c840ae4b0bf973d2081b76732f99c456fdbee6f7ba9e4c44ae13198a92b9566921a2f2
- SSDEEP 6144:7vxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAODiY3Qv6EVZ5:7vxwI7an+olyUan4hNy/jWSEV
- TLSH T1F2949D127AC1D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1
- MD5 4256b14af65b85bf6f7d7a76d63c52e1
- SHA1 f0f6192dd2bfc55fb9608a25207068de48e30023
- SHA512 3833dbadc17d2ac7a56f174b0752f5a67770b8413dad87a248ef5502e323e0345282eac136b2e0467d5bdee088e53287e18ad6804c91a30fde6d45c26f39a560
- SSDEEP 24576:L8d+H5/wzK0K+3AOzTORk0U1BPfypVXISyXthAeagonjfQVp:QGRwO0KYfPORkrHyXCXthzagmQ
- TLSH T1CA558D1A626C41F9D1BFE17C89878A4AE7B17806037187EF13A8475A2F276E15F7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\GoToResolveUnattended.exe
- Size 409KB
- SHA256 3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9
- MD5 bf5b71caaa5051900504a20a670981aa
- SHA1 747defaa7994ef6a9b9b736def73d8e53ff9f0e3
- SHA512 0ebf2412628bdab69e99d2acef8a17005d82c8ae4192e03e3c60eef9e2cd09beaaa1ea294c2bee7bfc4be04c8e783a5af61b348957984b84b915acea384f76bb
- SSDEEP 6144:/vFwjIKCan+HIlnusRWaUnox9CdER02gOu6+nbjAOdBIa3Qv6EVZo:/vFwkLan+olus6nox5ybjySEVG
- TLSH T1AF949D127A81D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\LibGoToResolve.dll
- Size 19.5MB
- SHA256 ddf3244decb29688d6a1972d3004f92bd365700bc77606efce8013a3677c6a83
- MD5 d7a242def5ff195ea246e33e28413999
- SHA1 3ba086b87fc81c21673252b70f8d29bb91d45a56
- SHA512 659e016968f18af79df9a513d972dda79bc84d16f4aad9023df238c4fde946ca46ae856b60234a49a587aa002153097a44855100dc88bc6a22ba9a8319acbf70
- SSDEEP 196608:muMIO5dY3td4PLTm1lW3ILzUmMcBs0Qooa4C7Gs8Jsv6tWKFdu9C5qhnjxFJoHI:ZZiMYmh3H7H8Jsv6tWKFdu9Ckh1oo
- TLSH T13727AFD27147C0F1E98A11B9A53AAB3F8678A8504B2954D797EC3E1D99301D33F37A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\MediaClientLib.dll
- Size 14.0MB
- SHA256 16729d5e7273b72c0fa05d08734f558c9da7f939900dcf38c1356edbbdade0c5
- MD5 99c94e16cc0b360eea8164a74972092b
- SHA1 280cd506fa6e0e1a586fbfc6265f43ab40eea2bc
- SHA512 d6e6ac52ba9d8ac4faf718897ea2b33a690b2f757c688072ca628eee03a50b374ba777641620f4e0310fa82453b1de6a1cb4e88bdb0d58f9c5f899ca0a075d51
- SSDEEP 196608:nVf8Kglmgw143el82aJdnv4KMGx715CARN775eciChoUCCp1kxJ3gF:nVf8vRC4HnhMc5Co5F8GkxJ3gF
- TLSH T16DE6AFC1E1625174C9461870AD3DAA3E6E28025D87B089F7BBD85CA07BF37D0377A786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100
- MD5 acf440dd02b14609359844366e281ef9
- SHA1 288190791a137dec98109104392a13eba4ae6abc
- SHA512 4d7b7b09903145319ea1509c56cd60fcfcf932fbf9396697ac3ecfb8bd9e7f8e3453579954812f8b58f38f9971627b4dd252deb172f085f4aec5c364e0ebce6f
- SSDEEP 24576:4ZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr54:lYM801G81cOS5TI1hr54
- TLSH T1C9458C03BAC189B1F5AE06B448B6B33C897EBD704734C5C75BC8688969715C1BB3B396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 c24fe5213f16a9dc6e2ae232c7d2f134f94ac9ad9a5122dd988a15448554398f
- MD5 20e52839c9139cbad78103f64e3c68fd
- SHA1 1b954c79b5b11c5cd819f81c24350607d41ec497
- SHA512 3cb02a88243bf6da5dd64bfc27cfd05518635e5d343011a93cb46c3b354519a29f8209a8e336cbe2f161caa26138317d0cf6326d41adb8bf6e6c313bbeba06c1
- SSDEEP 48:onppO77Qhkf4q4Xdi9jvPYUzvJiUC5p57Jbuei4PYUzvJip5pZjXu7Jb8Zei5IXJ:oSPcO49gxhX0wihYTg2zQEfHkVhkK
- TLSH T11791419809F531B707729B7DFE0F289AB061685E94F0687197DC856B19CAF2523F3030
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\GoToResolveUnattended.log
- Size 2KB
- SHA256 5aa4b8531f79ae18435c410b16f4f7cb76d6797aa311398291c647c9be5cb705
- MD5 0fb9d6610bf911509dc96ea8314c11e0
- SHA1 386f7ddb23b8a25ab5e70848b85c020a4b8292df
- SHA512 932b9e021f74b8b7ade3b7f66e86c805b0e9901df719a0363247bbef4e8089957bf6e36a296c0a4677e7ed4408ac33ed0be807741da5f40da21ea7c22c6493d7
- TLSH T16051B0D91DA635F7C62201BEBC0576D5B013223EADD84E49A3C91A1C21CDF1727B73A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\appdata\UnattendedUiCrashReportDB\reports\4eb05317-e861-40e4-973f-a6bb0655909b.dmp
- Size 256KB
- SHA256 f9c29e2b07e5c54fbe3ad55377b94f057414f91b3568ec7a9c0709349363840d
- MD5 a56dc9a76a9c8271662c7919c6a2723b
- SHA1 038432dd53a9d737e6ad695cbadc7d7f9a245542
- SHA512 4b8231dbf7755f76b5a81e57d97c2e831b69fe74e281697e08e2dacf82b48c0b75864b567dc07f011940eb9758b65e23cf339ac33d0ed10be126521dfcd52e1e
- SSDEEP 1536:olVjRmKo6jhhqjpxxoNeGKvAGXOvajsYELCvmGSxukYmNg9FqfgUV0K:wtAl6jzyKNeGKvAGXwajszLJuR9qgK
- TLSH T121447566AFD81DAADE27573568D38B107771E8255F93C71B072102BE1C7B380AE32E16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 7667612b7ee8efd38b87050f6a58b291831a90310c9a72b08179e66eec55b9d0
- MD5 afc23696090bbe82aae9e8b108d6cbd2
- SHA1 73d749b6ea4ce572cdf921c2f0fb210c7cc0d4c0
- SHA512 52ad3b9ccc99db60ef72adf786e6018a21edbc252bffd384e5a0540d845da4e826bb4f477b01121b3114e34fb84628a7776f66e877a5a86c28bbc35ca91b11fd
- SSDEEP 98304:SD+fVjyaabqoQPk1p7huA0F19IuPj1CPwDvt3uFlDCM:E+1yaabxyshuAkrIu71CPwDvt3uFlDCM
- TLSH T133567C6EA7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\libcrypto-3.dll
- Size 4.2MB
- SHA256 20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a
- MD5 e2d7132d06648c344f851a16d2830964
- SHA1 153034cc90a84282c15ca91b401f120a516435cf
- SHA512 552e4eb9bdd888ce2a177e795aeed88bcce2ab6f2c71617a6e8354d4d7c4ef6b51517172c1451a7be43a32a1a7a97fb9febe5222f519a3ed99c13f19d5e8eeac
- SSDEEP 49152:Fyx0uEV3rsWweF37k5FyOgvMbziX+cg1CPwDvt3uFlDCPSmFzO2rnd:w0uEiGNOhKX+P1CPwDvt3uFlDC7
- TLSH T12B26BF12FB936591E8CF927D12EEA33F0E3D5B14872489D38EA615E9C8256C0773E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\libssl-3.dll
- Size 1.1MB
- SHA256 9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf
- MD5 753cfc508dcc0883db50d5069cd81a4f
- SHA1 c8193d2556392324007f6a4e916620b85600c24b
- SHA512 3137c88fe025ff3e3bf068f23b31ab7d3a468c5fee172726e25351aa83c4b5cdb89b000d03b829c35cba0f13d0d5783e11a6db3c29da23a81b57158d725f9ff9
- SSDEEP 12288:OasfmiM1aHnChqPS3/pziY7g6X5zTR4bQT6clxHlhhNFXN2WcrFe9XbOz5:tsfmL5VbRl/f0WcrFe9XbOz5
- TLSH T10135AF11BA814970DCE661BE06EDB77E473DA2601318C9C78F8559FADE206C16B3A3CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\mandatory.json
- Size 1KB
- SHA256 3c3a30d6b357f7bba935cb735d48a9535b85d61e1897f56640fe8ae900ab8a1b
- MD5 3f4a6f9a457a423a493cb9413a16daa5
- SHA1 30373f91dd3cc1ccfd19548d893a3beb2d12f8db
- SHA512 9297cd617cec11afc940dcdf5add98a155b2df43bb93b23c6f6d6e11212103dce0100153868c1f96ff0110662fb6318cd90a3a75115e59dbdf3688695a497c21
- TLSH T10311ADB0C9612D770B0099DCDC16654A72114D775D84B8F6BB481A1E0F4FE6F227213D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\unattended.json
- Size 699B
- SHA256 a6289d8fff07a9aa02add1958088107c4aea70dfb6754da6c77f90540d1ab55a
- MD5 dd1f7947c6055c04442eeae43a2697e8
- SHA1 388748c3aa79e7a31e895a87ce3418b5654cb87d
- SHA512 2ba40868a98de6b4f8ded214921616c1a987174403a89594dce3c87b01d8e08343b2454019a92107521a1c14139c6772cc053c5159a12f440b4e830588aab038
- TLSH T12C017BA50EF625394B02BEDCCC1EA45EE2A64C6265C8BCE6DD1D2E2F0893F922157435
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\unattended.json
- Size 1KB
- SHA256 8958a001501926467819cb05c9cd754cd9a5db9fa0de5312066ce443c01ca79d
- MD5 4962704b6c5402d331398f6725c488d8
- SHA1 cd7356d000ea854fdcd18facb99cafd19e0b9ea6
- SHA512 bcdab0a5060e5739f2c976ff652fb03bb46fbb26ac0edf56e7b156bd4aa67837bd3df08077a4479ecd05e57552d39ad55de823fff8456bb6241415a879313445
- TLSH T10621C0A0CDA12D770B0099D8DC1A264E72214A775C9878F6BB481A1E0F8FF6F31B257D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\1153080285157970709\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 739f8e541c286e7e353621d69bacc9ced66521aef62008cfe48fa653c19fbb78
- MD5 38752c7d832a0a6328ff7d2872c6ef67
- SHA1 16d1c875027a526ae9d0a68be92c227e200e71d1
- SHA512 21c03f1f279d9ddc89250115b49d0e396a35196a1e44ccf9ad05c3da0defe9095e6e78d565cee39ccf0753c6d3b86618a08c224372a4adc0ee7108fc5a038eb8
- TLSH T1CA019923595E44A12C64625514F494B767D7D7907DE32B53A094190A2020B5FAE71061
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 727B
- SHA256 d187b91a776be684301d113b3a1a454cbd6e96fda9e6644fb22909f472e12782
- MD5 1ac8cc1c13f54816c54d58ee2dc81af7
- SHA1 fc22f5ec9047e326f4bcbb6794e74b217a26e38e
- SHA512 f4bae2b8aa5f43d6049102d8f24ba09d2c25dd64f4e03a90f61c5049921fe07d860bbc0c79093425ec4aacbd970442cc498c6e957b180946b4ec9edd51afea78
- TLSH T1E60165432AD812C0A8811D59AB788B503CF1128430550D6633342AA0E355AAD6533B2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 95ea782e285a91dadbca45b666cd2ee890fdf1c0b02c2e2aef8428e361fbbf4e
- MD5 0f1b78390a65769a27ba033c7f1f7d04
- SHA1 0d74594d2ea2f2a484b1d36264f786207969a5a2
- SHA512 5ac20c31e28cfc232c1c2188f558998039be7df65362693fbcc9ab0dc29c7ac9120dbf1fdf7f8c69349cf76b8352effb57b2dce100aaa63edf360174b9431d5a
- TLSH T19CE0C6281FF3427EF3ABCA354ED1B6228819F1469800C7A40E90090CCA5CB042E928F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 cfbf2c8d6429ccf98de772d7ce4f6bbf0944443b318b92f0dd74ed2d2267c151
- MD5 5ef3e39db980b3f689e56e6a1c8310b4
- SHA1 44e96738cd604e280549bb11e67d74820f4e3780
- SHA512 b993f0101a61715775eff2774219409156c119e3f2370f2ea59b90fd291db9818da41c877b7c75c6493514bb5d70e7d0eb60c48401ae242b2c89af37cbe2c46b
- TLSH T12FE0C03426FA444DF1F1D03402EB6D22854AF2160C03CB9D26E063046765A404DD7D30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
- Size 6KB
- SHA256 87e820d97133cb4b9b9cb37935a7b404f71e8ca75820bb2947105da8a6e2975c
- MD5 2b407e40990c2f4a53856aae4d76804d
- SHA1 c2e567c215612a6b3962e8945712e157d74d0207
- SHA512 068684a10123a50ea25e47c1568e5397de4aa19224c926dbb1c78b5fc76308c19a79a312682a1355d86f020020e22766762fac69b46db746b8602b995ee11af3
- SSDEEP 192:1YzrRgvOwh2A28/2ti2v2f2+242P2B202620O/alCJO:CXRgvHh2A28/2ti2v2f2+242P2B2026D
- TLSH T193D18692B2EFEAB40407EB7C7C01178ED55268B1A6FC38D4F3D53C99C6A6E09499C532
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log
- Size 3KB
- SHA256 a1482a4f672f2bee4a35368067452b627f06edd0f785934cab347e21b4940615
- MD5 797f06383106795b1c6abd3a51bce5dc
- SHA1 7c47a1f2ec860cc8dac4d44035fc65612923b40e
- SHA512 784159a44f2e5c40e75b95647e7fbe8daa0775f3449ec16f5f200940f508afc463082d1379419108eb27b665220cf7f5bdb86bf4552ea19f95dc13e1b141f974
- TLSH T10C812692759FFAFA0446C7BDBD4117CAA14624B28CAC2D5193C43DEDE1AEE0312DD262
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\EviteRSVP.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 41a844405e29279792889d0762f7e99232c75a03fb99c9b997d09ed55239d401
- MD5 7a8d4a976bac24775060ec55bdbcb8a0
- SHA1 274841c30802b76124e6261c9e3ce81d1ca97a93
- SHA512 f2b7cb709d1743c719bd049cf1a815819b6b93f0322f18024bf723639aff559780261cfc12e8ca07549eec2abe697d39a5cdcedf345f54e566f9e2fea325e2c2
- TLSH T142E0C6281EF3423EF3ABCA354ED1B962882DF1579800C7A40EA00D0C9B4DB002E928F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 afd504944eca30ad2c7f360c4ef4ecaa01953a9d5d05d12975541ca1a0590e9f
- MD5 b52e38c47b8748bf53b0e0263661f0e9
- SHA1 cf7e5c37e310a042539392b0268750aae9364a49
- SHA512 bdd1c39f0b80f1aefb0a323a769273e17d1065a77927f3709c7400b91013b88675ca2106a13e16e27077bc47ba33615be6deadd5de366f90c85b53047cbee830
- TLSH T1C4E0C03426FA448DF0F1D03442FA6D21494AF2160802CB9D26E473056765A404DD3D30
- MD5 SHA1 SHA512 TLSH