Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 12:09
Behavioral task
behavioral1
Sample
Access_Documents.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
Access_Documents.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target Access_Documents.exe
- Size 23.3MB
- Sample261027-pblr2ade22
- SHA256 9d0f757af542331cd7208026383fa2fcc8ddbf2ada37592910b96195c4a2f1c3
- MD5 f70d1bc5756a31c39525a6a09f0831a8
- SHA1 cbaf112e891d636c47846b7513bf0192bf33d693
- SHA512 fe40bf855e040f3d9d910c187a88a1e91597af2a5e6d11808cbdcc49b1ffd1a333b16ddecdd04e0f8c11cca0f0de1f76ef800132f3e58d8b436bf8569e06618b
- SSDEEP 393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpZ:q9WtLzgOTbjZvk/ekS/mcpZ
- TLSH T12337333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion GoToResolveQuickView.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral1/files/0x00070000000243b6-136.dat rat_gotoresolve - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation GoToResolveUnattended.exe - Drops file in System32 directory 36 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\g2rvdd.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\SETE0E6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\g2rvdd.dll DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7 GoToResolveNetworkChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\SETE0E5.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 GoToResolveProcessChecker.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c} DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache GoToResolveProcessChecker.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\SETE0E5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\SETE0E6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\SETE0E7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft GoToResolveProcessChecker.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveProcessChecker.exe File opened for modification C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{91232db6-1aed-5648-82c4-f8d293c18e7c}\SETE0E7.tmp DrvInst.exe File created C:\Windows\system32\GoToResolveUnlock64.dll GoToResolveUnattended.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 GoToResolveNetworkChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 GoToResolveNetworkChecker.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData GoToResolveProcessChecker.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7 GoToResolveNetworkChecker.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 10 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveQuickView.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\Logs\FileManager-2026-10-27T12-13-17-064Z.log GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2dfdd3a1-0bd9-481a-4f80-38df8690dcd7.run\session.json GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnlock64.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB\settings.dat GoToResolveRemoteControl.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2dfdd3a1-0bd9-481a-4f80-38df8690dcd7.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRegistryEditor.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x86\g2rvdd.inf Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\lmiscrhook32.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveNetworkChecker.log GoToResolveNetworkChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64\g2rvdd.cat Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\MediaClientLib.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\pc.json.tmp GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a8e4f5b2-cad2-427a-a746-2ec52dd23648.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB\settings.dat GoToResolveQuickView.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB\settings.dat GoToResolveUnattendedUi.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LibGoToResolve.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a962786d-1493-4baa-11d1-0c076028c28d.run.lock GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattendedUi.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattendedRemover.exe Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a8e4f5b2-cad2-427a-a746-2ec52dd23648.run.lock GoToResolveRegistryEditor.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB\settings.dat GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x86\g2rvdd.cat Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\PasswordPrivacyDll.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveFileManager.log GoToResolveFileManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\lmiscrhook64.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\5f876365-cf95-4bca-8d22-255520dc7afe.run\session.json GoToResolveTerminal.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a962786d-1493-4baa-11d1-0c076028c28d.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\FileManager.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3-x64.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB\settings.dat GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a962786d-1493-4baa-11d1-0c076028c28d.run\session.json GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a962786d-1493-4baa-11d1-0c076028c28d.run.lock GoToResolveTerminal.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a962786d-1493-4baa-11d1-0c076028c28d.run.lock GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveRemoteControl.log GoToResolveRemoteControl.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\007e26ec-1109-412b-b1d8-c9dbaebdee53.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64\g2rvdd.inf Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\2dfdd3a1-0bd9-481a-4f80-38df8690dcd7.run.lock GoToResolveServiceManager.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a8e4f5b2-cad2-427a-a746-2ec52dd23648.run.lock GoToResolveServiceManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LMISupportM32.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libssl-3-x64.dll Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB\settings.dat GoToResolveFileManager.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUpdaterCopy.csv GoToResolveLoggerProcess.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUpdater.csv Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\.sentry-native\a962786d-1493-4baa-11d1-0c076028c28d.run.lock GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB\settings.dat GoToResolveExternalModuleHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRemoteControl.exe Access_Documents.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\legacy.dll Access_Documents.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata Access_Documents.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe - Executes dropped EXE 28 IoCs
pid Process 872 GoToResolveUnattended.exe 2692 GoToResolveTools64.exe 3316 GoToResolveCrashHandler.exe 612 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 1804 GoToResolveCrashHandler.exe 3792 GoToResolveUnattended.exe 4876 GoToResolveLoggerProcess.exe 856 GoToResolveCrashHandler.exe 1484 GoToResolveExternalModuleHandler.exe 3776 GoToResolveFileManager.exe 3824 GoToResolveQuickView.exe 3624 GoToResolveTerminal.exe 1592 GoToResolveServiceManager.exe 3116 GoToResolveRemoteControl.exe 4032 GoToResolveRegistryEditor.exe 3800 GoToResolveNetworkChecker.exe 4408 GoToResolveUnattendedUi.exe 3760 GoToResolveCrashHandler.exe 4756 GoToResolveCrashHandler.exe 4904 GoToResolveCrashHandler.exe 4244 GoToResolveCrashHandler.exe 4380 GoToResolveCrashHandler.exe 4484 GoToResolveCrashHandler.exe 4204 GoToResolveCrashHandler.exe 4640 GoToResolveCrashHandler.exe 4704 GoToResolveCrashHandler.exe 4344 GoToResolveCrashHandler.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3772 sc.exe 3984 sc.exe - Loads dropped DLL 64 IoCs
pid Process 2692 GoToResolveTools64.exe 872 GoToResolveUnattended.exe 872 GoToResolveUnattended.exe 872 GoToResolveUnattended.exe 872 GoToResolveUnattended.exe 872 GoToResolveUnattended.exe 872 GoToResolveUnattended.exe 612 GoToResolveProcessChecker.exe 612 GoToResolveProcessChecker.exe 612 GoToResolveProcessChecker.exe 612 GoToResolveProcessChecker.exe 612 GoToResolveProcessChecker.exe 612 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 4876 GoToResolveLoggerProcess.exe 4876 GoToResolveLoggerProcess.exe 4876 GoToResolveLoggerProcess.exe 4876 GoToResolveLoggerProcess.exe 4876 GoToResolveLoggerProcess.exe 3824 GoToResolveQuickView.exe 3776 GoToResolveFileManager.exe 1592 GoToResolveServiceManager.exe 4032 GoToResolveRegistryEditor.exe 1484 GoToResolveExternalModuleHandler.exe 3116 GoToResolveRemoteControl.exe 3624 GoToResolveTerminal.exe 4876 GoToResolveLoggerProcess.exe 3800 GoToResolveNetworkChecker.exe 3776 GoToResolveFileManager.exe 1592 GoToResolveServiceManager.exe 4032 GoToResolveRegistryEditor.exe 3116 GoToResolveRemoteControl.exe 1484 GoToResolveExternalModuleHandler.exe 3624 GoToResolveTerminal.exe 3824 GoToResolveQuickView.exe 3800 GoToResolveNetworkChecker.exe 3776 GoToResolveFileManager.exe 4032 GoToResolveRegistryEditor.exe 3776 GoToResolveFileManager.exe 1592 GoToResolveServiceManager.exe 4032 GoToResolveRegistryEditor.exe 4032 GoToResolveRegistryEditor.exe 3776 GoToResolveFileManager.exe 3624 GoToResolveTerminal.exe 3116 GoToResolveRemoteControl.exe 3624 GoToResolveTerminal.exe 1484 GoToResolveExternalModuleHandler.exe 3116 GoToResolveRemoteControl.exe 3824 GoToResolveQuickView.exe 1592 GoToResolveServiceManager.exe 1592 GoToResolveServiceManager.exe 3624 GoToResolveTerminal.exe 3116 GoToResolveRemoteControl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3308 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 28 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveRegistryEditor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveTerminal.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveNetworkChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveServiceManager.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveUnattendedUi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveUnattendedUi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveFileManager.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveTerminal.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveServiceManager.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveLoggerProcess.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveLoggerProcess.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveRegistryEditor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveExternalModuleHandler.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveFileManager.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveExternalModuleHandler.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname GoToResolveNetworkChecker.exe - System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveFileManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveLoggerProcess.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveExternalModuleHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveQuickView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveCrashHandler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveNetworkChecker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Access_Documents.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveTerminal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRemoteControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveServiceManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveRegistryEditor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoToResolveUnattendedUi.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveRemoteControl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveQuickView.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveQuickView.exe - Delays execution with timeout.exe 4 IoCs
pid Process 1780 timeout.exe 404 timeout.exe 412 timeout.exe 4520 timeout.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople GoToResolveLoggerProcess.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveNetworkChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveTerminal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveServiceManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveRemoteControl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveRegistryEditor.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveFileManager.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveExternalModuleHandler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveQuickView.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveLoggerProcess.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b} GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv" GoToResolveUnattended.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32 GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToResolveUnlock64.dll" GoToResolveUnattended.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment" GoToResolveUnattended.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4408 GoToResolveUnattendedUi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 Access_Documents.exe 4828 Access_Documents.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 1484 GoToResolveExternalModuleHandler.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 3824 GoToResolveQuickView.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 724 GoToResolveProcessChecker.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe 3792 GoToResolveUnattended.exe - Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeAuditPrivilege 1228 svchost.exe Token: SeSecurityPrivilege 1228 svchost.exe Token: SeShutdownPrivilege 872 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 872 GoToResolveUnattended.exe Token: SeShutdownPrivilege 612 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 612 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 724 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 724 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 724 GoToResolveProcessChecker.exe Token: SeCreatePagefilePrivilege 724 GoToResolveProcessChecker.exe Token: SeShutdownPrivilege 3792 GoToResolveUnattended.exe Token: SeCreatePagefilePrivilege 3792 GoToResolveUnattended.exe Token: SeShutdownPrivilege 4032 GoToResolveRegistryEditor.exe Token: SeCreatePagefilePrivilege 4032 GoToResolveRegistryEditor.exe Token: SeShutdownPrivilege 3776 GoToResolveFileManager.exe Token: SeCreatePagefilePrivilege 3776 GoToResolveFileManager.exe Token: SeShutdownPrivilege 3624 GoToResolveTerminal.exe Token: SeCreatePagefilePrivilege 3624 GoToResolveTerminal.exe Token: SeShutdownPrivilege 1484 GoToResolveExternalModuleHandler.exe Token: SeCreatePagefilePrivilege 1484 GoToResolveExternalModuleHandler.exe Token: SeShutdownPrivilege 3824 GoToResolveQuickView.exe Token: SeCreatePagefilePrivilege 3824 GoToResolveQuickView.exe Token: SeShutdownPrivilege 3116 GoToResolveRemoteControl.exe Token: SeCreatePagefilePrivilege 3116 GoToResolveRemoteControl.exe Token: SeShutdownPrivilege 1592 GoToResolveServiceManager.exe Token: SeCreatePagefilePrivilege 1592 GoToResolveServiceManager.exe Token: SeShutdownPrivilege 3800 GoToResolveNetworkChecker.exe Token: SeCreatePagefilePrivilege 3800 GoToResolveNetworkChecker.exe Token: SeShutdownPrivilege 4408 GoToResolveUnattendedUi.exe Token: SeCreatePagefilePrivilege 4408 GoToResolveUnattendedUi.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe - Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe 4408 GoToResolveUnattendedUi.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4828 wrote to memory of 872 4828 Access_Documents.exe 84 PID 4828 wrote to memory of 2692 4828 Access_Documents.exe 85 PID 4828 wrote to memory of 3308 4828 Access_Documents.exe 86 PID 2692 wrote to memory of 3316 2692 GoToResolveTools64.exe 88 PID 3308 wrote to memory of 4520 3308 cmd.exe 92 PID 1228 wrote to memory of 4396 1228 svchost.exe 93 PID 3308 wrote to memory of 1780 3308 cmd.exe 96 PID 3308 wrote to memory of 404 3308 cmd.exe 98 PID 872 wrote to memory of 612 872 GoToResolveUnattended.exe 99 PID 3308 wrote to memory of 412 3308 cmd.exe 103 PID 724 wrote to memory of 1804 724 GoToResolveProcessChecker.exe 105 PID 724 wrote to memory of 3792 724 GoToResolveProcessChecker.exe 106 PID 3792 wrote to memory of 4876 3792 GoToResolveUnattended.exe 109 PID 3792 wrote to memory of 856 3792 GoToResolveUnattended.exe 110 PID 3792 wrote to memory of 1484 3792 GoToResolveUnattended.exe 111 PID 3792 wrote to memory of 3776 3792 GoToResolveUnattended.exe 112 PID 3792 wrote to memory of 3824 3792 GoToResolveUnattended.exe 113 PID 3792 wrote to memory of 3624 3792 GoToResolveUnattended.exe 114 PID 3792 wrote to memory of 1592 3792 GoToResolveUnattended.exe 115 PID 3792 wrote to memory of 3116 3792 GoToResolveUnattended.exe 116 PID 3792 wrote to memory of 4032 3792 GoToResolveUnattended.exe 117 PID 3792 wrote to memory of 3800 3792 GoToResolveUnattended.exe 118 PID 724 wrote to memory of 4408 724 GoToResolveProcessChecker.exe 119 PID 4876 wrote to memory of 3760 4876 GoToResolveLoggerProcess.exe 122 PID 4032 wrote to memory of 4756 4032 GoToResolveRegistryEditor.exe 123 PID 3776 wrote to memory of 4904 3776 GoToResolveFileManager.exe 124 PID 1484 wrote to memory of 4244 1484 GoToResolveExternalModuleHandler.exe 125 PID 3116 wrote to memory of 4380 3116 GoToResolveRemoteControl.exe 126 PID 3824 wrote to memory of 4484 3824 GoToResolveQuickView.exe 127 PID 3624 wrote to memory of 4204 3624 GoToResolveTerminal.exe 128 PID 3800 wrote to memory of 4640 3800 GoToResolveNetworkChecker.exe 129 PID 1592 wrote to memory of 4704 1592 GoToResolveServiceManager.exe 130 PID 4408 wrote to memory of 4344 4408 GoToResolveUnattendedUi.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe"C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe" -regsvc2⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 872 -InstallationId wxo2bAdMiz -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -ApplicationType 4 -Environment "Production" -ForceInstall 03⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe" -InstallVDD2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=version=1.24.0.142 --initial-client-data=0x31c,0x324,0x330,0x328,0x334,0x7ff63b53baf8,0x7ff63b53bb10,0x7ff63b53bb283⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3316
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4520
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1780
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:404
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:412
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fc0bff45-27e3-584e-8b8f-189f9a5e1feb}\g2rvdd.inf" "9" "485c3f42b" "0000000000000148" "WinSta0\Default" "0000000000000150" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4396
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -ApplicationType "4"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x84c,0x850,0x854,0x848,0x858,0x6ff76fac,0x6ff76fbc,0x6ff76fcc2⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:1804
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe"C:/Program Files (x86)/GoTo Resolve Unattended/4535335282478998551/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "724" "-InstallationId" "wxo2bAdMiz" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_4535335282478998551" "-Service" "-LogLevel" "2"2⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveLoggerProcess.exeGoToResolveLoggerProcess.exe -ParentProcessId 3792 -CompanyId 4535335282478998551 -InstallationId wxo2bAdMiz -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -Environment Production -ApplicationType 4 -HostId 4d5c9ca15d231c2f3d68e2aaf0e55c07 -LogLevel 2 -SessionType Unattended3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x700,0x704,0x708,0x6c8,0x70c,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Executes dropped EXE
PID:3760
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x7d0,0x7d4,0x7d8,0x748,0x7dc,0x6ff76fac,0x6ff76fbc,0x6ff76fcc3⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:856
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe" -InstallationId wxo2bAdMiz -CompanyId 4535335282478998551 -publickey 1a1b52cf4c7aba62e657c86541120c578ceaa2b79c2365f29f3c763bedbdd8b9 -LogLevel 2 -Environment Production3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x754,0x758,0x75c,0x730,0x760,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Executes dropped EXE
PID:4244
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveFileManager.exeGoToResolveFileManager.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId wxo2bAdMiz -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x7f0,0x7f4,0x7f8,0x740,0x7fc,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Executes dropped EXE
PID:4904
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveQuickView.exeGoToResolveQuickView.exe -InstallationId wxo2bAdMiz -LogLevel 2 -Environment Production3⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x710,0x714,0x718,0x6f0,0x71c,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Executes dropped EXE
PID:4484
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTerminal.exeGoToResolveTerminal.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId wxo2bAdMiz -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x7e8,0x7ec,0x7f0,0x738,0x7f4,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4204
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveServiceManager.exeGoToResolveServiceManager.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId wxo2bAdMiz -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x7f4,0x7f8,0x7fc,0x744,0x804,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4704
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRemoteControl.exeGoToResolveRemoteControl.exe -CompanyId 4535335282478998551 -InstallationId wxo2bAdMiz -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 13⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x758,0x75c,0x760,0x510,0x764,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4380
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRegistryEditor.exeGoToResolveRegistryEditor.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId wxo2bAdMiz -LogLevel 23⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x7f0,0x7f4,0x7f8,0x740,0x7fc,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Executes dropped EXE
PID:4756
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveNetworkChecker.exeGoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId wxo2bAdMiz -CompanyId 4535335282478998551 -Environment Production3⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x74c,0x750,0x754,0x730,0x758,0x6ff76fac,0x6ff76fbc,0x6ff76fcc4⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:4640
-
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattendedUi.exe"C:/Program Files (x86)/GoTo Resolve Unattended/4535335282478998551/GoToResolveUnattendedUi.exe" "-CompanyId" "4535335282478998551" "-InstallationId" "wxo2bAdMiz" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Iphxuvfw --annotation=installationid=wxo2bAdMiz --annotation=version=1.27.1.3232 --initial-client-data=0x74c,0x750,0x754,0x720,0x758,0x6ff76fac,0x6ff76fbc,0x6ff76fcc3⤵
- Executes dropped EXE
PID:4344
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:3772
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start GoToResolve_45353352824789985511⤵
- Launches sc.exe
PID:3984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\FileManager.dll
- Size 16.2MB
- SHA256 fa0b23cbb92d9f312e07fd34e9cca29f7f07f857c66437eac688884982c9772a
- MD5 a4f290656640bf413f90120e3a5adce1
- SHA1 1bea9cd003199b7be94f2bb971fcbb7e62d1b31d
- SHA512 d6a4fafb33407f0cbf502e3f83d4bde2d4b35c984793defdc1126b38ab7aea6b31c74c7dd40aa55e538aeaed0efa3ea05bd11b2d8b74981e5e8ea6187bd73331
- SSDEEP 393216:t8NxtVeLf7nCAArnTkXFVtci38fEhJdcJsv6tWKFdu9CErs3ba:t8Nx/eLf7YnTkVci3mE1ruba
- TLSH T12C07BFA2B1639135DD863172792EF73F5E288A244F2644C7925C3DD9BB705E23B36283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
- Size 652KB
- SHA256 a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635
- MD5 9574719cdf372198425169af317b0eb4
- SHA1 36cd0b6410d0ee3fe0622d6378b62160baf17c51
- SHA512 629d13ef185ddb14f2abaa385ace9bd201cf35de2f9822112f9f212cd684c8facce1164190f669633acc566964df8346acff6a8077797b324e7b1f02fa5966ab
- SSDEEP 12288:hipIeD/QOu+knUEf1IGXTWp3R94REnT1lkxdXIphalx5rS72yHS1n3qUVU8uU7e9:hipIc72CJhxGfRBYcRXHTqM8JMfqPwh2
- TLSH T113E4B011B1818032F5B222B2A9BDBF7059FCB52647BB09D773C44A3B9B242D22F35756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveLoggerProcess.exe
- Size 409KB
- SHA256 ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4
- MD5 47a7dd2ac70934804295fba021cc325c
- SHA1 153f964a9ec4431251b51f2194c580c87da4520f
- SHA512 a2c5cdad9dbb851bc39593b59a9b9af57caa8028222e0456331ee519b513c0d60570b370846f1658a488363f2b30ded8a1750e422c4a69e63a49f35797253f2a
- SSDEEP 6144:avxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAOcya3Qv6EVZp:avxwI7an+olyUan4hNy/jHSEVT
- TLSH T13D949E127A81D032D8B210318EA4DF756A7DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe
- Size 409KB
- SHA256 7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd
- MD5 1de89cd290b4ecba1d834275e914f850
- SHA1 5c204a50b53e1b5ead77b3d0d6335f103074ab29
- SHA512 6247f45e385bd08c7cc926d2f92aba203dcf8f5e95c2d6ed67315b2902c840ae4b0bf973d2081b76732f99c456fdbee6f7ba9e4c44ae13198a92b9566921a2f2
- SSDEEP 6144:7vxwnIqKan+HIl/aUxWaUn4hN6dER82AOGGHS/jAODiY3Qv6EVZ5:7vxwI7an+olyUan4hNy/jWSEV
- TLSH T1F2949D127AC1D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19B31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1
- MD5 4256b14af65b85bf6f7d7a76d63c52e1
- SHA1 f0f6192dd2bfc55fb9608a25207068de48e30023
- SHA512 3833dbadc17d2ac7a56f174b0752f5a67770b8413dad87a248ef5502e323e0345282eac136b2e0467d5bdee088e53287e18ad6804c91a30fde6d45c26f39a560
- SSDEEP 24576:L8d+H5/wzK0K+3AOzTORk0U1BPfypVXISyXthAeagonjfQVp:QGRwO0KYfPORkrHyXCXthzagmQ
- TLSH T1CA558D1A626C41F9D1BFE17C89878A4AE7B17806037187EF13A8475A2F276E15F7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe
- Size 409KB
- SHA256 3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9
- MD5 bf5b71caaa5051900504a20a670981aa
- SHA1 747defaa7994ef6a9b9b736def73d8e53ff9f0e3
- SHA512 0ebf2412628bdab69e99d2acef8a17005d82c8ae4192e03e3c60eef9e2cd09beaaa1ea294c2bee7bfc4be04c8e783a5af61b348957984b84b915acea384f76bb
- SSDEEP 6144:/vFwjIKCan+HIlnusRWaUnox9CdER02gOu6+nbjAOdBIa3Qv6EVZo:/vFwkLan+olus6nox5ybjySEVG
- TLSH T1AF949D127A81D032D8B210318EA4EF75667DEC304BA29ADF67D43E5E8E306D19F31766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LibGoToResolve.dll
- Size 19.5MB
- SHA256 ddf3244decb29688d6a1972d3004f92bd365700bc77606efce8013a3677c6a83
- MD5 d7a242def5ff195ea246e33e28413999
- SHA1 3ba086b87fc81c21673252b70f8d29bb91d45a56
- SHA512 659e016968f18af79df9a513d972dda79bc84d16f4aad9023df238c4fde946ca46ae856b60234a49a587aa002153097a44855100dc88bc6a22ba9a8319acbf70
- SSDEEP 196608:muMIO5dY3td4PLTm1lW3ILzUmMcBs0Qooa4C7Gs8Jsv6tWKFdu9C5qhnjxFJoHI:ZZiMYmh3H7H8Jsv6tWKFdu9Ckh1oo
- TLSH T13727AFD27147C0F1E98A11B9A53AAB3F8678A8504B2954D797EC3E1D99301D33F37A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\MediaClientLib.dll
- Size 14.0MB
- SHA256 16729d5e7273b72c0fa05d08734f558c9da7f939900dcf38c1356edbbdade0c5
- MD5 99c94e16cc0b360eea8164a74972092b
- SHA1 280cd506fa6e0e1a586fbfc6265f43ab40eea2bc
- SHA512 d6e6ac52ba9d8ac4faf718897ea2b33a690b2f757c688072ca628eee03a50b374ba777641620f4e0310fa82453b1de6a1cb4e88bdb0d58f9c5f899ca0a075d51
- SSDEEP 196608:nVf8Kglmgw143el82aJdnv4KMGx715CARN775eciChoUCCp1kxJ3gF:nVf8vRC4HnhMc5Co5F8GkxJ3gF
- TLSH T16DE6AFC1E1625174C9461870AD3DAA3E6E28025D87B089F7BBD85CA07BF37D0377A786
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\PasswordPrivacyDll.dll
- Size 1.1MB
- SHA256 e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100
- MD5 acf440dd02b14609359844366e281ef9
- SHA1 288190791a137dec98109104392a13eba4ae6abc
- SHA512 4d7b7b09903145319ea1509c56cd60fcfcf932fbf9396697ac3ecfb8bd9e7f8e3453579954812f8b58f38f9971627b4dd252deb172f085f4aec5c364e0ebce6f
- SSDEEP 24576:4ZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr54:lYM801G81cOS5TI1hr54
- TLSH T1C9458C03BAC189B1F5AE06B448B6B33C897EBD704734C5C75BC8688969715C1BB3B396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveProcessChecker.log
- Size 4KB
- SHA256 1a588625c9487d106a39ae3511a8b8fc225029da09761fd80b3694013e89f7a0
- MD5 ff1815e933280f5ff2c1c741e53040c8
- SHA1 1602e9a378e188acfb5e58d29dd702c368db7c28
- SHA512 5cba737940d93a98fb44d4a33d6f9f03c7badfc32398bf61638975e026f829373eef3da4b3430721d093a6b99c8cde327efc3a0b8ee0dcff127147d865153fad
- SSDEEP 96:oxIx464IVaOXQ+twzoaOfi+t2zj7fXfprEK:ICB4+aEQIkoanIij7fXxrEK
- TLSH T1079103D90868347713B1AB9EED4E386AE171189D45F426B49FC84EA71ACFF1417E3620
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log
- Size 2KB
- SHA256 26a8b4bed01af5117ce97d5d430cb5e5f5df099f6dbbb72206cfa9c4d19f1bb5
- MD5 d0ae3a059b4a9223799fc1a574ee002c
- SHA1 82d221581ace6d4241401cad306f98862a08fc8f
- SHA512 eeeb6150d3dd4cab3067b17ea5603cb45492fa785bca0070d025dad4cd603d572314eed0cf72fb34c1fc17abd8784ace63946d2216a26d31350704b8969f99fd
- TLSH T14B519BC2581D75D7822146257C8EB6A0B82321BF9DCC4C886AC14AD862DFD472FDFBB1
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUpdater.csv
- Size 6KB
- SHA256 f5b7fb4b86d1bf6b0974d6f793510dc9a42aa80e109b48da8d21aca10cb90102
- MD5 6d03205bbb60cdae2ce0b52cbc0826f0
- SHA1 b4698d9568c9a02ebb544f80886efd60ec2072e0
- SHA512 367f2bd81f23288bf95a58bff32495936d480087525dd099699cf02c0da75666346cb43bf8ee9034f78c81218630f8e980e887cb1fb63e2cb59349dcdcbe5c53
- SSDEEP 192:GL6zhCHKptG7x2e2U2n2T2w2u2Y252F2A2Z2ck/JfRHb3:S6dCHKpw7x2e2U2n2T2w2u2Y252F2A2e
- TLSH T1C0D147D2F09BEBF90027A7387C01134A9A1755A0AAFD31DCBBD07DE9427BD144A0D9A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3-x64.dll
- Size 5.8MB
- SHA256 7667612b7ee8efd38b87050f6a58b291831a90310c9a72b08179e66eec55b9d0
- MD5 afc23696090bbe82aae9e8b108d6cbd2
- SHA1 73d749b6ea4ce572cdf921c2f0fb210c7cc0d4c0
- SHA512 52ad3b9ccc99db60ef72adf786e6018a21edbc252bffd384e5a0540d845da4e826bb4f477b01121b3114e34fb84628a7776f66e877a5a86c28bbc35ca91b11fd
- SSDEEP 98304:SD+fVjyaabqoQPk1p7huA0F19IuPj1CPwDvt3uFlDCM:E+1yaabxyshuAkrIu71CPwDvt3uFlDCM
- TLSH T133567C6EA7A81149E0BAD13CC6574A23D2B1F81647B093CF09A596B91F33FD92B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3.dll
- Size 4.2MB
- SHA256 20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a
- MD5 e2d7132d06648c344f851a16d2830964
- SHA1 153034cc90a84282c15ca91b401f120a516435cf
- SHA512 552e4eb9bdd888ce2a177e795aeed88bcce2ab6f2c71617a6e8354d4d7c4ef6b51517172c1451a7be43a32a1a7a97fb9febe5222f519a3ed99c13f19d5e8eeac
- SSDEEP 49152:Fyx0uEV3rsWweF37k5FyOgvMbziX+cg1CPwDvt3uFlDCPSmFzO2rnd:w0uEiGNOhKX+P1CPwDvt3uFlDC7
- TLSH T12B26BF12FB936591E8CF927D12EEA33F0E3D5B14872489D38EA615E9C8256C0773E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libssl-3.dll
- Size 1.1MB
- SHA256 9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf
- MD5 753cfc508dcc0883db50d5069cd81a4f
- SHA1 c8193d2556392324007f6a4e916620b85600c24b
- SHA512 3137c88fe025ff3e3bf068f23b31ab7d3a468c5fee172726e25351aa83c4b5cdb89b000d03b829c35cba0f13d0d5783e11a6db3c29da23a81b57158d725f9ff9
- SSDEEP 12288:OasfmiM1aHnChqPS3/pziY7g6X5zTR4bQT6clxHlhhNFXN2WcrFe9XbOz5:tsfmL5VbRl/f0WcrFe9XbOz5
- TLSH T10135AF11BA814970DCE661BE06EDB77E473DA2601318C9C78F8559FADE206C16B3A3CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\logger.json
- Size 321B
- SHA256 be1d505aa26ae85783019744ac4079c4f87c226f7a0e4774e3b40cc2c7700c31
- MD5 8b6e9ee09ccb8c5b5d78f26f4dbe9f82
- SHA1 2124aea8dce9f36716c8c84a4e07c5125babfa8d
- SHA512 63876ab8589048f39228901a6f55eca995ef6d086aef9a921a46081485b0d13815fb176935e1f855b6c9008a81a9b22b8256627ae42390436ed482bfca3f29f9
- TLSH T14BE020E0C8419C8516455551647C1B472221932B9E24200671812B1F0F4EE3F05B7069
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\mandatory.json
- Size 1KB
- SHA256 a4717c4e5b7ba5ab9518719fd33bd61fa7369ba17aa3bf3a4d842a4b71bae365
- MD5 664479c0f16f768a7c9a96f806d4f47e
- SHA1 62eb9d1f2f9e9ae023337329289b460c5a315662
- SHA512 f7c341762607902029427c79b88e96886b3be93e8e6f4152104cbf813ce36ea9c40fa5b214b26296b9aaffe85463e042f9e7b837e8ec438ced230674c5cab7ba
- TLSH T17711ADE1CCA11E7B17156DD4CC25190BB2218A570D45B4EABB8D1E1E0F8FEAF21B213D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json
- Size 697B
- SHA256 232496d23b4620c969c06729b8eb50e62591b602bf337549baa9a905a5de103c
- MD5 9b14ac894b1b6bb7496ff11049bec379
- SHA1 e4b263bfdbf5d364b83afa296780694053c1a801
- SHA512 ace9d8fd2aaa6e120a1f63329b598807f9cdb0bee92eb1d570e54f7736e37ab21c45101e77e0b502bd9edca4572223ae27cbe97615ceae3a2407492e24c79860
- TLSH T1B70170E10DF635394713BEC8CC5E685FE1AA4C5125C4B9E2AC4D2E1A04D3F933146438
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json
- Size 1KB
- SHA256 d73f568dcfb3d7b16ecf871e911aed09fabe3c13b4e238e1df38ca88c7a4c7ed
- MD5 a0d6e8a2ae3d5fa637cd8443cd3f9a44
- SHA1 4f405a13b704f2842718b11eb08522042afe680c
- SHA512 a9b277a46248c06c8650be3234bdf6cd052c5f576a5b9b235ae98ebe97c30513c2131d2513e307b4ac03dfb2ab00d45e2a284587d775bfcd789a201026cdca1d
- TLSH T1BF11ADE0CCA16D3B0711ADD4DC152A4BB2214A675D5474EABB4D0E1E0F8FEAF21B213C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 5d7fe0f2148ec6e446ae64dc4432f98a7cd208172b79638edd5699944c667c6a
- MD5 2fe7300cbbc06c992f93593c890c265c
- SHA1 825c3a22c064b3a1b6a1f43b4448ef7e81b5eb90
- SHA512 5fc82d228815151bc8c15c26965a026a1aeea0606fbd66e2be02f3f9114b5184fe71f47f146b78208d84ae1de35b192d2e95cf1025253c18b8b5359e5fbcbe6c
- TLSH T13D0194AAE4BEA4823CA8474C85F00950A0F7D56137EF6D8ED6210A87205C22D1F33014
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 727B
- SHA256 97f0e0380bb98dc911291d6c3864c904e5f45422c90b8ad3a9e1ff98c4be4861
- MD5 336fc8b3adba01e67ea1d6b6e6e174e4
- SHA1 c680dedcaf98e25c19e27693f75acb96dfc748de
- SHA512 91bcca1eb3814d8519a90442a889009a7c5edee0337b6547c908662f46f518d7cbaba0953c320f323f7b0552b002ab5f151e55fe3e7b923aea7b7b19a733d10f
- TLSH T19001155669DC9BB19F971CD9CABC45B03950213559D9408F16E40204F5843253DAD500
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 01b1b9651103f58c246f69908685e5a7de54d0e3e608ee1351b0c9267db98ee4
- MD5 0072cd16bf2990b2c84c4c2b9b4f0ef4
- SHA1 69b86b7d2f9813aea4d575cd360646311d5dca7f
- SHA512 b259cbc79a3544111f1191b508734f04f7aff5fd117fa387711d12c5bf812e6e926e088ebb405caf9dfd781fc6684e270479fc5a203e055c6005844b0c45b85e
- TLSH T1F4E0C0241DF6003DF357C5798FC2B4176C09F166685087A00D90090C9B15B000D734F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 bc7b4e5aebaafbe2ba339b6463cdcedc42809ad2f03e202403104f5a89a0aac9
- MD5 d18b651f6dd80343e8749c3f4a65d550
- SHA1 259104b614ff0a56455c04eb5500e838e7bdc31d
- SHA512 8d7e76e6bdcb93b003db5bf38d670a15ad9bef76d6b5c3864829ec883d3253b0fb00a793e91eab213786a99c86945ed8661de420602dfcdbb5f7cfaef4bfb5ba
- TLSH T188E0C63432FA888EF2F9E03402FAB8220A4DF2160841C3A921C01224AB66A801CEA930
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log
- Size 3KB
- SHA256 9b4d7d6f82a9bf1faf652eb039c5cafdfd57d98048098dfc0c41c7e9d8afa943
- MD5 44dfd30763b736326dd34a17357a4fd6
- SHA1 a412445624316c371b7d053389f2d446e9e4f8be
- SHA512 01cd3350763df93ae010333dd91d849f6004917aabd06229e16c693074387f4f8b6a6f8a9f5de011fdfee114f739a919829bf84e8afb9885e3f0bf1c0f53acd6
- TLSH T1A381E9D2F42BFBFA0401CA6C7C4917D96C4645F58CDC19A4A7D0B9ED826FE032E4D156
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{fc0bff45-27e3-584e-8b8f-189f9a5e1feb}\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{fc0bff45-27e3-584e-8b8f-189f9a5e1feb}\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 42c9ae0b4fbd3e3b84acf6cd1123452483cd2af2e7b9c31f74304e96dfff25af
- MD5 17da6a845873b55ee544ba44afa76194
- SHA1 368a7e8c5d6d9c1f0f2f246797de401dc5ed2dbe
- SHA512 3e843f36d1fe4c24707ae14d8c906bb7360b7fd5c255d7cb46b68711aa5134878a38d804a70bbde55b61747a3300446c325e7d979cd73b6541bbf134e5e767ac
- TLSH T12EE0C0241DF6003DF397C5758FC274276C09F172B85087A10E90450C9B05F000D634F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
- Size 408B
- SHA256 b4ec3207c0ab801c3547e41da618c58870ad7a17f448b355ccc9d790fb281859
- MD5 131cac07fb3fd7cd8f6df953f9d0900f
- SHA1 e5b9c68cdf84f0e877ec6a0a9907ba119f15cc92
- SHA512 71a2cbd7d58b797c5e31a4d25107a49fd8e7fcf5262c3264d0a7459d7fc273f2430134cf3810053e7a26bf5bfc975ac0dc9688f2af363482884ac90511ca0645
- TLSH T1B9E0C03421FE444DF1F4E03402F578210A0DF2170C41C26D11D05624A666B401CDB920
- MD5 SHA1 SHA512 TLSH