24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 8d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.Scam.LConnect Sample 77e22f4e1af7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 77e22f4e1af7…. Malware family: Application.Scam.LConnect. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e","keywords":["Malicious","Application.Scam.LConnect","malware analysis","sandbox report","threat intelligence","77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e"],"about":{"@type":"SoftwareApplication","name":"DamicoStockstillPolicy.exe","applicationCategory":["peexe","executable"],"identifier":"77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.Scam.LConnect","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T620,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "DamicoStockstillPolicy.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "DamicoStockstillPolicy.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "DamicoStockstillPolicy.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")26:T5e8,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "DamicoStockstillPolicy.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "void *__cdecl crashpad::`anonymous-namespace'::OpenThread(const struct crashpad::process_types::SYSTEM_THREAD_INFORMATION &)" (Indicator: "OpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")27:T1005,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "DamicoStockstillPolicy.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "DamicoStockstillPolicy.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "DamicoStockstillPolicy.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "DamicoStockstillPolicy.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "DamicoStockstillPolicy.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "Check failed: WaitForSingleObject(semaphore_, INFINITE) == WAIT_OBJECT_0" (Indicator: "WaitForSingleObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject crash dump requested" (Indicator: "WaitForSingleObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject non-crash dump requested" (Indicator: "WaitForSingleObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "RegisterWaitForSingleObject process end" (Indicator: "WaitForSingleObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")28:T6c1,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")29:Tcfd,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "DamicoStockstillPolicy.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "DamicoStockstillPolicy.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "LMIInputHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "LMIInputHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "LMIInputHook32.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "LMIInputHook32.dll")2a:Ta12,file/memory contains long string with (Indicator: "SHA384"; File: "lmiscrhook64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "lmiscrhook32.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "SHA384"; File: "LMIInputHook32.dll") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "DamicoStockstillPolicy.exe") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "DamicoStockstillPolicy.exe") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "DamicoStockstillPolicy.exe") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "DamicoStockstillPolicy.exe") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "DamicoStockstillPolicy.exe") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "DamicoStockstillPolicy.exe") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "DamicoStockstillPolicy.exe") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "DamicoStockstillPolicy.exe") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "DamicoStockstillPolicy.exe") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007224-00000CC3-930354979") Found reference to "RC2_ecb_encrypt" (Indicator: "RC2"; File: "DamicoStockstillPolicy.exe") Found reference to "RC2_ofb64_encrypt" (Indicator: "RC2"; File: "DamicoStockstillPolicy.exe") Found reference to "RC2_cfb64_encrypt" (Indicator: "RC2"; File: "DamicoStockstillPolicy.exe") Found reference to "RC2_set_key" (Indicator: "RC2"; File: "DamicoStockstillPolicy.exe") Found reference to "RC2_cbc_encrypt" (Indicator: "RC2"; File: "DamicoStockstillPolicy.exe") Found reference to "RSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.03140000.00000004.mdmp")2b:T4dd,"GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "GoToResolveUnattended.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "GoToResolveUnattended.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER") "GoToResolveUnattended.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\GOTORESOLVEUNATTENDED.EXE") "GoToResolveUnattended.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE_36354489") "GoToResolveUnattended.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE") "GoToResolveUnattended.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE")2c:Tb24,"DamicoStockstillPolicy.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-919101848 [PID: 4960] "DamicoStockstillPolicy.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-919108488 [PID: 4960] "DamicoStockstillPolicy.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-919742059 [PID: 4960] "DamicoStockstillPolicy.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-919748936 [PID: 4960] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-923559765 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-923567633 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-924072676 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-924101103 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-925124178 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-925143598 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-925341643 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-925353337 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-926276480 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-926283143 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-926534385 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-926541856 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-926950927 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-926957235 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-927412169 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-927418475 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-928196858 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-928227969 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-928517267 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-928524283 [PID: 7224] "GoToResolveUnattended.exe" queried SystemProcessInformation at 00000000-00007224-00000C15-928856018 [PID: 7224]2d:Td57,Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "DamicoStockstillPolicy.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "DamicoStockstillPolicy.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "DamicoStockstillPolicy.exe") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "DamicoStockstillPolicy.exe") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "DamicoStockstillPolicy.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "DamicoStockstillPolicy.exe") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "DamicoStockstillPolicy.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "DamicoStockstillPolicy.exe") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "DamicoStockstillPolicy.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "DamicoStockstillPolicy.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "DamicoStockstillPolicy.exe") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "DamicoStockstillPolicy.exe") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002896.00000001.129761.031FF000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")2e:T112b,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-1528-0092CF20 Assembly shows XOR instruction xor byte ptr [ebp+45C68045h] cl in Stream UID: 00000000-00004960-6143-1528-0092CF20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-1535-008998A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-1536-008A54C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-1540-0088A530 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-1580-008BC560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-2339-008981B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-6143-2339-008981B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-2364-008A2980 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-6143-2364-008A2980 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-2645-00907460 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-6143-2645-00907460 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-2688-00905780 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-3070-008EBC00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-4158-008B9820 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-6143-4158-008B9820 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-4210-008D6310 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-6143-4488-00934560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007224-15826-1060-00557340 Assembly shows XOR instruction xor byte ptr [ebp+45C68045h] cl in Stream UID: 00000000-00007224-15826-1060-00557340 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007224-15826-1175-00555DD0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007224-15826-1175-00555DD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-13-00645B74 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-61-00637C9C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-61-00637C9C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-176-005FAF40 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-176-005FAF40 Assembly shows XOR instruction xor eax dword ptr [edx+08h] in Stream UID: 00000000-00007476-24058-319-006478D0 Assembly shows XOR instruction xor dword ptr [edx+08h] eax in Stream UID: 00000000-00007476-24058-319-006478D0 Assembly shows XOR instruction xor ecx dword ptr [edx+08h] in Stream UID: 00000000-00007476-24058-319-006478D0 Assembly shows XOR instruction xor dword ptr [edx+08h] ecx in Stream UID: 00000000-00007476-24058-319-006478D0 Assembly shows XOR instruction xor ecx dword ptr [edx] in Stream UID: 00000000-00007476-24058-319-006478D0 Assembly shows XOR instruction xor dword ptr [edx] ecx in Stream UID: 00000000-00007476-24058-319-006478D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-373-0064C019 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-373-0064C019 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-388-0064C588 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-388-0064C588 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-456-0065216C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-456-0065216C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-479-0064BD3D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-498-005FADC0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-498-005FADC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007476-24058-556-005FB0A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007476-24058-556-005FB0A02f:T1003b,Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: ip.zscaler.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Host: ip.zscaler.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Host: ip.zscaler.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET / HTTP/1.1Host: ip.zscaler.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET / HTTP/1.1Host: ip.zscaler.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "comX" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "1600971844239445521X" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Hash" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET /properties HTTP/1.1Host: devices.console.gotoresolve.comX-CompanyId: 1600971844239445521X-Version: 1.27.1.3232X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1Content-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2519Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2443Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2625Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2754Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2701Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2744Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "GET /api/live HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET /api/live HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET /api/live HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET /api/live HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET /api/live HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET /api/live HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2716Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2461Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2682Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2577Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2609Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2595Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET / HTTP/1.1Host: devices-iot.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "sessions" in header "GET /api/health HTTP/1.1Host: sessions.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET /api/health HTTP/1.1Host: sessions.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET /api/health HTTP/1.1Host: sessions.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET /api/health HTTP/1.1Host: sessions.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET /api/health HTTP/1.1Host: sessions.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET /api/health HTTP/1.1Host: sessions.console.gotoresolve.comContent-Length: 0Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 3174Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2539Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2774Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2530Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2520Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2611Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 4669Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "dumpster" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api/sendEventsV2 HTTP/1.1Host: dumpster.console.gotoresolve.comContent-Type: application/jsonAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3Content-Length: 2566Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0"30:T5c1,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm31:T628,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "DamicoStockstillPolicy.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "DamicoStockstillPolicy.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMISupport7x32.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMISupportM32.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "lmiscrhook64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "lmiscrhook32.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIFilterHook64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIInputHook64.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "g2rvdd.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIFilterHook32.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "LMIInputHook32.dll") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")32:T422,Found string "QueryServiceConfigW" (File: "DamicoStockstillPolicy.exe") Found string "QueryServiceConfig2W" (File: "DamicoStockstillPolicy.exe") Found string "QueryServiceStatus" (File: "DamicoStockstillPolicy.exe") Found string "EnumServicesStatusW" (File: "DamicoStockstillPolicy.exe") Found string "QueryServiceConfig failed, could not get the required size of buffer for service config. Error: %d" (File: "DamicoStockstillPolicy.exe") Found string "QueryServiceConfig failed. Error: %d" (File: "DamicoStockstillPolicy.exe") Found string "EnumServicesStatusW" (Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found string "QueryServiceConfigW" (Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found string "QueryServiceConfig2W" (Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found string "QueryServiceStatus" (Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found string "QueryServiceStatusEx" (Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")33:T8c7,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "DamicoStockstillPolicy.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")34:T4e6,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")35:T607,Found system information discovery API: "GetEnvironmentStringsW" in file "DamicoStockstillPolicy.exe" Found system information discovery API: "RtlNtStatusToDosError" in file "DamicoStockstillPolicy.exe" Found system information discovery API: "NtQuerySystemInformation" in file "DamicoStockstillPolicy.exe" Found system information discovery API: "GetSystemInfo" in file "DamicoStockstillPolicy.exe" Found system information discovery API: "GetUserObjectInformationW" in file "DamicoStockstillPolicy.exe" Found system information discovery API: "GetNativeSystemInfo" in file "DamicoStockstillPolicy.exe" Found system information discovery API: "NtQuerySystemInformation SystemExtendedHandleInformation" in file "00000000-00007476.00000000.127481.005F1000.00000020.mdmp" Found system information discovery API: "::NtQuerySystemInformation" in file "00000000-00007476.00000000.127481.005F1000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004388.00000000.129182.003A3000.00000002.mdmp"36:T16ae,"DamicoStockstillPolicy.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000038f1ef02e8102677000000000800000008efef02000000000000000000000000000000000000000000000000000000000000000000000000180000005235154669006e00b0e8ef026f00720034f0ef02a0189973be236037feffffff22c28c5c6068240318f0ef020000657660682403f0006576000000004cefef020000000048f0ef02b0e82d779a1d5429feffffffacefef02c0192b77010000000000657600000000000000006068240300000000a8482403f00065760000000158f0ef02f20d2a77090000000cf0ef0218f0ef02fadd8c5c6068240300000000a8482403a46824030000000002000000000000006cf0ef020000000001000000 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000240330f6ef02000000002f752c771902917278000000000000002c0200000000000019029172000000003900f30400f6ef0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff00000000008b720000000020f6ef02008000000000000000000000000000000000000000000000000000002c0200000000000019029172000000003900f30400f6ef02b0252a7700008b72a83c240320f6ef0208f6ef0267452a770cd3387700000000000000000000000000000000000000002da32c77000000000100000008000000a83c240334f6ef028269fb7500008b7200000000 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000ef02c6562a7740f5ef020000000008282503000000000828250300742c7740f5ef020000000008282503d8f5ef02ec742c772c28250324f6ef02000000002f752c777a6ff27178000000000000004c020000000000007a6ff271000000002e00ea71f0f5ef0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a10300000000000000000000008000000000000000000000000000000000000000000000000000004c020000000000007a6ff271000000002e00ea71f0f5ef02b0252a777ad88c5cecf5ef0280732c77850000004f0000007a6ff2712cf6ef02 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007224)37:T6ed,"DamicoStockstillPolicy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "DamicoStockstillPolicy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GoToResolveTools64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GoToResolveTools64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "GoToResolveCrashHandler.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "GoToResolveProcessChecker.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")38:T436,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")39:T44d,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "DamicoStockstillPolicy.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")3a:T9b6,"GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")3b:T63b,"DamicoStockstillPolicy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "DamicoStockstillPolicy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY\CERTIFICATES"; Key: "") "DamicoStockstillPolicy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY\CRLS"; Key: "") "DamicoStockstillPolicy.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "GoToResolveUnattended.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB")3c:T8c4,"DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\GoTo Resolve Installer (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter x86 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateDirectoryW" with parameter x64 (UID: 00000000-00004960) "GoToResolveTools64.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata (UID: 00000000-00008124) "GoToResolveTools64.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB (UID: 00000000-00008124) "GoToResolveTools64.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\reports (UID: 00000000-00008124) "GoToResolveTools64.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\attachments (UID: 00000000-00008124) "GoToResolveCrashHandler.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\reports (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\attachments (UID: 00000000-00007476)3d:T45f,"DamicoStockstillPolicy.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe" -regsvc" - (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools64.exe" -InstallVDD" - (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "CreateProcessW" with parameter "cmd.exe /S /C ""C:\DamicoStockstillPolicy.exe.cmd" "C:\DamicoStockstillPolicy.exe""" - (UID: 00000000-00004960) "GoToResolveUnattended.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpi" - (UID: 00000000-00007224) "GoToResolveTools64.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveCrashHandler.exe" "--database=%PROGRAMFILES%\(x86" - (UID: 00000000-00008124) "cmd.exe" called "CreateProcessW" with parameter "timeout /T 3" - (UID: 00000000-00003824)3e:T7bff,"DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004960) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter POWRPROF.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SAS.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter SLWGA.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PSAPI.DLL (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter snmpapi.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter inetmib1.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00007224) "GoToResolveUnattended.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007224) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00008124) "GoToResolveTools64.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008124) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003824) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003824) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003824) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003824) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007476) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter POWRPROF.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SAS.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SLWGA.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PSAPI.DLL (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter snmpapi.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter inetmib1.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002896) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter AVRT.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d2d1.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter DWrite.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter pdh.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter POWRPROF.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SAS.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter SLWGA.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter WinTrust.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PSAPI.DLL (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wtsapi32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wsock32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter snmpapi.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter inetmib1.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004388) "GoToResolveProcessChecker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00004388)3f:T4b3,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateDirectoryExW" (Indicator: "CreateDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "bool __cdecl crashpad::`anonymous-namespace'::CreateDirectoryIfNecessary(const class base::FilePath &)" (Indicator: "CreateDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "bool __cdecl crashpad::LoggingCreateDirectory(const class base::FilePath &,enum crashpad::FilePermissions,bool)" (Indicator: "CreateDirectory"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "CreateDirectoryCommandResponder" (Indicator: "CreateDirectory"; Source: "00000000-00002896.00000001.129761.70A00000.00000004.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateDirectoryExW" (Indicator: "CreateDirectory"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")40:T474,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateFile() error: {}" (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateFileMapping() error: {}" (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")41:T18066,Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "QueryServiceConfigW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "StartServiceW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeleteService"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegDeleteKeyExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "QueryServiceStatus"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegCloseKey"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumServicesStatusW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenServiceW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegDeleteTreeA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ControlService"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "BuildSecurityDescriptorW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CertCloseStore"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CryptProtectData"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CertGetNameStringW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CertOpenStore"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TlsGetValue"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ExitThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetEvent"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LockFileEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindClose"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "lstrlenW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCPInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsValidLocale"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetStdHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TransactNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateEventA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TerminateProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TlsFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateFileW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WriteFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileSize"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapSize"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileType"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WaitNamedPipeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ExitProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetVersionExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CloseHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RaiseException"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LocalAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CompareStringEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FreeLibrary"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TlsSetValue"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindResourceW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SleepEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LockResource"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LoadResource"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LCMapStringW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetVersion"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetStringTypeExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SizeofResource"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetStdHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CompareStringW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateProcessW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeleteFileW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "lstrcpyW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenEventA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CopyFileExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetProcAddress"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsWow64Process"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetACP"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "Sleep"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ResetEvent"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DecodePointer"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateEventW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetLastError"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "TlsAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CompareFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetLastError"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "lstrcatW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "UnlockFileEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FormatMessageW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LocalFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetLocalTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "MoveFileExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindNextFileW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateDirectoryExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EncodePointer"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReadFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LCMapStringA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetOEMCP"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FormatMessageA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VariantClear"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "PathIsDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "wsprintfW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LoadStringA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ShowWindow"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "gethostname"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WSAStartup"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WSACleanup"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RtlUnwind"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileAttributes"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeleteFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "BuildSecurityDescriptor"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindFirstFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindNextFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindFirstFileEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RemoveDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "NtCreateFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "NtQueryDirectoryFile"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlsAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlsFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlsGetValue"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlsSetValue"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DisplayVersion"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CryptMsgClose"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CryptMsgGetParam"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReportEventW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualProtect"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DeleteFiber"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualLock"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ConvertThreadToFiberEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateFiberEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsThreadAFiber"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetTempPathW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "MessageBoxW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "getsockopt"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ioctlsocket"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WSASetLastError"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "getservbyport"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "htons"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "closesocket"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "inet_ntoa"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "gethostbyname"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "getsockname"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "getservbyname"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "htonl"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ntohs"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "recvfrom"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "inet_addr"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaOpenPolicy"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaNtStatusToWinError"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaRetrievePrivateData"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaStorePrivateData"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaClose"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CryptUnprotectData"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetProductInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiBuildDriverInfoList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiGetDriverInfoDetailW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiDestroyDriverInfoList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiGetClassDevsW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiEnumDriverInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiCreateDeviceInfoList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LookupAccountSidW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetTokenInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EqualSid"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsTokenRestricted"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FreeSid"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "Thread32First"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "IsBadReadPtr"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindNextVolumeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenEventW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapDestroy"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapCreate"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetTickCount"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateMutexW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ResumeThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "Thread32Next"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindFirstVolumeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "QueryDosDeviceW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlushConsoleInputBuffer"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindVolumeClose"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "Process32NextW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "Process32FirstW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SysAllocString"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SysFreeString"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumProcessModules"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumProcesses"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "NdrOleAllocate"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "NdrOleFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "PathStripPathW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "PathRemoveExtensionW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CloseWindowStation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CloseDesktop"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumDesktopsW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "MessageBoxA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenWindowStationW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "EnumDesktopWindows"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CoUninitialize"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenMutexW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualQuery"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaDeregisterLogonProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaLookupAuthenticationPackage"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LsaConnectUntrusted"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "HeapQueryInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetThreadContext"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetProcessId"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SuspendThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetSearchPathMode"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VerQueryValue"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpen"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpConnect"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpWriteData"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReadData"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "NtOpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "CreateSemaphore"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "NtResumeProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "RegisterClass"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "GetMessage"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClass"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "PostMessage"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "CreateEvent"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "ImpersonateNamedPipeClient"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileName"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "NtSuspendProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLongPtr"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLongPtr"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "VirtualProtectEx"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "OpenThread"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "FindNextFileA"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "DamicoStockstillPolicy.exe") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002896.00000001.129761.031FF000.00000004.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp, 00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetNetworkParams"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetDynamicTimeZoneInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrencyFormatW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetGeoInfoW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetUserGeoID"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CharNextExA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AccessCheck"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "MapGenericMask"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "NetShareEnum"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContextA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DeleteSecurityContext"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "timeSetEvent"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "HeapQueryInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgClose"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgGetParam"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")42:T49c,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "DamicoStockstillPolicy.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")43:T811,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "DamicoStockstillPolicy.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "void *__cdecl crashpad::`anonymous-namespace'::OpenThread(const struct crashpad::process_types::SYSTEM_THREAD_INFORMATION &)" (Indicator: "OpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")44:T903,"libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_free" at ordinal 1 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_it" at ordinal 2 "libcrypto-3.dll" contains export function called "ACCESS_DESCRIPTION_new" at ordinal 3 "libcrypto-3.dll" contains export function called "ADMISSIONS_free" at ordinal 4 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_admissionAuthority" at ordinal 5 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_namingAuthority" at ordinal 6 "libcrypto-3.dll" contains export function called "ADMISSIONS_get0_professionInfos" at ordinal 7 "libcrypto-3.dll" contains export function called "ADMISSIONS_it" at ordinal 8 "libcrypto-3.dll" contains export function called "ADMISSIONS_new" at ordinal 9 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_admissionAuthority" at ordinal 10 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_namingAuthority" at ordinal 11 "libcrypto-3.dll" contains export function called "ADMISSIONS_set0_professionInfos" at ordinal 12 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_free" at ordinal 13 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_admissionAuthority" at ordinal 14 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_get0_contentsOfAdmissions" at ordinal 15 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_it" at ordinal 16 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_new" at ordinal 17 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_admissionAuthority" at ordinal 18 "libcrypto-3.dll" contains export function called "ADMISSION_SYNTAX_set0_contentsOfAdmissions" at ordinal 19 "libcrypto-3.dll" contains export function called "AES_bi_ige_encrypt" at ordinal 20 "libcrypto-3.dll" contains export function called "AES_cbc_encrypt" at ordinal 21 "libcrypto-3.dll" contains export function called "AES_cfb128_encrypt" at ordinal 22 "libcrypto-3.dll" contains export function called "AES_cfb1_encrypt" at ordinal 23 "libcrypto-3.dll" contains export function called "AES_cfb8_encrypt" at ordinal 24 "libcrypto-3.dll" contains export function called "AES_decrypt" at ordinal 2545:T63d,"SOFTWARE\GoTo Resolve Customer Attended App" in Source: DamicoStockstillPolicy.exe "SOFTWARE\GoTo Resolve Unattended" in Source: DamicoStockstillPolicy.exe "SOFTWARE\GoTo Resolve Unattended\" in Source: DamicoStockstillPolicy.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended" in Source: DamicoStockstillPolicy.exe "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: DamicoStockstillPolicy.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: DamicoStockstillPolicy.exe "SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" in Source: DamicoStockstillPolicy.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: DamicoStockstillPolicy.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: DamicoStockstillPolicy.exe "SYSTEM\CurrentControlSet\Control\SafeBoot\Network" in Source: DamicoStockstillPolicy.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 24058-1026-00620AD0 "-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft" in Source: 00000000-00002896.00000000.128360.03140000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended 1600971844239445521" in Source: 00000000-00002896.00000001.129761.03229000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp46:T758,"DamicoStockstillPolicy.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" with parameter %LOCALAPPDATA%\GoTo Resolve Installer (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" with parameter %LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" with parameter x86 (UID: 00000000-00004960) "DamicoStockstillPolicy.exe" with parameter x64 (UID: 00000000-00004960) "GoToResolveTools64.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata (UID: 00000000-00008124) "GoToResolveTools64.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB (UID: 00000000-00008124) "GoToResolveTools64.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\reports (UID: 00000000-00008124) "GoToResolveTools64.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\attachments (UID: 00000000-00008124) "GoToResolveCrashHandler.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\reports (UID: 00000000-00007476) "GoToResolveCrashHandler.exe" with parameter %PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\attachments (UID: 00000000-00007476)47:Ta7c,Process DamicoStockstillPolicy.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4960:168:WilStaging_02" Process DamicoStockstillPolicy.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4960:64:WilError_03" Process DamicoStockstillPolicy.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4960:64:WilError_03" Process DamicoStockstillPolicy.exe created mutex with name "Local\SM0:4960:168:WilStaging_02" Process DamicoStockstillPolicy.exe created mutex with name "Local\SM0:4960:64:WilError_03" Process DamicoStockstillPolicy.exe created mutex with name "SM0:4960:64:WilError_03" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7224:64:WilError_03" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7224:168:WilStaging_02" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7224:64:WilError_03" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process GoToResolveUnattended.exe created mutex with name "Local\SM0:7224:168:WilStaging_02" Process GoToResolveUnattended.exe created mutex with name "Local\SM0:7224:64:WilError_03" Process GoToResolveUnattended.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process GoToResolveUnattended.exe created mutex with name "SM0:7224:64:WilError_03" Process GoToResolveUnattended.exe created mutex with name "DBWinMutex" Process GoToResolveUnattended.exe created mutex with name "Local\ZonesCacheCounterMutex" Process GoToResolveUnattended.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process GoToResolveUnattended.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process GoToResolveTools64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8124:120:WilError_03" Process GoToResolveTools64.exe created mutex with name "SM0:8124:120:WilError_03" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3824:168:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:3824:168:WilStaging_02" Process GoToResolveCrashHandler.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7476:168:WilStaging_02"48:Ta67,Antivirus vendors marked dropped file "libcrypto-3-x64.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"), Antivirus vendors marked dropped file "libcrypto-3.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"), Antivirus vendors marked dropped file "libssl-3-x64.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"), Antivirus vendors marked dropped file "GoToResolveTools64.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"), Antivirus vendors marked dropped file "PasswordPrivacyDll.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "libssl-3.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"), Antivirus vendors marked dropped file "GoToResolveTools32.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "GoToResolveUnlock64.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "GoToResolveCrashHandler.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "legacy.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"), Antivirus vendors marked dropped file "GoToResolveUnlock32.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "LMISupport7x64.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"), Antivirus vendors marked dropped file "GoToResolveUnattendedRemover.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "GoToResolveRemoteControl.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "GoToResolveLoggerProcess.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "GoToResolveProcessChecker.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "GoToResolveUnattendedUi.exe" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "DamicoStockstillPolicy.exe.cmd" as clean (type is "DOS batch file ASCII text with CRLF line terminators")49:Tf54,"DamicoStockstillPolicy.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "libcrypto-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3-x64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GoToResolveTools64.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "PasswordPrivacyDll.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "libssl-3.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GoToResolveTools32.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnlock64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "GoToResolveCrashHandler.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "legacy.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "GoToResolveUnlock32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "LMISupport7x64.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "GoToResolveUnattendedRemover.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveRemoteControl.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveLoggerProcess.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveProcessChecker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnattendedUi.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveUnattended.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveExternalModuleHandler.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveRegistryEditor.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveNetworkChecker.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "GoToResolveServiceManager.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE4a:T2687,"-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft" in Source: 00000000-00002896.00000000.128360.03140000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended 1600971844239445521" in Source: 00000000-00002896.00000001.129761.03229000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp "-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User " in Source: 00000000-00004388.00000000.129182.02B20000.00000004.mdmp "-1-5-18\Software\Microsoft\Wind" in Source: 00000000-00004388.00000000.129182.02B20000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00004388.00000001.129825.6F3D5000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00004388.00000001.129825.6F3D5000.00000004.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004960.00000000.126942.06040000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesc" in Source: 00000000-00004960.00000000.126942.06040000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00004960.00000000.126942.06040000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesy" in Source: 00000000-00004960.00000000.126942.06040000.00000004.mdmp "SOFTWARE\GoTo Resolve Customer Attended App" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SOFTWARE\GoTo Resolve Unattended" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SOFTWARE\GoTo Resolve Unattended\" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GoTo Resolve Unattended " in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SafeBoot\Network" in Source: 00000000-00004960.00000001.127235.00989000.00000002.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004960.00000001.127235.0604A000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007224.00000001.129146.03230000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007224.00000001.129146.03230000.00000004.mdmp "SOFTWARE\GoTo Resolve Unattended\1600971844239445521" in Source: 00000000-00007224.00000001.129146.05EF0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007224.00000001.129146.05EF0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\Instance" in Source: 00000000-00007224.00000001.129146.05EF0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007224.00000001.129146.05EF0000.00000004.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007224.00000001.129146.05EF0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007224.00000001.129146.05EF0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007224.00000001.129146.06320000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00007224.00000001.129146.06320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007224.00000001.129146.06320000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007224.00000001.129146.06320000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007224.00000001.129146.06320000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00007224.00000001.129146.6F3D5000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00007224.00000001.129146.6F3D5000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00007224.00000001.129146.7F480000.00000002.mdmp "YSTEM\Software\Microsoft\" in Source: 00000000-00007224.00000002.129777.02EFA000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007224.00000002.129777.03230000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007224.00000002.129777.03230000.00000004.mdmp "SOFTWARE\GoTo Resolve Unattended\1600971844239445521" in Source: 00000000-00007224.00000002.129777.05F5D000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007224.00000002.129777.05FC3000.00000004.mdmp "Registry\Machine\OSDATA\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007224.00000002.129777.05FC3000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007224.00000002.129777.05FC3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007224.00000002.129777.06320000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00007224.00000002.129777.06320000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007224.00000002.129777.06320000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007224.00000002.129777.06320000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00007224.00000002.129777.6F3D5000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00007224.00000002.129777.6F3D5000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007476.00000000.127481.00665000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00008124.00000000.127230.1FB70000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00008124.00000000.127230.21A6B000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00008124.00000000.127230.21A6B000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008124.00000001.127424.B7737000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00008124.00000001.127424.B7737000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\SystemInformation" in Source: 00000000-00008124.00000001.127424.B7737000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\OemInfo" in Source: 00000000-00008124.00000001.127424.B7737000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00008124.00000001.127424.B7737000.00000002.mdmp4b:T1f7d,"GET / HTTP/1.1 Host: ip.zscaler.com Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:31:36 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx X-Powered-By: PHP/8.0.30 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET OPTIONS HEAD Strict-Transport-Security: max-age=63072000; includeSubDomains X-Frame-Options: SAMEORIGIN Content-Encoding: gzip with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A3C686561643E0A093C6D65746120687474702D65717569763D22436F6E74656E742D54797065222063....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 1600971844239445521 X-Version: 1.27.1.3232 X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:31:35 GMT Content-Type: application/json Content-Length: 5299 Connection: keep-alive x-amzn-RequestId: d808b8de-68bf-41ba-8adf-ac42a2c6a10e Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: ZPBKRGa-oAMEbSQ= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-699c48a7-1e97e02153aaa4da11e989fd Access-Control-Allow-Credentials: true with response body ==>7B227368617265644365727469666963617465223A222D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D5C6E4D494944576A4343416B4B6741....... "GET /api/live HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:31:35 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: Kestrel with response body ==>7B2276657273696F6E223A22312E31222C22636F6E74656E74223A7B2268656164657273223A5B7B226B6579223A22436F6E74656E742D54797065222C227661....... "GET / HTTP/1.1 Host: devices-iot.console.gotoresolve.com Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 404 Not Found content-type: application/json content-length: 72 date: Mon 23 Feb 2026 12:31:35 GMT x-amzn-RequestId: cd2170a3-b102-084e-5b78-63df6a33ef53 connection: keep-alive x-amzn-ErrorType: ResourceNotFoundException: with response body ==>7B226D657373616765223A224E6F7420466F756E64222C2274726163654964223A2263643231373061332D623130322D303834652D356237382D363364663661....... "GET /api/health HTTP/1.1 Host: sessions.console.gotoresolve.com Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 1600971844239445521 X-Version: 1.27.1.3232 X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:31:45 GMT Content-Type: application/json Content-Length: 5299 Connection: keep-alive x-amzn-RequestId: 78de7a55-4f08-4114-856b-11fa69eef753 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: ZPBLwEIfoAMEhvA= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-699c48b1-08afb65f572914457c199eb3 Access-Control-Allow-Credentials: true with response body ==>7B227368617265644365727469666963617465223A222D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D5C6E4D494944576A4343416B4B6741....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 1600971844239445521 X-Version: 1.27.1.3232 X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:31:59 GMT Content-Type: application/json Content-Length: 5299 Connection: keep-alive x-amzn-RequestId: b7dbdc97-06dd-4baa-b856-d09492d4b875 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: ZPBN_Gd_oAMEAnA= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-699c48bf-64dcf3e82f94b8986a465d60 Access-Control-Allow-Credentials: true with response body ==>7B227368617265644365727469666963617465223A222D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D5C6E4D494944576A4343416B4B6741....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 1600971844239445521 X-Version: 1.27.1.3232 X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:32:09 GMT Content-Type: application/json Content-Length: 5299 Connection: keep-alive x-amzn-RequestId: 858b9c22-c8ba-4517-8778-f93162ec761a Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: ZPBPnFO2oAMEDXg= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-699c48c9-172bc0442ee348bc67f4f50f Access-Control-Allow-Credentials: true with response body ==>7B227368617265644365727469666963617465223A222D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D5C6E4D494944576A4343416B4B6741....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 1600971844239445521 X-Version: 1.27.1.3232 X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:32:36 GMT Content-Type: application/json Content-Length: 5299 Connection: keep-alive x-amzn-RequestId: 80eb1760-1949-48f4-a27a-281966ac79ad Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: ZPBTvFtsoAMEWjg= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-699c48e4-2d6de7fa0371679f7bfe212d Access-Control-Allow-Credentials: true with response body ==>7B227368617265644365727469666963617465223A222D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D5C6E4D494944576A4343416B4B6741....... "GET /properties HTTP/1.1 Host: devices.console.gotoresolve.com X-CompanyId: 1600971844239445521 X-Version: 1.27.1.3232 X-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 Content-Length: 0 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Date: Mon 23 Feb 2026 12:33:00 GMT Content-Type: application/json Content-Length: 5299 Connection: keep-alive x-amzn-RequestId: b9d64be5-4d90-4883-a058-760d843b538e Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin X-Requested-With X-CompanyId Content-Type Accept Authorization x-amz-apigw-id: ZPBXiGQzIAMEKDg= Access-Control-Allow-Methods: GET OPTIONS X-Amzn-Trace-Id: Root=1-699c48fc-5774078d333cdbb8742c0590 Access-Control-Allow-Credentials: true with response body ==>7B227368617265644365727469666963617465223A222D2D2D2D2D424547494E2043455254494649434154452D2D2D2D2D5C6E4D494944576A4343416B4B6741.......4c:T6183,"DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "KERNEL32" at base 752f0000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738f0000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "KERNEL32.DLL" at base 752f0000 "DamicoStockstillPolicy.exe" loaded module "SHELL32.DLL" at base 766a0000 "DamicoStockstillPolicy.exe" loaded module "RPCRT4.DLL" at base 75d40000 "DamicoStockstillPolicy.exe" loaded module "NTDLL.DLL" at base 77260000 "DamicoStockstillPolicy.exe" loaded module "KERNELBASE" at base 75e70000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74690000 "DamicoStockstillPolicy.exe" loaded module "COMCTL32.DLL" at base 74ce0000 "DamicoStockstillPolicy.exe" loaded module "USER32.DLL" at base 75630000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73860000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74760000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 73c20000 "DamicoStockstillPolicy.exe" loaded module "ATLTHUNK.DLL" at base 72f40000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76d40000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76110000 "DamicoStockstillPolicy.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75630000 "DamicoStockstillPolicy.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75630000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76330000 "DamicoStockstillPolicy.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76e20000 "DamicoStockstillPolicy.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74740000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e70000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e70000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e70000 "GoToResolveUnattended.exe" loaded module "KERNEL32" at base 752f0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738f0000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75e70000 "GoToResolveUnattended.exe" loaded module "ADVAPI32.DLL" at base 76330000 "GoToResolveUnattended.exe" loaded module "AVRT.DLL" at base 72f50000 "GoToResolveUnattended.exe" loaded module "BCRYPT.DLL" at base 739f0000 "GoToResolveUnattended.exe" loaded module "CRYPT32.DLL" at base 76fd0000 "GoToResolveUnattended.exe" loaded module "D2D1.DLL" at base 728b0000 "GoToResolveUnattended.exe" loaded module "GDI32.DLL" at base 76260000 "GoToResolveUnattended.exe" loaded module "D3D11.DLL" at base 72670000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 752f0000 "GoToResolveUnattended.exe" loaded module "KERNEL32.DLL" at base 752f0000 "GoToResolveUnattended.exe" loaded module "DBGHELP.DLL" at base 723c0000 "GoToResolveUnattended.exe" loaded module "DWMAPI.DLL" at base 72390000 "GoToResolveUnattended.exe" loaded module "DWRITE.DLL" at base 72170000 "GoToResolveUnattended.exe" loaded module "DXGI.DLL" at base 725a0000 "GoToResolveUnattended.exe" loaded module "GDIPLUS.DLL" at base 74270000 "GoToResolveUnattended.exe" loaded module "IMM32.DLL" at base 76d10000 "GoToResolveUnattended.exe" loaded module "IPHLPAPI.DLL" at base 74800000 "GoToResolveUnattended.exe" loaded module "MPR.DLL" at base 74cc0000 "GoToResolveUnattended.exe" loaded module "MSDMO.DLL" at base 72160000 "GoToResolveUnattended.exe" loaded module "MSI.DLL" at base 71ea0000 "GoToResolveUnattended.exe" loaded module "MSIMG32.DLL" at base 71e90000 "GoToResolveUnattended.exe" loaded module "NETAPI32.DLL" at base 71e70000 "GoToResolveUnattended.exe" loaded module "NTDLL.DLL" at base 77260000 "GoToResolveUnattended.exe" loaded module "OLE32.DLL" at base 76e20000 "GoToResolveUnattended.exe" loaded module "OLEAUT32.DLL" at base 76290000 "GoToResolveUnattended.exe" loaded module "PDH.DLL" at base 74610000 "GoToResolveUnattended.exe" loaded module "POWRPROF.DLL" at base 71e00000 "GoToResolveUnattended.exe" loaded module "PSAPI.DLL" at base 753e0000 "GoToResolveUnattended.exe" loaded module "RPCRT4.DLL" at base 75d40000 "GoToResolveUnattended.exe" loaded module "RSTRTMGR.DLL" at base 73ab0000 "GoToResolveUnattended.exe" loaded module "SAS.DLL" at base 71a80000 "GoToResolveUnattended.exe" loaded module "SECUR32.DLL" at base 71a70000 "GoToResolveUnattended.exe" loaded module "SETUPAPI.DLL" at base 75900000 "GoToResolveUnattended.exe" loaded module "SHELL32.DLL" at base 766a0000 "GoToResolveUnattended.exe" loaded module "SHLWAPI.DLL" at base 76650000 "GoToResolveUnattended.exe" loaded module "SLWGA.DLL" at base 738d0000 "GoToResolveUnattended.exe" loaded module "USER32.DLL" at base 75630000 "GoToResolveUnattended.exe" loaded module "USERENV.DLL" at base 747e0000 "GoToResolveUnattended.exe" loaded module "UXTHEME.DLL" at base 74760000 "GoToResolveUnattended.exe" loaded module "VERSION.DLL" at base 74f50000 "GoToResolveUnattended.exe" loaded module "WINHTTP.DLL" at base 73620000 "GoToResolveUnattended.exe" loaded module "WINMM.DLL" at base 74f10000 "GoToResolveUnattended.exe" loaded module "WS2_32.DLL" at base 75570000 "GoToResolveUnattended.exe" loaded module "WTSAPI32.DLL" at base 743e0000 "GoToResolveUnattended.exe" loaded module "WINTRUST.DLL" at base 75190000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73880000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76fd0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75e00000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 735c0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 735c0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73590000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73af0000 "GoToResolveUnattended.exe" loaded module "SSPICLI.DLL" at base 73c50000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73500000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 734a0000 "GoToResolveUnattended.exe" loaded module "CRYPTNET.DLL" at base 735c0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73480000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 752f0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\PSAPI.DLL" at base 753e0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76650000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76330000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 723c0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 743e0000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\PASSWORDPRIVACYDLL.DLL" at base 73370000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75e70000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75e70000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75e70000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\MEDIACLIENTLIB.DLL" at base 70ad0000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\FILEMANAGER.DLL" at base 6fa70000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75e70000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\LIBCRYPTO-3.DLL" at base 6f630000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\LIBSSL-3.DLL" at base 73250000 "GoToResolveUnattended.exe" loaded module "WSOCK32.DLL" at base 74f60000 "GoToResolveUnattended.exe" loaded module "SHCORE.DLL" at base 761a0000 "GoToResolveUnattended.exe" loaded module "SNMPAPI.DLL" at base 731b0000 "GoToResolveUnattended.exe" loaded module "INETMIB1.DLL" at base 731a0000 "GoToResolveUnattended.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\LIBGOTORESOLVE.DLL" at base 6e280000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74760000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74740000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76330000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 73180000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73160000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 73150000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 73130000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 73110000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766a0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d10000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72f70000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74040000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75e70000 "GoToResolveUnattended.exe" loaded module "VIRTDISK.DLL" at base 74530000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 6dbb0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 72ff0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 72ff0000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 72e80000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 71b70000 "GoToResolveUnattended.exe" loaded module "KERNELBASE" at base 75e70000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74690000 "GoToResolveUnattended.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 72f60000 "GoToResolveUnattended.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 75e70000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "KERNEL32" at base 7ff9a0c80000 "GoToResolveTools64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff98fb10000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff99c7c0000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff99e1e0000 "GoToResolveTools64.exe" loaded module "RPCRT4.DLL" at base 7ff9a1810000 "GoToResolveTools64.exe" loaded module "KERNEL32.DLL" at base 7ff9a0c80000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ff993d00000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ff993ce0000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff99e650000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ff98faf0000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ff986b70000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ff98fac0000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 7ff99e200000 "GoToResolveTools64.exe" loaded module "NTMARTA.DLL" at base 7ff99e200000 "GoToResolveTools64.exe" loaded module "NTDLL.DLL" at base 7ff9a1d70000 "GoToResolveTools64.exe" loaded module "KERNELBASE" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff99c620000 "GoToResolveTools64.exe" loaded module "USER32.DLL" at base 7ff9a06b0000 "GoToResolveTools64.exe" loaded module "DEVOBJ.DLL" at base 7ff99ed60000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "WINTRUST.DLL" at base 7ff99f2e0000 "GoToResolveTools64.exe" loaded module "DEVRTL.DLL" at base 7ff9964e0000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-FILE-L1-1-0.DLL" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-CORE-STRING-L2-1-0.DLL" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "DRVSTORE.DLL" at base 7ff9969c0000 "GoToResolveTools64.exe" loaded module "SPINF.DLL" at base 7ff999120000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff99f350000 "GoToResolveTools64.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ff9a0b40000 "GoToResolveTools64.exe" loaded module "CABINET.DLL" at base 7ff997b10000 "GoToResolveTools64.exe" loaded module "CFGMGR32.DLL" at base 7ff99ed90000 "GoToResolveTools64.exe" loaded module "SETUPAPI.DLL" at base 7ff99fdf0000 "cmd.exe" loaded module "KERNEL32" at base 752f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75e70000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75e70000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75e70000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76d10000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e70000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e70000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e70000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738f0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 752f0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77260000 "cmd.exe" loaded module "KERNELBASE" at base 75e70000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74740000 "GoToResolveCrashHandler.exe" loaded module "KERNEL32" at base 752f0000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76d10000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738f0000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75e70000 "GoToResolveCrashHandler.exe" loaded module "ADVAPI32.DLL" at base 76330000 "GoToResolveCrashHandler.exe" loaded module "USER32.DLL" at base 75630000 "GoToResolveCrashHandler.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74760000 "GoToResolveCrashHandler.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74740000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "KERNEL32" at base 752f0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738f0000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "ADVAPI32.DLL" at base 76330000 "GoToResolveProcessChecker.exe" loaded module "AVRT.DLL" at base 72f50000 "GoToResolveProcessChecker.exe" loaded module "BCRYPT.DLL" at base 739f0000 "GoToResolveProcessChecker.exe" loaded module "CRYPT32.DLL" at base 76fd0000 "GoToResolveProcessChecker.exe" loaded module "D2D1.DLL" at base 728b0000 "GoToResolveProcessChecker.exe" loaded module "GDI32.DLL" at base 76260000 "GoToResolveProcessChecker.exe" loaded module "D3D11.DLL" at base 72670000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 752f0000 "GoToResolveProcessChecker.exe" loaded module "KERNEL32.DLL" at base 752f0000 "GoToResolveProcessChecker.exe" loaded module "DBGHELP.DLL" at base 723c0000 "GoToResolveProcessChecker.exe" loaded module "DWMAPI.DLL" at base 72390000 "GoToResolveProcessChecker.exe" loaded module "DWRITE.DLL" at base 72170000 "GoToResolveProcessChecker.exe" loaded module "DXGI.DLL" at base 725a0000 "GoToResolveProcessChecker.exe" loaded module "GDIPLUS.DLL" at base 74270000 "GoToResolveProcessChecker.exe" loaded module "IMM32.DLL" at base 76d10000 "GoToResolveProcessChecker.exe" loaded module "IPHLPAPI.DLL" at base 74800000 "GoToResolveProcessChecker.exe" loaded module "MPR.DLL" at base 74cc0000 "GoToResolveProcessChecker.exe" loaded module "MSDMO.DLL" at base 72160000 "GoToResolveProcessChecker.exe" loaded module "MSI.DLL" at base 71ea0000 "GoToResolveProcessChecker.exe" loaded module "MSIMG32.DLL" at base 71e90000 "GoToResolveProcessChecker.exe" loaded module "NETAPI32.DLL" at base 71e70000 "GoToResolveProcessChecker.exe" loaded module "NTDLL.DLL" at base 77260000 "GoToResolveProcessChecker.exe" loaded module "OLE32.DLL" at base 76e20000 "GoToResolveProcessChecker.exe" loaded module "OLEAUT32.DLL" at base 76290000 "GoToResolveProcessChecker.exe" loaded module "PDH.DLL" at base 74610000 "GoToResolveProcessChecker.exe" loaded module "POWRPROF.DLL" at base 71e00000 "GoToResolveProcessChecker.exe" loaded module "PSAPI.DLL" at base 753e0000 "GoToResolveProcessChecker.exe" loaded module "RPCRT4.DLL" at base 75d40000 "GoToResolveProcessChecker.exe" loaded module "RSTRTMGR.DLL" at base 73ab0000 "GoToResolveProcessChecker.exe" loaded module "SAS.DLL" at base 71a80000 "GoToResolveProcessChecker.exe" loaded module "SECUR32.DLL" at base 71a70000 "GoToResolveProcessChecker.exe" loaded module "SETUPAPI.DLL" at base 75900000 "GoToResolveProcessChecker.exe" loaded module "SHELL32.DLL" at base 766a0000 "GoToResolveProcessChecker.exe" loaded module "SHLWAPI.DLL" at base 76650000 "GoToResolveProcessChecker.exe" loaded module "SLWGA.DLL" at base 738d0000 "GoToResolveProcessChecker.exe" loaded module "USER32.DLL" at base 75630000 "GoToResolveProcessChecker.exe" loaded module "USERENV.DLL" at base 747e0000 "GoToResolveProcessChecker.exe" loaded module "UXTHEME.DLL" at base 74760000 "GoToResolveProcessChecker.exe" loaded module "VERSION.DLL" at base 74f50000 "GoToResolveProcessChecker.exe" loaded module "WINHTTP.DLL" at base 73620000 "GoToResolveProcessChecker.exe" loaded module "WINMM.DLL" at base 74f10000 "GoToResolveProcessChecker.exe" loaded module "WS2_32.DLL" at base 75570000 "GoToResolveProcessChecker.exe" loaded module "WTSAPI32.DLL" at base 743e0000 "GoToResolveProcessChecker.exe" loaded module "WINTRUST.DLL" at base 75190000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73880000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76fd0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75e00000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 735c0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 735c0000 "GoToResolveProcessChecker.exe" loaded module "CRYPTNET.DLL" at base 735c0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 752f0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\PSAPI.DLL" at base 753e0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76650000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76330000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 723c0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\WTSAPI32.DLL" at base 743e0000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\PASSWORDPRIVACYDLL.DLL" at base 73370000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\MEDIACLIENTLIB.DLL" at base 70ad0000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\FILEMANAGER.DLL" at base 6fa70000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75e70000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\LIBCRYPTO-3.DLL" at base 6f630000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\LIBSSL-3.DLL" at base 73250000 "GoToResolveProcessChecker.exe" loaded module "WSOCK32.DLL" at base 74f60000 "GoToResolveProcessChecker.exe" loaded module "SHCORE.DLL" at base 761a0000 "GoToResolveProcessChecker.exe" loaded module "SNMPAPI.DLL" at base 731b0000 "GoToResolveProcessChecker.exe" loaded module "INETMIB1.DLL" at base 731a0000 "GoToResolveProcessChecker.exe" loaded module "%PROGRAMFILES%\(X86)\GOTO RESOLVE UNATTENDED\1600971844239445521\LIBGOTORESOLVE.DLL" at base 6e280000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74760000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74740000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76d10000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72df0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73af0000 "GoToResolveProcessChecker.exe" loaded module "SSPICLI.DLL" at base 73c50000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73500000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 734a0000 "GoToResolveProcessChecker.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76330000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766a0000 "GoToResolveProcessChecker.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73c80000 "GoToResolveProcessChecker.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 752f00004d:T1706,"DamicoStockstillPolicy.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DamicoStockstillPolicy.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DamicoStockstillPolicy.exe" was detected as "Microsoft Linker" and name: "Linker" "libcrypto-3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libcrypto-3.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3-x64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libssl-3-x64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3-x64.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveTools64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools64.exe" was detected as "Microsoft Linker" and name: "Linker" "PasswordPrivacyDll.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "PasswordPrivacyDll.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "PasswordPrivacyDll.dll" was detected as "Microsoft Linker" and name: "Linker" "libssl-3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "libssl-3.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveTools32.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools32.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveTools32.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnlock64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock64.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveCrashHandler.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveCrashHandler.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveCrashHandler.exe" was detected as "Microsoft Linker" and name: "Linker" "legacy.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "legacy.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "legacy.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnlock32.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnlock32.dll" was detected as "Microsoft Linker" and name: "Linker" "LMISupport7x64.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "LMISupport7x64.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "LMISupport7x64.dll" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnattendedRemover.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedRemover.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedRemover.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveRemoteControl.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRemoteControl.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRemoteControl.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveLoggerProcess.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveLoggerProcess.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveLoggerProcess.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveProcessChecker.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveProcessChecker.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveProcessChecker.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnattendedUi.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedUi.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattendedUi.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveUnattended.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattended.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveUnattended.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveExternalModuleHandler.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveExternalModuleHandler.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveExternalModuleHandler.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveRegistryEditor.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRegistryEditor.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveRegistryEditor.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveNetworkChecker.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveNetworkChecker.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveNetworkChecker.exe" was detected as "Microsoft Linker" and name: "Linker" "GoToResolveServiceManager.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "GoToResolveServiceManager.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "GoToResolveServiceManager.exe" was detected as "Microsoft Linker" and name: "Linker"4e:T51d,"GoToResolveUnattended.exe" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "GoToResolveUnattended.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "GoToResolveUnattended.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "GoToResolveUnattended.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "GoToResolveUnattended.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "GoToResolveUnattended.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "GoToResolveUnattended.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "GoToResolveUnattended.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "GoToResolveProcessChecker.exe" touched "TaskScheduler class" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")4f:T720,"DamicoStockstillPolicy.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3-x64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveTools64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "PasswordPrivacyDll.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libssl-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveTools32.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnlock64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveCrashHandler.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "legacy.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnlock32.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "LMISupport7x64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnattendedRemover.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveRemoteControl.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveLoggerProcess.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveProcessChecker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnattendedUi.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveUnattended.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveExternalModuleHandler.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveRegistryEditor.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveNetworkChecker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "GoToResolveServiceManager.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"50:T618,"DamicoStockstillPolicy.exe" has an executable section named ".text" "libcrypto-3.dll" has an executable section named ".text" "libssl-3-x64.dll" has an executable section named ".text" "GoToResolveTools64.exe" has an executable section named ".text" "PasswordPrivacyDll.dll" has an executable section named ".text" "PasswordPrivacyDll.dll" has an executable section named ".orpc" "libssl-3.dll" has an executable section named ".text" "GoToResolveTools32.exe" has an executable section named ".text" "GoToResolveUnlock64.dll" has an executable section named ".text" "GoToResolveCrashHandler.exe" has an executable section named ".text" "legacy.dll" has an executable section named ".text" "GoToResolveUnlock32.dll" has an executable section named ".text" "LMISupport7x64.dll" has an executable section named ".text" "GoToResolveUnattendedRemover.exe" has an executable section named ".text" "GoToResolveRemoteControl.exe" has an executable section named ".text" "GoToResolveLoggerProcess.exe" has an executable section named ".text" "GoToResolveProcessChecker.exe" has an executable section named ".text" "GoToResolveUnattendedUi.exe" has an executable section named ".text" "GoToResolveUnattended.exe" has an executable section named ".text" "GoToResolveExternalModuleHandler.exe" has an executable section named ".text" "GoToResolveRegistryEditor.exe" has an executable section named ".text" "GoToResolveNetworkChecker.exe" has an executable section named ".text" "GoToResolveServiceManager.exe" has an executable section named ".text"51:T626,"DamicoStockstillPolicy.exe" has an writable section named ".data" "DamicoStockstillPolicy.exe" has an writable section named "CPADinfo" "libcrypto-3.dll" has an writable section named ".data" "libcrypto-3.dll" has an writable section named ".fptable" "libssl-3-x64.dll" has an writable section named ".data" "libssl-3-x64.dll" has an writable section named ".fptable" "libssl-3-x64.dll" has an writable section named "_guard_c" "libssl-3-x64.dll" has an writable section named "_guard_d" "GoToResolveTools64.exe" has an writable section named ".data" "PasswordPrivacyDll.dll" has an writable section named ".data" "PasswordPrivacyDll.dll" has an writable section named ".tls" "libssl-3.dll" has an writable section named ".data" "libssl-3.dll" has an writable section named ".fptable" "GoToResolveTools32.exe" has an writable section named ".data" "GoToResolveUnlock64.dll" has an writable section named ".data" "GoToResolveCrashHandler.exe" has an writable section named ".data" "GoToResolveCrashHandler.exe" has an writable section named "CPADinfo" "GoToResolveCrashHandler.exe" has an writable section named ".fptable" "legacy.dll" has an writable section named ".data" "legacy.dll" has an writable section named ".fptable" "GoToResolveUnlock32.dll" has an writable section named ".data" "LMISupport7x64.dll" has an writable section named ".data" "LMISupport7x64.dll" has an writable section named ".tls" "GoToResolveUnattendedRemover.exe" has an writable section named ".data" "GoToResolveRemoteControl.exe" has an writable section named ".data"52:T2db9,"DamicoStockstillPolicy.exe" file has an entrypoint instructions - "call 0x4dd899,jmp 0x4dc8b2,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push -1,push 0x517ccc,mov eax, dword ptr fs:[0],push eax,push ecx,push ebx,push esi,push edi,mov eax, dword ptr [0x55d440],xor eax, ebp,push eax,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,mov dword ptr [ebp - 0x10], esp,push dword ptr [ebp + 8],and dword ptr [ebp - 4], 0,call 0x4dc767,pop ecx,jmp 0x4dca80,mov eax, 0x4dca7e,ret ,xor eax, eax,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop esi,pop ebx,leave ,ret ,int3 ,int3 ,int3 ,int3 ," "libcrypto-3.dll" file has an entrypoint instructions - "jmp 0x102af2fe,jmp 0x102bb838,jmp 0x1021d800,jmp 0x101b5fa0,jmp 0x100b1b50,jmp 0x10095240,jmp 0x102ffbee,jmp 0x102adb30,jmp 0x10127ef0,jmp 0x101e6a40,jmp 0x10249fa0,jmp 0x1013d4a0,jmp 0x100efe20,jmp 0x1031f746,jmp 0x102cd7a3,jmp 0x10100130,jmp 0x1009cd80,jmp 0x1016a800,jmp 0x10102a20,jmp 0x101cd000," "libssl-3-x64.dll" file has an entrypoint instructions - "jmp 0x1800847b8,jmp 0x1800e66f8,jmp 0x180024970,jmp 0x18002a4c0,jmp 0x1800c93b8,jmp 0x1800bbb5c,jmp 0x18000fad0,jmp 0x1800a1138,jmp 0x180091ea4,jmp 0x1800a8504,jmp 0x1800a629c,jmp 0x1800a85e8,jmp 0x18006b990,jmp 0x1800cced4,jmp 0x180035f80,jmp 0x180085190,jmp 0x180091ed0,jmp 0x18007acf0,jmp 0x180018780,jmp 0x1800d7c94," "GoToResolveTools64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400bab60,add rsp, 0x28,jmp 0x1400b9cac,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov edx, 0xfa0,lea rcx, [rip + 0x826de],call qword ptr [rip + 0x3d5f8],lea rcx, [rip + 0x45649],call qword ptr [rip + 0x3d323],mov rbx, rax,test rax, rax,jne 0x1400b9e7a,lea rcx, [rip + 0x3f75c],call qword ptr [rip + 0x3d30e],mov rbx, rax,test rax, rax,je 0x1400b9ef9,lea rdx, [rip + 0x45667],mov rcx, rbx," "PasswordPrivacyDll.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100a2e43,call 0x100ad7d1,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100a2e58,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x1010b140,call 0x100a58f0,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x100a2e7a,cmp dword ptr [0x101122bc], esi,je 0x100a2f5e,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x100a2e88,cmp esi, 2,jne 0x100a2ebd,mov ecx, dword ptr [0x10109860],test ecx, ecx,je 0x100a2e9e,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "libssl-3.dll" file has an entrypoint instructions - "jmp 0x10072f1c,jmp 0x1007ec68,jmp 0x100a9d23,jmp 0x10049650,jmp 0x10023ec0,jmp 0x10053c50,jmp 0x10057c20,jmp 0x100c7300,jmp 0x10092b0d,jmp 0x1002b8b0,jmp 0x10024050,jmp 0x1008c636,jmp 0x100a9098,jmp 0x100a4bc6,jmp 0x10073028,jmp 0x100d1fc0,jmp 0x10088af7,jmp 0x100a5826,jmp 0x100aff48,jmp 0x1003eac0," "GoToResolveTools32.exe" file has an entrypoint instructions - "call 0x49ce49,jmp 0x49bcf4,jmp 0x49bbf9,call 0x49bea6,push 0,call 0x49c137,pop ecx,test al, al,je 0x49be9e,push 0x49bf28,call 0x49c2c4,pop ecx,xor eax, eax,ret ,push 7,call 0x49cf00,int3 ,push esi,push edi,push 0xfa0,push 0x504b7c,call dword ptr [0x4d3224],push 0x4d9818,call dword ptr [0x4d30c0],mov esi, eax,test esi, esi,jne 0x49beda,push 0x4d482c,call dword ptr [0x4d30c0]," "GoToResolveUnlock64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180055141,call 0x180055aa8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180054fec,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x180055180,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx," "GoToResolveCrashHandler.exe" file has an entrypoint instructions - "call 0x443c9b,jmp 0x442e6f,call 0x44301c,push 0,call 0x443809,pop ecx,test al, al,je 0x443014,push 0x44309e,call 0x443996,pop ecx,xor eax, eax,ret ,push 7,call 0x443d55,int3 ,push esi,push edi,push 0xfa0,push 0x49b27c,call dword ptr [0x475038],push 0x4831a8,call dword ptr [0x475000],mov esi, eax,test esi, esi,jne 0x443050,push 0x4752fc,call dword ptr [0x475000],mov esi, eax,test esi, esi," "legacy.dll" file has an entrypoint instructions - "jmp 0x1001728d,jmp 0x100229a8,jmp 0x10026275,jmp 0x10016a40,jmp 0x10066205,jmp 0x100339ec,jmp 0x1002d515,jmp 0x100255ea,jmp 0x1004613a,jmp 0x100173b0,jmp 0x1006fb70,jmp 0x10029995,jmp 0x10046e72,jmp 0x10058173,jmp 0x1004bbb4,jmp 0x10030b77,jmp 0x10057b13,jmp 0x100231d8,jmp 0x10034c4d,jmp 0x1004193c," "GoToResolveUnlock32.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003de5e,call 0x1003e83a,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003dd1a,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x1003de99,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10," "LMISupport7x64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013db1,call 0x180014464,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180013c40,int3 ,int3 ,int3 ,and dword ptr [rip + 0x54555], 0,ret ,mov qword ptr [rsp + 8], rbx,push rbp,lea rbp, [rsp - 0x4c0],sub rsp, 0x5c0,mov ebx, ecx,mov ecx, 0x17," "GoToResolveUnattendedRemover.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveRemoteControl.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveLoggerProcess.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveProcessChecker.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveUnattendedUi.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveUnattended.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveExternalModuleHandler.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveRegistryEditor.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveNetworkChecker.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc," "GoToResolveServiceManager.exe" file has an entrypoint instructions - "call 0x408bee,jmp 0x408562,push ebp,mov ebp, esp,jmp 0x4086fc,push dword ptr [ebp + 8],call 0x42901d,pop ecx,test eax, eax,je 0x40870b,push dword ptr [ebp + 8],call 0x426b5f,pop ecx,test eax, eax,je 0x4086ef,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x401220,jmp 0x408f6d,jmp 0x426b44,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40871a,pop ecx,pop ebp,ret ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x443b58,je 0x40874c,push 0xc,"53:T139a,Process "GoToResolveUnattended.exe" (UID: 00000000-00007224) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveUnattended.exe" (UID: 00000000-00007224) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "timeout.exe" (UID: 00000000-00006312) was launched with new environment variables: "PROMPT="$P$G", self="C:\DamicoStockstillPolicy.exe.cmd"" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00007476) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00007476) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432, self" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00002896) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00002896) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00004388) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "GoToResolveProcessChecker.exe" (UID: 00000000-00004388) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00001084) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00001084) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "GoToResolveUnattended.exe" (UID: 00000000-00007876) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, Path" Process "GoToResolveUnattended.exe" (UID: 00000000-00007876) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "GoToResolveLoggerProcess.exe" (UID: 00000000-00007776) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveLoggerProcess.exe" (UID: 00000000-00007776) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE" Process "GoToResolveUnattendedUi.exe" (UID: 00000000-00003884) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\H5pMRGV", HOMEDRIVE="C:"" Process "GoToResolveUnattendedUi.exe" (UID: 00000000-00003884) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "GoToResolveUnattendedUi.exe" (UID: 00000000-00003884) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00006464) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00006464) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00006464) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00003708) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\H5pMRGV", HOMEDRIVE="C:"" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00003708) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00007920) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "GoToResolveCrashHandler.exe" (UID: 00000000-00007920) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE" Process "sc.exe" (UID: 00000000-00004044) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", PROMPT="$P$G", EFC_5628="1", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\H5pMRGV", HOMEDRIVE="C:"" Process "sc.exe" (UID: 00000000-00004044) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP"54:T7df,"DamicoStockstillPolicy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "DamicoStockstillPolicy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DamicoStockstillPolicy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DamicoStockstillPolicy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "DamicoStockstillPolicy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "GoToResolveUnattended.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "GoToResolveUnattended.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "GoToResolveUnattended.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "GoToResolveCrashHandler.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "GoToResolveCrashHandler.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "GoToResolveCrashHandler.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")55:T402,Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007224-00000C2B-931671843] Observed system executable string:"%WINDIR%\system32\PSAPI.DLL" [Source: 00000000-00007224-00000C2B-931727496] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00007224-00000C2B-931777540] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00007224-00000C2B-931964603] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00007224-00000C2B-932065542] Observed system executable string:"%WINDIR%\system32\dbghelp.dll" [Source: 00000000-00007224-00000C2B-932169348] Observed system executable string:"%WINDIR%\system32\wtsapi32.dll" [Source: 00000000-00007224-00000C2B-932219272] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00007224-00000C2B-939338006] Observed system executable string:"%WINDIR%\system32\ntmarta.dll" [Source: 00000000-00008124-00000C2B-926385249]56:Te14,Spawned process "GoToResolveUnattended.exe" with commandline "-regsvc" (UID: 00000000-00007224) Spawned process "GoToResolveTools64.exe" with commandline "-InstallVDD" (UID: 00000000-00008124) Spawned process "cmd.exe" with commandline "/S /C ""C:\\DamicoStockstillPolicy.exe.cmd" "C:\\DamicoStockstil ..." (UID: 00000000-00003824) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006312) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600 ..." (UID: 00000000-00007476), Spawned process "GoToResolveProcessChecker.exe" with commandline "-regsvc -expectadmin -starterpid 7224 -InstallationId H6l9SRwVhM ..." (UID: 00000000-00002896), Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unatte ..." (UID: 00000000-00004388) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4388 -ip 4388" (UID: 00000000-00006736) Spawned process "WerFault.exe" with commandline "-u -p 4388 -s 2088" (UID: 00000000-00008284) Spawned process "WerFault.exe" with commandline "-u -p 4388 -s 2088" (UID: 00000000-00006240) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unatte ..." (UID: 00000000-00006276), Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600 ..." (UID: 00000000-00001084) Spawned process "GoToResolveUnattended.exe" with commandline ""-RegisteredProcess" "1" "-ParentProcessId" "6276" "-Installatio ..." (UID: 00000000-00007876), Spawned process "GoToResolveLoggerProcess.exe" with commandline "-ParentProcessId 7876 -CompanyId 1600971844239445521 -Installati ..." (UID: 00000000-00007776), Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveUnattended.log=%PROGRAMFILES ..." (UID: 00000000-00004296) Spawned process "GoToResolveExternalModuleHandler.exe" with commandline "-InstallationId H6l9SRwVhM -CompanyId 1600971844239445521 -publi ..." (UID: 00000000-00008624) Spawned process "GoToResolveFileManager.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00003268) Spawned process "GoToResolveQuickView.exe" with commandline "-InstallationId H6l9SRwVhM -LogLevel 2 -Environment Production" (UID: 00000000-00007756) Spawned process "GoToResolveTerminal.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00008956) Spawned process "GoToResolveServiceManager.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00002548) Spawned process "GoToResolveRemoteControl.exe" with commandline "-CompanyId 1600971844239445521 -InstallationId H6l9SRwVhM -WorkF ..." (UID: 00000000-00002608) Spawned process "GoToResolveRegistryEditor.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00007952) Spawned process "GoToResolveNetworkChecker.exe" with commandline "-BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBa ..." (UID: 00000000-00003704) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveLoggerProcess.log=%PROGRAMFI ..." (UID: 00000000-00004724), Spawned process "GoToResolveUnattendedUi.exe" with commandline ""-CompanyId" "1600971844239445521" "-InstallationId" "H6l9SRwVhM ..." (UID: 00000000-00003884)57:Te14,Spawned process "GoToResolveUnattended.exe" with commandline "-regsvc" (UID: 00000000-00007224) Spawned process "GoToResolveTools64.exe" with commandline "-InstallVDD" (UID: 00000000-00008124) Spawned process "cmd.exe" with commandline "/S /C ""C:\\DamicoStockstillPolicy.exe.cmd" "C:\\DamicoStockstil ..." (UID: 00000000-00003824) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006312) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600 ..." (UID: 00000000-00007476), Spawned process "GoToResolveProcessChecker.exe" with commandline "-regsvc -expectadmin -starterpid 7224 -InstallationId H6l9SRwVhM ..." (UID: 00000000-00002896), Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unatte ..." (UID: 00000000-00004388) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4388 -ip 4388" (UID: 00000000-00006736) Spawned process "WerFault.exe" with commandline "-u -p 4388 -s 2088" (UID: 00000000-00008284) Spawned process "WerFault.exe" with commandline "-u -p 4388 -s 2088" (UID: 00000000-00006240) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unatte ..." (UID: 00000000-00006276), Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600 ..." (UID: 00000000-00001084) Spawned process "GoToResolveUnattended.exe" with commandline ""-RegisteredProcess" "1" "-ParentProcessId" "6276" "-Installatio ..." (UID: 00000000-00007876), Spawned process "GoToResolveLoggerProcess.exe" with commandline "-ParentProcessId 7876 -CompanyId 1600971844239445521 -Installati ..." (UID: 00000000-00007776), Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveUnattended.log=%PROGRAMFILES ..." (UID: 00000000-00004296) Spawned process "GoToResolveExternalModuleHandler.exe" with commandline "-InstallationId H6l9SRwVhM -CompanyId 1600971844239445521 -publi ..." (UID: 00000000-00008624) Spawned process "GoToResolveFileManager.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00003268) Spawned process "GoToResolveQuickView.exe" with commandline "-InstallationId H6l9SRwVhM -LogLevel 2 -Environment Production" (UID: 00000000-00007756) Spawned process "GoToResolveTerminal.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00008956) Spawned process "GoToResolveServiceManager.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00002548) Spawned process "GoToResolveRemoteControl.exe" with commandline "-CompanyId 1600971844239445521 -InstallationId H6l9SRwVhM -WorkF ..." (UID: 00000000-00002608) Spawned process "GoToResolveRegistryEditor.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -Installa ..." (UID: 00000000-00007952) Spawned process "GoToResolveNetworkChecker.exe" with commandline "-BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBa ..." (UID: 00000000-00003704) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveLoggerProcess.log=%PROGRAMFI ..." (UID: 00000000-00004724), Spawned process "GoToResolveUnattendedUi.exe" with commandline ""-CompanyId" "1600971844239445521" "-InstallationId" "H6l9SRwVhM ..." (UID: 00000000-00003884)58:T48b,The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 6D:C2:5E:62:60:6D:15:24:7E:1D:6E:B1:C7:A4:0E:C9:8A:03:FC:10; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 8D:3F:A6:EE:EB:FC:68:A0:FA:76:CD:C4:C6:AD:59:82:FE:07:DE:91; see report for more information)59:T687,"DamicoStockstillPolicy.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libcrypto-3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PasswordPrivacyDll.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "libssl-3.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveTools32.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveCrashHandler.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "legacy.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnlock32.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnattendedRemover.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveRemoteControl.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveLoggerProcess.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveProcessChecker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnattendedUi.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveUnattended.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveExternalModuleHandler.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveRegistryEditor.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveNetworkChecker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "GoToResolveServiceManager.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE5a:T3617,"libcrypto-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3-x64.dll]- [targetUID: 00000000-00004960] "FileManager.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll]- [targetUID: 00000000-00002896] "LibGoToResolve.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll]- [targetUID: 00000000-00002896] "MediaClientLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll]- [targetUID: 00000000-00002896] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll]- [targetUID: 00000000-00002896] "libssl-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3-x64.dll]- [targetUID: 00000000-00004960] "GoToResolveTools64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools64.exe]- [targetUID: 00000000-00004960] "PasswordPrivacyDll.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll]- [targetUID: 00000000-00002896] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll]- [targetUID: 00000000-00002896] "GoToResolveTools32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools32.exe]- [targetUID: 00000000-00004960] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock64.dll]- [targetUID: 00000000-00004960] "GoToResolveCrashHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveCrashHandler.exe]- [targetUID: 00000000-00004960] "legacy.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\legacy.dll]- [targetUID: 00000000-00004960] "GoToResolveUnlock32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock32.dll]- [targetUID: 00000000-00004960] "LMISupport7x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x64.dll]- [targetUID: 00000000-00004960] "GoToResolveUnattendedRemover.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedRemover.exe]- [targetUID: 00000000-00004960] "GoToResolveRemoteControl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRemoteControl.exe]- [targetUID: 00000000-00004960] "GoToResolveLoggerProcess.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveLoggerProcess.exe]- [targetUID: 00000000-00004960] "GoToResolveProcessChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveProcessChecker.exe]- [targetUID: 00000000-00004960] "GoToResolveUnattendedUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedUi.exe]- [targetUID: 00000000-00004960] "GoToResolveUnattended.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe]- [targetUID: 00000000-00004960] "GoToResolveExternalModuleHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveExternalModuleHandler.exe]- [targetUID: 00000000-00004960] "GoToResolveRegistryEditor.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRegistryEditor.exe]- [targetUID: 00000000-00004960] "GoToResolveNetworkChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveNetworkChecker.exe]- [targetUID: 00000000-00004960] "GoToResolveServiceManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveServiceManager.exe]- [targetUID: 00000000-00004960] "GoToResolveFileManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveFileManager.exe]- [targetUID: 00000000-00004960] "GoToResolveQuickView.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveQuickView.exe]- [targetUID: 00000000-00004960] "GoToResolveTerminal.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTerminal.exe]- [targetUID: 00000000-00004960] "GoToResolveUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUi.exe]- [targetUID: 00000000-00004960] "LMISupport7x32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x32.dll]- [targetUID: 00000000-00004960] "LMISupportM64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupportM64.exe]- [targetUID: 00000000-00004960] "LMISupportM32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupportM32.exe]- [targetUID: 00000000-00004960] "lmiscrhook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook64.dll]- [targetUID: 00000000-00004960] "lmiscrhook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook32.dll]- [targetUID: 00000000-00004960] "LMIFilterHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook64.dll]- [targetUID: 00000000-00004960] "LMIInputHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook64.dll]- [targetUID: 00000000-00004960] "g2rvdd.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.dll]- [targetUID: 00000000-00004960] "LMIFilterHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook32.dll]- [targetUID: 00000000-00004960] "LMIInputHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook32.dll]- [targetUID: 00000000-00004960] "g2rvdd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.dll]- [targetUID: 00000000-00004960] "sc.exe.bin" has type "PE32+ executable for MS Windows 10.00 (console) x86-64 7 sections"- [targetUID: N/A] "g2rvdd.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.cat]- [targetUID: 00000000-00004960] "g2rvdd.cat" has type "DER Encoded PKCS#7 Signed Data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.cat]- [targetUID: 00000000-00004960] "UnattendedUpdater.csv" has type "ASCII text with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv]- [targetUID: 00000000-00004960] "g2rvdd.inf" has type "Windows setup INFormation"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.inf]- [targetUID: 00000000-00004960] "g2rvdd.inf" has type "Windows setup INFormation"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.inf]- [targetUID: 00000000-00004960] "DamicoStockstillPolicy.exe.cmd" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [C:\DamicoStockstillPolicy.exe.cmd]- [targetUID: 00000000-00003824] "GoToResolveProcessChecker.log" has type "ASCII text with CRLF LF line terminators"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\GoToResolveProcessChecker.log]- [targetUID: 00000000-00002896] "UnattendedUpdater.log" has type "ASCII text with CRLF LF line terminators"- Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log]- [targetUID: 00000000-00004960] "GoToResolveUnattended.log" has type "ASCII text with CRLF LF line terminators"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\GoToResolveUnattended.log]- [targetUID: 00000000-00007224] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00002896] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00002896] "GoToResolveTools64.log" has type "ASCII text with very long lines (381) with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\GoToResolveTools64.log]- [targetUID: 00000000-00008124] "unattended.json" has type "JSON text data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\unattended.json]- [targetUID: 00000000-00002896] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00002896] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00002896] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00002896] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%WINDIR%\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00002896] "settings.dat" has type "data"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\appdata\CrashReportDB\settings.dat]- [targetUID: 00000000-00008124] "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00002896] "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00002896]5b:T53a,"DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")5c:T124a,"libcrypto-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3-x64.dll]- [targetUID: 00000000-00004960] "FileManager.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll]- [targetUID: 00000000-00002896] "LibGoToResolve.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll]- [targetUID: 00000000-00002896] "MediaClientLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll]- [targetUID: 00000000-00002896] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll]- [targetUID: 00000000-00002896] "libssl-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3-x64.dll]- [targetUID: 00000000-00004960] "PasswordPrivacyDll.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll]- [targetUID: 00000000-00002896] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll]- [targetUID: 00000000-00002896] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock64.dll]- [targetUID: 00000000-00004960] "legacy.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\legacy.dll]- [targetUID: 00000000-00004960] "GoToResolveUnlock32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock32.dll]- [targetUID: 00000000-00004960] "LMISupport7x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x64.dll]- [targetUID: 00000000-00004960] "LMISupport7x32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x32.dll]- [targetUID: 00000000-00004960] "lmiscrhook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook64.dll]- [targetUID: 00000000-00004960] "lmiscrhook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook32.dll]- [targetUID: 00000000-00004960] "LMIFilterHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook64.dll]- [targetUID: 00000000-00004960] "LMIInputHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook64.dll]- [targetUID: 00000000-00004960] "g2rvdd.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.dll]- [targetUID: 00000000-00004960] "LMIFilterHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook32.dll]- [targetUID: 00000000-00004960] "LMIInputHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook32.dll]- [targetUID: 00000000-00004960] "g2rvdd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.dll]- [targetUID: 00000000-00004960]5d:Tb69,"DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "DAMICOSTOCKSTILLPOLICY.EXE"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DAMICOSTOCKSTILLPOLICY"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "")5e:T4b9,"DamicoStockstillPolicy.exe" reads file "c:\program files (x86)\goto resolve unattended\1600971844239445521\unattended.json" "DamicoStockstillPolicy.exe" reads file "c:\windows\fonts\staticcache.dat" "DamicoStockstillPolicy.exe" reads file "c:\users\%osuser%\appdata\local\goto resolve installer\goto0001.tmp\unattendedupdater.csv" "DamicoStockstillPolicy.exe" reads file "c:\users\%osuser%\appdata\local\goto resolve installer\goto0001.tmp\unattendedupdater.log" "GoToResolveUnattended.exe" reads file "c:\program files (x86)\goto resolve unattended\1600971844239445521\passwordprivacydll.dll" "GoToResolveUnattended.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\8ec9b1d0abbd7f98b401d425828828ce_1b47b234e9558c0145847e653cbeced5" "GoToResolveUnattended.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\0e0ea2cd61f757ceb5bb65fc2c758bf4_59b8c30534ea03831ad62b87d9d5f56a" "GoToResolveUnattended.exe" reads file "c:\program files (x86)\goto resolve unattended\1600971844239445521\mediaclientlib.dll" "GoToResolveUnattended.exe" reads file "c:\program files (x86)\goto resolve unattended\1600971844239445521\filemanager.dll"5f:T56a,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to detect virtual environment Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Calls an API typically used to find device information Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Calls an API typically used to enumerate device information Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: Contains ability to delay the execution of current thread60:T538,"DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\RstrtMgr.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\ncrypt.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\ntasn1.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "DamicoStockstillPolicy.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "DamicoStockstillPolicy.exe" trying to touch file "\Global??\FltMgrMsg" "DamicoStockstillPolicy.exe" trying to touch file "C:\DamicoStockstillPolicy.exe"61:Td32,"DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\unattended.json" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveProcessChecker.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUi.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveLoggerProcess.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRemoteControl.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedUi.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedRemover.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveNetworkChecker.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveQuickView.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveFileManager.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTerminal.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveServiceManager.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveExternalModuleHandler.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRegistryEditor.exe" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.cat" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.dll" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.inf" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.cat" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.dll" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.inf" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook32.dll" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook64.dll" "DamicoStockstillPolicy.exe" touched file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook32.dll"62:T458,"GoToResolveUnattended.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "GoToResolveUnattended.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "GoToResolveTools64.exe" touched file "C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_27923191abb55ed0\wvmbusvideo.PNF" "GoToResolveTools64.exe" touched file "C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_dab3e47961bd4184\virtualdisplayadapter.PNF" "GoToResolveTools64.exe" touched file "C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_df3fa89d8f6bbc88\vrd.PNF" "GoToResolveTools64.exe" touched file "C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_95c99fadf120797f\c_display.PNF" "GoToResolveTools64.exe" touched file "C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c96ea0fb3af7d052\displayoverride.PNF" "GoToResolveTools64.exe" touched file "C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_0ae105f572981c3a\rdpidd.PNF" "GoToResolveTools64.exe" touched file "C:\Windows\INF\setupapi.dev.log"63:T85a,"DamicoStockstillPolicy.exe" trying to access non-existent file "C:\cmd.exe" "DamicoStockstillPolicy.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\cmd.exe" "DamicoStockstillPolicy.exe" trying to access non-existent file "C:\DPAPI.dll" "DamicoStockstillPolicy.exe" trying to access non-existent file "C:\DUser.dll" "DamicoStockstillPolicy.exe" trying to access non-existent file "C:\imageres.dll" "DamicoStockstillPolicy.exe" trying to access non-existent file "C:\TextShaping.dll" "DamicoStockstillPolicy.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "GoToResolveUnattended.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\CRYPTSP.DLL" "GoToResolveUnattended.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "GoToResolveTools64.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\DEVOBJ.dll" "GoToResolveTools64.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\drvstore.dll" "GoToResolveTools64.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\SPINF.dll" "GoToResolveTools64.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\cabinet.dll" "GoToResolveTools64.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\g2rvdd.dll" "GoToResolveTools64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\g2rvdd.dll" "GoToResolveCrashHandler.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\CRYPTSP.DLL" "GoToResolveProcessChecker.exe" trying to access non-existent file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\CRYPTSP.DLL" "GoToResolveProcessChecker.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll"64:Tbc4,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "DamicoStockstillPolicy.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")65:T4c1,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API "void __cdecl crashpad::`anonymous-namespace'::CreatePipe(class std::basic_string,class std::allocator > *,class base::ScopedGeneric *)" (Indicator: "CreatePipe"; File: "DamicoStockstillPolicy.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "DamicoStockstillPolicy.exe") Found reference to API "ImpersonateNamedPipeClient" (Indicator: "ImpersonateNamedPipeClient"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")66:Tc56,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")67:T5f6,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "DamicoStockstillPolicy.exe") Found reference to API "gethostname" (Indicator: "gethostname"; File: "DamicoStockstillPolicy.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "DamicoStockstillPolicy.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "DamicoStockstillPolicy.exe") Found reference to API "ed to send ${0}." (Indicator: " send "; File: "DamicoStockstillPolicy.exe") Found reference to API "Unable to send control message to service, error=%lu" (Indicator: " send "; File: "DamicoStockstillPolicy.exe") file/memory contains long string with (Indicator: " send "; File: "PCAP") file/memory contains long string with (Indicator: " socket "; File: "PCAP") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "DamicoStockstillPolicy.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "DamicoStockstillPolicy.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "DamicoStockstillPolicy.exe") Found reference to API "forged shutdown request, got:" (Indicator: " shutdown "; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "Try to connect to the dumpster" (Indicator: " connect "; Source: "00000000-00002896.00000001.129761.6F3F7000.00000004.mdmp") Found reference to API "ed to send ${0}." (Indicator: " send "; Source: "00000000-00004388.00000000.129182.003B9000.00000002.mdmp")68:T27b0,Pattern match: "https://sessions.console.gotoresolve.com" Pattern match: "https://devices-iot.console.gotoresolve.com" Heuristic match: "devices-iot.console.gotoresolve.com" Pattern match: "https://dumpster.console.gotoresolve.com/api/dump" Heuristic match: "../../client/crashpad_client_win.cc" Heuristic match: "../../client/settings.cc" Heuristic match: "../../client/crash_report_database_win.cc" Heuristic match: "../../util/win/scoped_handle.cc" Heuristic match: "../../util/win/critical_section_with_debug_info.cc" Heuristic match: "../../util/win/registration_protocol_win.cc" Heuristic match: "../../util/file/file_io.cc" Heuristic match: "../../util/file/file_io_win.cc" Heuristic match: "../../util/file/file_writer.cc" Heuristic match: "../../util/file/directory_reader_win.cc" Heuristic match: "../../util/file/filesystem_win.cc" Heuristic match: "../../util/file/file_reader.cc" Heuristic match: "../../util/win/scoped_local_alloc.cc" Heuristic match: "../../third_party/mini_chromium/mini_chromium/base/rand_util.cc" Pattern match: "l.goto.com/!&b" Heuristic match: "lg>.lb" Pattern match: "https://dumpster.console.gotoresolve.com" Pattern match: "https://dumpster.dev01-console.gotoresolve.com" Pattern match: "https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392#bkmk_easy" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/evcodesigningsha2-g1.crl071http://crl4.digicert.com/evcodesigningsha2-g1.crl0kd0b070*0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0u{gloygc:f8l;_?{@*42r9farwashington1redmond1microsoft" Pattern match: "https://applet.console.gotoresolve.comapplicationtype" Pattern match: "https://devices-iot.console.gotoresolve.com/,companyid:1600971844239445521,product:6,loglevel:2,offline:0,fleettemplatename:syn-prd-ava-unattended,namespace:syn-prd-ava-unattended,healthcheckurl:https://devices.console.gotoresolve" Heuristic match: "ip.zscaler.com" Heuristic match: "devices.console.gotoresolve.com" Heuristic match: "dumpster.console.gotoresolve.com" Heuristic match: "sessions.console.gotoresolve.com" Pattern match: "https://applet.console.gotoresolve.com\napplicationtype" Pattern match: "https://devices-iot.console.gotoresolve.com/" Pattern match: "http://ip.zscaler.com/" Pattern match: "https://zerotrust.services.gotoresolve.com/health" Pattern match: "https://sessions.console.gotoresolve.com/api/health" Pattern match: "https://devices.console.gotoresolve.com/properties" Pattern match: "https://devices-iot.console.gotoresolve.com/\" Heuristic match: "ocsp.digicert.com" Heuristic match: "../../util/win/module_version.cc" Heuristic match: "../../util/process/process_memory_range.cc" Heuristic match: "../../util/process/process_memory.cc" Heuristic match: "../../util/process/process_memory_win.cc" Heuristic match: "../../util/win/process_info.cc" Heuristic match: "../../client/prune_crash_reports.cc" Heuristic match: "../../util/net/http_body_gzip.cc" Heuristic match: "../../util/net/http_transport_win.cc" Heuristic match: "../../util/net/http_multipart_builder.cc" Heuristic match: "../../snapshot/win/pe_image_resource_reader.cc" Heuristic match: "../../snapshot/win/process_subrange_reader.cc" Heuristic match: "../../snapshot/win/pe_image_reader.cc" Heuristic match: "../../snapshot/win/pe_image_annotations_reader.cc" Heuristic match: "../../snapshot/crashpad_types/crashpad_info_reader.cc" Heuristic match: "../../snapshot/win/cpu_context_win.cc" Heuristic match: "../../snapshot/capture_memory.cc" Heuristic match: "../../util/file/file_seeker.cc" Heuristic match: "../../snapshot/minidump/minidump_simple_string_dictionary_reader.cc" Heuristic match: "../../snapshot/minidump/system_snapshot_minidump.cc" Heuristic match: "../../snapshot/minidump/module_snapshot_minidump.cc" Heuristic match: "../../snapshot/win/system_snapshot_win.cc" Heuristic match: "../../snapshot/win/module_snapshot_win.cc" Heuristic match: "../../snapshot/win/exception_snapshot_win.cc" Heuristic match: "../../snapshot/cpu_context.cc" Heuristic match: "../../snapshot/win/process_reader_win.cc" Heuristic match: "../../snapshot/memory_snapshot.cc" Heuristic match: "../../snapshot/minidump/process_snapshot_minidump.cc" Heuristic match: "../../snapshot/minidump/minidump_annotation_reader.cc" Heuristic match: "../../snapshot/minidump/minidump_string_list_reader.cc" Heuristic match: "../../snapshot/win/process_snapshot_win.cc" Heuristic match: "../../minidump/minidump_writer_util.cc" Heuristic match: "../../minidump/minidump_context_writer.cc" Heuristic match: "../../minidump/minidump_module_writer.cc" Heuristic match: "../../minidump/minidump_memory_writer.cc" Heuristic match: "../../minidump/minidump_exception_writer.cc" Heuristic match: "../../minidump/minidump_writable.cc" Heuristic match: "../../minidump/minidump_file_writer.cc" Heuristic match: "../../minidump/minidump_system_info_writer.cc" Heuristic match: "../../client/crash_report_database.cc" Heuristic match: "../../util/synchronization/semaphore_win.cc" Heuristic match: "../../util/thread/thread_win.cc" Heuristic match: "../../util/win/scoped_process_suspend.cc" Heuristic match: "../../util/win/session_end_watcher.cc" Heuristic match: "../../util/win/scoped_set_event.cc" Heuristic match: "../../util/win/exception_handler_server.cc" Heuristic match: "../../util/win/initial_client_data.cc" Heuristic match: "../../util/misc/paths_win.cc" Heuristic match: "../../handler/minidump_to_upload_parameters.cc" Heuristic match: "../../handler/user_stream_data_source.cc" Heuristic match: "../../handler/crash_report_upload_thread.cc" Heuristic match: "../../handler/handler_main.cc" Pattern match: "https://crashpad.chromium.org/" Pattern match: "https://crashpad.chromium.org/bug/new" Heuristic match: "../../handler/win/crash_report_exception_handler.cc" Heuristic match: "../../minidump/minidump_thread_writer.cc" Heuristic match: "../../minidump/minidump_unloaded_module_writer.cc" Heuristic match: "../../minidump/minidump_module_crashpad_info_writer.cc" Pattern match: "http://ocsp.digicert.com" Pattern match: "ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3d" Pattern match: "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Heuristic match: "\v1.hr" Heuristic match: "vt0.yt" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "https://secure.logmein.com0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Heuristic match: "2http://crl3.digicert.co" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha25620" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt" Pattern match: "https://secure.logmein.com" Pattern match: "http://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl" Heuristic match: "7s5.as" Pattern match: "https://applet.console.gotoresolve.com" Pattern match: "https://devices-iot.console.gotoresolve.co" Heuristic match: "7http://cacerts.digicert.co" Pattern match: "crl3.digicert.com/digicerttrusted" Pattern match: "https://custombranding.console.gotoresolve.com" Pattern match: "https://devices.console.gotoresolve.com/health" Heuristic match: "websiteurl: devices-iot.console.gotoresolve.com" Heuristic match: "logmein.com" Pattern match: "https://appl" Heuristic match: "le.gotoresolve.com" Heuristic match: ".gotoresolve.com" Pattern match: "https://applet.console.gotoresolve" Pattern match: "https://custombranding.cons" Heuristic match: "ve.com" Heuristic match: "ssions.console.gotoresolve.com" Pattern match: "https://se" Heuristic match: "otoresolve.com" Heuristic match: "~mg.bj" Heuristic match: "y%#1.su" Heuristic match: ",x.tw" Pattern match: "goto.com/!&b" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings"69:T13544,Found URL "http://ocsp.digicert.comicrosoft" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "https://secure.logmein.com0" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "https://secure.logmein.com0[" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.co" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://www.digicert.com/cps07" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0\phttp://cacerts.digice" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha25620x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhhsmookhpd?@qz03yz83!z" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt" - Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120251010151007zdigicert," - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "https://secure.logmein.com0[" - Source: "00000000-00002896.00000000.128360.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crll.2.manifest-starterpid7224resolve_1600971844239445521" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl:\program" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.co1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.4@eckp1.2.840.10045.3.1.3ecdpwvtasn1spclinkdecodeessmlhistorydecodeexwvtasn1spclinkdecodewvtasn1spclinkdecodewvtasn1spcsiginfodecode1.3.6.1.4.1.311.12.2.11.3.6.1.4.1.311.12.2.2ldapprovopenstoreessreceiptdecodeexldapprovopenstoreesscontenthintdecodeex1.3.6.1.4.1.311.2.1.111.3.6.1.4.1.311.2.1.12decoderecipientiddecodeattrsequence1.3.6.1.4.1.311.2.1.101.3.6.1.4.1.311.2.1.151.3.6.1.4.1.311.16.41.3.6.1.4.1.311.16.1.11.3.6.1.4.1.311.12.2.31.2.840.113549.1.9.16.1.11.2.840.113549.1.9.16.2.11.2.840.113549.1.9.16.2.11esssigncertificatedecodeex1.2.840.113549.1.9.16.2.121.2.840.113549.1.9.16.2.2essreceiptrequestdecodeexesssecuritylabeldecodeexesskeyexchpreferencedecodeex1.2.840.113549.1.1.121.2.840.113549.1.9.16.2.31.2.840.113549.1.9.16.2.4curl_ca_bundle=c:\users\hapubws\.mitmproxy\mitmproxy-ca-cert.cerprocessor_identifier=intel64" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://www.digicert.com/cps07" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0\phttp://cacerts.digice" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha25620x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhhsmookhpd?@qz03yz83!z" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.coh0g%wz\t" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrusted:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthcommon::util::rebranduninstallinregistryrebranduninstallinregistrycommon::serviceutils::getservicenamevhm'sessionidfromprocessidbatterychanging" - Source: "00000000-00002896.00000001.129761.031FF000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comgotoresolveunattended_1600971844239445521tenderebranduninstallinregistry" - Source: "00000000-00002896.00000001.129761.031FF000.00000004.mdmp") Found URL "https://appl2026-02-23t20:32:38.49324.98124.9822026-02-23t12:32:38.493serviceapplicationcontrollerervice" - Source: "00000000-00002896.00000001.129761.031FF000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.1dmo" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "https://secure.logmein.com0%:el:_q/q,f" - Source: "00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "https://secure.logmein.com0:sz5shbrv(nsf>5?ff>k20251010151008zdigicert," - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "https://secure.logmein.com0%:el:_q/q,f" - Source: "00000000-00002896.00000001.129761.05B90000.00000004.mdmp") Found URL "https://applet.console.gotoresolve." - Source: "00000000-00002896.00000001.129761.05DF4000.00000004.mdmp") Found URL "https://ces-iot.console.gotoresolve.com/" - Source: "00000000-00002896.00000001.129761.05DF4000.00000004.mdmp") Found URL "https://custombranding.consgotoresolve.com" - Source: "00000000-00002896.00000001.129761.05DF4000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtypehttps://devices-iot.console.gotoresolve.com/custombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.comfleettemplatenamesyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/health885334ed23799ec8eba6d5995304f246syn-prd-ava-unattendedrgnaowyoh22uyrwzgotoresolve_1600971844239445521sessionbackendurlhttps://sessions.console.gotoresolve.comdevices-iot.console.gotoresolve.comc:\program" - Source: "00000000-00002896.00000001.129761.05DF4000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.com\napplicationtype:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/\ncompanyid:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com\nenvironment:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health\nhostname:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com\nsessiontype:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com\nfleettemplatename:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health\nhostid:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com\nwebsiteurl:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://seotoresolve.comsessiontype:" - Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found URL "https://l" - Source: "00000000-00004388.00000000.129182.003B9000.00000002.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00004388.00000000.129182.003B9000.00000002.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00004388.00000000.129182.003B9000.00000002.mdmp") Found URL "http://ocsp.digicert.comcsp:http://ocsp.digicert.com:\windows\system32\webio.dll:\windows\system32\webio.dll:\windows\system32\mswsock.dll:\windows\system32\webio.dllttp://ocsp.digicert.com:\windows\system32\mswsock.dllcdsa/sha384cdsa/sha384cdsa/sha384cdsa/sha384trustthis" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3d8ec9b1d0abbd7f98b401d425828828ce_%systemroot%\system32\wshtcpip.dll,-60103%systemroot%\system32\napinsp.dll,-1000%systemroot%\system32\wshtcpip.dll,-60103cheduler-0000%systemroot%\system32\pnrpnsp.dll,-1000:\windows\system32\config\systemprofile%systemroot%\system32\napinsp.dll,-1000cpip6tcpippschedvmbusafunixrfcommsystemroot%\system32\config\systemprofile%systemroot%\system32\pnrpnsp.dll,-1001%systemroot%\system32\pnrpnsp.dll,-1001%systemroot%\system32\pnrpnsp.dll,-1000%systemroot%\system32\pnrpnsp.dll,-1001insock_regiyversionttp://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3dttp://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3dttp://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3dhyper-v" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "https://secure.logmein.com0" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "https://secure.logmein.com0[" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4(:%rl3.digicert.com/digicertassuredidrootca.crl0jz/::5fjitwz\t" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.:" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0c[b" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crthttp://cacerts.digicert.com/digitedg4codesigningrsa4096sha3842021ca1.crtesigningrsa4096sha3842021ca1.crt2.16.c[@gc[yqc[yhrsa4czuhdigicert," - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l%c[rb[\c1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l.c[y*suuuxbhhsmookhbs_hbs_gas\g0" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkicea4mh2e7lu%2fvwtyx3xhog4k%3d!f[srsbs" - Source: "00000000-00004388.00000000.129182.02B20000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120251010151007zdigicert," - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "https://secure.logmein.com0[" - Source: "00000000-00004388.00000000.129182.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl.dll.2.config%systemroot%\system32\wshtcpip.dll,-60103%systemroot%\system32\napinsp.dll,-1000tarfield" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crlrdisallowedcert_autoupdate_1??\c:\program" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digas\g0ib" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://cunattended-session-requestedunattended-session-failedunattended-set-publickeyresultunattended-mqtt-connect-failedunattended-mqtt-publishedunattended-mqtt-publish-failedunattended-migration-startedunattended-mqtt-connect-successunattended-mqtt-errorunattended-sessionstart-errorhealth-elevation-unknown-errorhealth-elevation-startedunattended-mqtt-subscribedunattended-state-insessionunattended-state-idleunattended-update-requestedunattended-mqtt-fallbackvoip-incoming-callrcs-use-screen-serverconfig-directory-existsunattended-update-device-tokenunattended-state-stoppedvoip-call-missedvoip-call-declinedvoip-call-canceledvoip-call-hung-upvoip-microphone-mute-toggledc[bg" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://devices-iot.cve.c1.2.840.10045.3.1.7@eckp2.5.29.192.5.29.142.5.29.15x509v53y2.5.29.31" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0c[b" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://ocshealth-desktop-session-change-requestedert.com/rcs-create-screen-capturer-failed4http://crlhealth-service-starting-as-adminunattended-remote-execution-install-successfulunattended-external-feature-module-terminatedunattended-session-invalid-companyidunattended-update-backup-startedunattended-session-publickey-for-agentunattended-device-duplication-detectedunattended-company-token-acceptedunattended-device-cert-availableunattended-mqtt-provisioning-doneunattended-mqtt-shadow-subscriptions-failedunattended-mqtt-provisioning-failedunattended-update-download-failedunattended-mqtt-subscribe-failedunattended-mqtt-shadow-subscriptions-doneunattended-update-install-failedunattended-update-max-try-count-exceededunattended-session-forced-takeoverunattended-update-install-startingunattended-session-is-not-in-the-valid-frameas\ghealth-media-ice-connection-stuckhealth-start-service-mode-elevationhealth-network-diagnostic-resultunattended-update-install-failedleavebehind-update-new-version-writtenunattended-external-feature-module-startinghealth-service-mode-elevation-failedhealth-elevation-request-receivedhealth-elevation-credentials-neededleavebehind-update-old-application-movedhealth-service-mode-elevation-wrong-credentialshealth-elevation-already-elevatedleavebehind-start-session-startupunattended-update-download-startingunattended-update-download-failedunattended-external-feature-module-terminatedhealthy-screen-capture-fallback-initiatedleavebehind-update-new-application-extractedunattended-update-install-startingunattended-update-max-try-count-exceededhealth-service-starting-as-adminhealth-session-connect-not-possiblercs-create-screen-capturer-failedleavebehind-start-session-quick-launchhealth-elevation-username-or-password-incorrectleavebehind-update-new-version-downloadedhealth-desktop-session-change-requestedunattended-update-download-successunattended-external-feature-module-start-failedhealth-elevation-not-admin-credentials-providedunattended-remote-execution-install-failedhealth-elevation-waiting-for-acceptunattended-mqtt-shadow-subscriptions-failedunattended-collect-support-files-successunattended-mqtt-shadow-subscriptions-doneunattended-session-publickey-for-agenthealth-elevation-not-admin-credentials-providedhealth-elevation-username-or-password-incorrectunattended-update-download-startingunattended-mqtt-provisioning-failedunattended-mqtt-permanent-fallbackunattended-collect-support-files-failedunattended-session-is-not-in-the-valid-frameunattended-mqtt-subscribe-failedhealth-elevation-waiting-for-acceptunattended-update-install-startingunattended-migration-finished-failedunattended-company-token-acceptedunattended-session-invalid-companyidunattended-migration-finished-successunattended-device-duplication-detectedunattended-update-download-successunattended-update-backup-startedunattended-update-install-failedhealth-elevation-already-elevatedunattended-mqtt-provisioning-doneunattended-update-max-try-count-exceededunattended-collect-support-files-startedunattended-new-updater-not-supportedunattended-update-download-failedunattended-session-forced-takeoverrcs-create-screen-capturer-failedunattended-device-cert-availablehealth-desktop-session-change-requestedunattended-remote-execution-install-successfulunattended-remote-execution-download-successfulunattended-remote-execution-finished-successfulunattended-remote-execution-finished-failedunattended-remote-execution-startingunattended-remote-execution-download-startingunattended-remote-execution-download-failedunattended-remote-execution-install-starting" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "https://secure.logmein.com" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0.http://www.digicert.com/ssl-cps-repository.htm0:fk" - Source: "00000000-00004388.00000001.129825.02B20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004388.00000001.129825.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004388.00000001.129825.03900000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004388.00000001.129825.03900000.00000004.mdmp") Found URL "https://secure.logmein.com0" - Source: "00000000-00004388.00000001.129825.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00004388.00000001.129825.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004388.00000001.129825.03900000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "https://secure.logmein.com0:sz5shbrv(nsf>5?ff>k20251010151008zdigicert," - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "https://secure.logmein.com0%:el:_q/q,f" - Source: "00000000-00004388.00000001.129825.040C0000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.com\napplicationtype:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/\ncompanyid:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com\nenvironment:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health\nhostname:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com\nsessiontype:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com\nfleettemplatename:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health\nhostid:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com\nwebsiteurl:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtype:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/companyid:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comenvironment:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostname:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comsessiontype:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.comfleettemplatename:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/healthhostid:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comwebsiteurl:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/healthsessionbackendurlhttps://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.comc:\program" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtypehttps://devices-iot.console.gotoresolve.com/custombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.comfleettemplatenamesyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/health885334ed23799ec8eba6d5995304f246syn-prd-ava-unattendedrgnaowyoh22uyrwzgotoresolve_1600971844239445521sessionbackendurlhttps://sessions.console.gotoresolve.comdevices-iot.console.gotoresolve.comc:\program" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comparams:" - Source: "00000000-00004388.00000001.129825.04600000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.041B0000.00000004.mdmp") Found URL "https://support.goto.com/pt/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.041B0000.00000004.mdmp") Found URL "https://status.gotoresolve.com/" - Source: "00000000-00004960.00000000.126942.041B0000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.041B0000.00000004.mdmp") Found URL "https://support.goto.com/pt/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://status.gotoresolve.com/" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/es/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/it/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/it/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/fr/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/fr/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/es/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/why-am-i-promed-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/de/resolve/help/why-am-i-prompted-for-proxy-credentials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/de/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/de/help/allowlisting-and-goto-resolehlungen" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/de/help/why-am-i-prompted-for-proxyials" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com1831e3412af4e00a1" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/1600971844239445521fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/healthsessionbackendurlhttps://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.compublickeywebsiteurlbaseurlcompanyidproductloglevelofflinenamespacecreatedat1761158774111regionglobaltdjtflst" - Source: "00000000-00004960.00000000.126942.06040000.00000004.mdmp") Found URL "https://support.goto.com/resolve/help/allowlisting-and-goto-resolve" - Source: "00000000-00004960.00000000.126942.060E0000.00000004.mdmp") Found URL "https://status.gotoresolve.com/" - Source: "00000000-00004960.00000000.126942.060E0000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com" - Source: "00000000-00004960.00000000.126942.060E0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/topic/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-winhttp-in-windows-c4bd73d2-31d7-761e-0178-11268bb10392" - Source: "00000000-00004960.00000001.127235.00989000.00000002.mdmp") Found URL "https://l" - Source: "00000000-00004960.00000001.127235.00989000.00000002.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00004960.00000001.127235.00989000.00000002.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00004960.00000001.127235.00989000.00000002.mdmp") Found URL "https://dumpster.console.gotoresolve.comsetupcrashhandlermissing" - Source: "00000000-00004960.00000001.127235.00989000.00000002.mdmp") Found URL "https://dumpster.dev01-console.gotoresolve.comminidumpformathostnameversionsessionidsuccessfully" - Source: "00000000-00004960.00000001.127235.00989000.00000002.mdmp") Found URL "https://support.goto.com/de/help/allowlisting-and-goto-resolehlungen" - Source: "00000000-00004960.00000001.127235.0604A000.00000004.mdmp") Found URL "https://l" - Source: "00000000-00007224.00000001.129146.005A9000.00000002.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00007224.00000001.129146.005A9000.00000002.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00007224.00000001.129146.005A9000.00000002.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhyper-v" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crlchannel" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://voip-call-declinedrttrustedg4tivoip-call-missed25ca1.crt0_health-session-quit-crash-countvoip-call-canceledrsa4096sha256leavebehind-update-failedhealthy-first-frame-senthealth-elevation-uac-declinedvoip-call-hung-uphealth-elevation-unknown-errorvoip-microphone-mute-toggledhealth-session-quit-crash-counthealth-data-channel-connectedvoip-call-acceptedhealth-service-startingvoip-call-declinedhealth-session-connect-pendinghealth-session-connect-rejectedunattended-mqtt-publish-failedvoip-incoming-callhealth-fatal-error-picked-upvoip-call-missedwww.digiunattended-migration-startedvoip-call-canceled4235959z0i1leavebehind-update-started1a0?health-rc-startingimestamping" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://ocsp.digiceiyk)iokdi]km" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/1.2.840.10045.4.3.3xcpx" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007224.00000001.129146.03230000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000001.129146.04F30000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007224.00000001.129146.04F30000.00000004.mdmp") Found URL "https://secure.logmein.com0%:el:_q/q,f" - Source: "00000000-00007224.00000001.129146.04F30000.00000004.mdmp") Found URL "http://ocsp.digice" - Source: "00000000-00007224.00000001.129146.04F30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007224.00000001.129146.04F30000.00000004.mdmp") Found URL "https://secure.logmein.com1.3.6.1.4.1.311.3.3.120251010151008zdigicert," - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "https://secure.logmein.com0v&cc]0z0%$3d;" - Source: "00000000-00007224.00000001.129146.05940000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.com" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://custombranding.console.gotoresolve.com" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health885334ed23799ec8eba6d5995304f246devices-iot.console.gotoresolve.comcom/healths-iot.console.gotoresolve.com/eplaced" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/1600971844239445521fleettemplatenamesyn-prd-ava-unattendedsyn-prd-ava-unattendedhealthcheckurlhttps://devices.console.gotoresolve.com/healthsessionbackendurlhttps://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.compublickeywebsiteurlbaseurlcompanyidproductloglevelofflinenamespacecreatedat1761158774111regiongloballangsessiontypeunattendedworkfoldersaltservicenamehostnameenvironmentproductionc:\program" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l-02-23t12:31:10.904" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtypehttps://devices-iot.console.gotoresolve.com/custombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.comfleettemplatenamesyn-prd-ava-unattendedhealthcheckurlthttps://devices.console.gotoresolve.com/health" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://secure.logmein.com0wk5chj@ertt60908dicegicert" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/x381.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://crl3.digicert.com/di1$$" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://oc" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://crl3.dq!com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "http://ww/hjg/_j4/c:\usershapubwspictures" - Source: "00000000-00007224.00000001.129146.05EF0000.00000004.mdmp") Found URL "https://secu" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://ocsp.dk" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:08crl0" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt070:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha384202omhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/ghl" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "https://l" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "https://jj$jwhy-am-i-" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "https://s)-w^cbaj" - Source: "00000000-00007224.00000001.129146.06320000.00000004.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00007224.00000001.129146.6FA47000.00000002.mdmp") Found URL "https://www.openssl.org/filedescriptionopenssl" - Source: "00000000-00007224.00000001.129146.7335B000.00000002.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlhyper-v" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crlchannel" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://voip-call-declinedrttrustedg4tivoip-call-missed25ca1.crt0_health-session-quit-crash-countvoip-call-canceledrsa4096sha256leavebehind-update-failedhealthy-first-frame-senthealth-elevation-uac-declinedvoip-call-hung-uphealth-elevation-unknown-errorvoip-microphone-mute-toggledhealth-session-quit-crash-counthealth-data-channel-connectedvoip-call-acceptedhealth-service-startingvoip-call-declinedhealth-session-connect-pendinghealth-session-connect-rejectedunattended-mqtt-publish-failedvoip-incoming-callhealth-fatal-error-picked-upvoip-call-missedwww.digiunattended-migration-startedvoip-call-canceled4235959z0i1leavebehind-update-started1a0?health-rc-startingimestamping" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://ocsp.digice-ieciyk)iokdi]km" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/1.2.840.10045.4.3.3xcpx" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007224.00000002.129777.03230000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000002.129777.04F30000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007224.00000002.129777.04F30000.00000004.mdmp") Found URL "https://secure.logmein.com0%:el:_q/q,f" - Source: "00000000-00007224.00000002.129777.04F30000.00000004.mdmp") Found URL "http://ocsp.digice" - Source: "00000000-00007224.00000002.129777.04F30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007224.00000002.129777.04F30000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/" - Source: "00000000-00007224.00000002.129777.05F5D000.00000004.mdmp") Found URL "https://devices.console.gotoresolve.com/health885334ed23799ec8eba6d5995304f246devices-iot.console.gotoresolve.comcom/healths-iot.console.gotoresolve.com/eplaced" - Source: "00000000-00007224.00000002.129777.05F5D000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.comappletgeneratorurlhttps://applet.console.gotoresolve.comcustombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.compublickeywebsiteurlbaseurlcompanyidproductloglevelofflinenamespacecreatedat1761158774111regiongloballangsessiontypeunattendedworkfoldersaltservicenamehostnameenvironmentproductionc:\program" - Source: "00000000-00007224.00000002.129777.05F5D000.00000004.mdmp") Found URL "https://devices-iot.console.gotoresolve.com/" - Source: "00000000-00007224.00000002.129777.05F94000.00000004.mdmp") Found URL "https://applet.console.gotoresolve.comapplicationtypehttps://devices-iot.console.gotoresolve.com/custombrandingcustombrandingtitlecustombrandingurlhttps://custombranding.console.gotoresolve.comfleettemplatenamesyn-prd-ava-unattendedhealthcheckurlthttps://devices.console.gotoresolve.com/health" - Source: "00000000-00007224.00000002.129777.05F94000.00000004.mdmp") Found URL "https://sessions.console.gotoresolve.com" - Source: "00000000-00007224.00000002.129777.05F94000.00000004.mdmp") Found URL "https://secure.logmein.com0wk5chj@ertt60908dicegicert" - Source: "00000000-00007224.00000002.129777.05FA9000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007224.00000002.129777.05FA9000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000002.129777.05FA9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007224.00000002.129777.05FA9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007224.00000002.129777.05FA9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l/x381.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007224.00000002.129777.05FA9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007224.00000002.129777.05FC3000.00000004.mdmp") Found URL "http://crl3.digicert.com/di1$$" - Source: "00000000-00007224.00000002.129777.05FC3000.00000004.mdmp") Found URL "http://oc" - Source: "00000000-00007224.00000002.129777.05FC3000.00000004.mdmp") Found URL "http://crl3.dq!com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000002.129777.05FC3000.00000004.mdmp") Found URL "http://ww/hjg/_j4/c:\usershapubwspictures" - Source: "00000000-00007224.00000002.129777.05FC3000.00000004.mdmp") Found URL "https://secu" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://ocsp.dk" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:08@*>vlmem8@*>v@*>v@*>vd0046003000370037002d00340031003vd0042004400320043002d0041003600420042003\60034004^07f452c3634db60506b0ace2ckf" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt070:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha384202omhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/ghl" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00007224.00000002.129777.06320000.00000004.mdmp") Found URL "http://%shttp://%s" - Source: "00000000-00007224.00000002.129777.6F966000.00000002.mdmp") Found URL "http://www.webrtc.org/experiments/rtp-hdrext/abs-send-timehttp://www.webrtc.org/experiments/rtp-hdrext/abs-capture-timeurn:3gpp:video-orientationhttp://www.webrtc.org/experiments/rtp-hdrext/video-content-typehttp://www.webrtc.org/experiments/rtp-hdrext/video-timinghttp://www.webrtc.org/experiments/rtp-hdrext/generic-frame-descriptor-00https://aomediacodec.github.io/av1-rtp-spec/" - Source: "00000000-00007224.00000002.129777.7168E000.00000002.mdmp") Found URL "http://www.webrtc.org/experiments/rtp-hdrext/video-layers-allocation00http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01http://www.webrtc.org/experiments/rtp-hdrext/transport-wide-cc-02http://www.webrtc.org/experiments/rtp-hdrext/playout-delayhttp://www.webrtc.org/experiments/rtp-hdrext/color-spaceurn:ietf:params:rtp-hdrext:sdes:midurn:ietf:params:rtp-hdrext:sdes:rtp-stream-idurn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-idhttp://www.webrtc.org/experiments/rtp-hdrext/video-frame-tracking-idurn:ietf:params:rtp-hdrext:csrc-audio-levelpbo@profile-level-idqprofile-id" - Source: "00000000-00007224.00000002.129777.7168E000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007224.00000002.129777.7168E000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,::operator *(void) noexcept &" (Indicator: "ProcessList"; File: "DamicoStockstillPolicy.exe") Found reference to API "const class boost::system::error_code &__thiscall boost::variant2::detail::variant_base_impl<0,0,class common::util::ProcessList,class boost::system::error_code>::_get_impl<0x1>(struct std::integral_constant) noexcept const" (Indicator: "ProcessList"; File: "DamicoStockstillPolicy.exe") Found reference to API "C:\a\rescue-native-rescueassist\rescue-native-rescueassist\lib\common\common\util\win\ProcessList.cpp" (Indicator: "ProcessList"; File: "DamicoStockstillPolicy.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "DamicoStockstillPolicy.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "DamicoStockstillPolicy.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "DamicoStockstillPolicy.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "DamicoStockstillPolicy.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "DamicoStockstillPolicy.exe") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "DamicoStockstillPolicy.exe") Found reference to API "CoGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "DamicoStockstillPolicy.exe") Found reference to API "::NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "QueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "63056572866,2092,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:33:47.406",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002896.00000001.129761.05E06000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")71:T414,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")72:Te2e,Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileAttributes" (Indicator: "GetFileAttributes"; File: "DamicoStockstillPolicy.exe") Found reference to API "unsigned __int64 __cdecl crashpad::GetFileSize(const class base::FilePath &)" (Indicator: "GetFileSize"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileSize() error: {}" (Indicator: "GetFileSize"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfo"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSize:" (Indicator: "GetFileVersionInfoSize"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "GetFileVersionInfo:" (Indicator: "GetFileVersionInfo"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")73:T48f,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "DamicoStockstillPolicy.exe") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleFileName() error: {}" (Indicator: "GetModuleFileName"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004388.00000000.129182.003A3000.00000002.mdmp")74:T8dc,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "DamicoStockstillPolicy.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "DamicoStockstillPolicy.exe") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::NtQueryObject" (Indicator: "NtQueryObject"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "NtQuerySystemInformation SystemExtendedHandleInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "::NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess incorrect size" (Indicator: "NtQueryInformationProcess"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")75:Ta78,Found string "\Device\HarddiskVolume3\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe" (Indicator: "\Device\"; Source: "00000000-00004960-00000BC0-922786672") Found string "\Device\HarddiskVolume3\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools64.exe" (Indicator: "\Device\"; Source: "00000000-00004960-00000BC0-922888823") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00004960-00000BC0-922941459") Found string "\Device\HarddiskVolume3\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveProcessChecker.exe" (Indicator: "\Device\"; Source: "00000000-00007224-00000BC0-940521988") Found string "\Device\HarddiskVolume3\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveCrashHandler.exe" (Indicator: "\Device\"; Source: "00000000-00008124-00000BC0-926788077") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00003824-00000BC0-923416545") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\timeout.exe" (Indicator: "\Device\"; Source: "00000000-00003824-00000BC0-926213521") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp, 00000000-00002896.00000000.128360.052D0000.00000004.mdmp, 00000000-00002896.00000001.129761.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp, 00000000-00002896.00000000.128360.052D0000.00000004.mdmp, 00000000-00002896.00000001.129761.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.052D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002896.00000000.128360.03140000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002896.00000001.129761.03140000.00000004.mdmp") Found string "ystem32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002896.00000001.129761.03229000.00000004.mdmp")76:T41f,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "DamicoStockstillPolicy.exe") Found reference to API "RemoveDirectory" (Indicator: "RemoveDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "bool __cdecl crashpad::`anonymous-namespace'::LoggingRemoveDirectoryImpl(const class base::FilePath &)" (Indicator: "RemoveDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "bool __cdecl crashpad::LoggingRemoveDirectory(const class base::FilePath &)" (Indicator: "RemoveDirectory"; File: "DamicoStockstillPolicy.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")77:Td21,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "DamicoStockstillPolicy.exe") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; File: "DamicoStockstillPolicy.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "DamicoStockstillPolicy.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "DamicoStockstillPolicy.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "DamicoStockstillPolicy.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "DamicoStockstillPolicy.exe") Found reference to API "IsTokenRestricted" (Indicator: "IsTokenRestricted"; File: "DamicoStockstillPolicy.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "DamicoStockstillPolicy.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "DamicoStockstillPolicy.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "DamicoStockstillPolicy.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "DamicoStockstillPolicy.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "DamicoStockstillPolicy.exe") Found reference to API "Check failed: RevertToSelf()" (Indicator: "RevertToSelf"; File: "00000000-00007476.00000000.127481.005F1000.00000020.mdmp") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002896.00000001.129761.70A5A000.00000002.mdmp")78:Tfce,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: PasswordPrivacyDll.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: PasswordPrivacyDll.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: PasswordPrivacyDll.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: PasswordPrivacyDll.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: PasswordPrivacyDll.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: PasswordPrivacyDll.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: PasswordPrivacyDll.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: PasswordPrivacyDll.dll] Observed import api "IsTokenRestricted" which can "indicate whether a token contains a list of restricted security identifiers (SIDs)" [Source: PasswordPrivacyDll.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: PasswordPrivacyDll.dll] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: PasswordPrivacyDll.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: GoToResolveUnlock64.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: GoToResolveUnlock64.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: GoToResolveUnlock64.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: GoToResolveUnlock64.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: GoToResolveUnlock64.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: GoToResolveUnlock64.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: GoToResolveUnlock64.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: GoToResolveUnlock64.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: GoToResolveUnlock32.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: GoToResolveUnlock32.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: GoToResolveUnlock32.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: GoToResolveUnlock32.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: GoToResolveUnlock32.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: GoToResolveUnlock32.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: GoToResolveUnlock32.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: GoToResolveUnlock32.dll]79:Ta7e,"DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "DamicoStockstillPolicy.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")7a:T12f0,"DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOTO RESOLVE UNATTENDED 1600971844239445521"; Key: "DISPLAYICON"; Value: "%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe"), "DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOTO RESOLVE UNATTENDED 1600971844239445521"; Key: "DISPLAYNAME"; Value: "LogMeIn Resolve Unattended 1600971844239445521"), "DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOTO RESOLVE UNATTENDED 1600971844239445521"; Key: "DISPLAYVERSION"; Value: "1.27.1.3232"), "DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOTO RESOLVE UNATTENDED 1600971844239445521"; Key: "INSTALLLOCATION"; Value: "%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521"), "DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOTO RESOLVE UNATTENDED 1600971844239445521"; Key: "UNINSTALLSTRING"; Value: "%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedRemover.exe"), "DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CMD.EXE"; Value: "56C1A02B03A5DC010000000000000000000000000200000000"), "DamicoStockstillPolicy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\GOTO RESOLVE UNATTENDED\1600971844239445521"; Key: "PUBLICKEY"; Value: "01000000D08C9DDF0115D1118C7A00C04FC297EB0100000054462903917EBF4DB793CC58DF25662904000000020000000000106600000001000020000000CF63CB8614D3B4EF0E7D32400719D8E1C0D8A78C65A4F74D590CADB19F8233F9000000000E800000000200002000000002B776F11E71069911F0D7B27ED041A6004D823D8A44EF652E4986E7BA9A739B30000000741D039B3FB37EDE6AFC6323902FFF0B66D41BDCBA89761F9A1EC099EF162508E6315D975691423F148D400BE119793D4000000064328359E14D3BB95988E6F44A3F6ADBD971493007705AC0BC54AF34011111406D898E11739BDCE5CAF8E926A4B719434A13087B2784755C08C377F6151C323300"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\GOTO RESOLVE UNATTENDED\1600971844239445521"; Key: "HOSTID"; Value: "885334ed23799ec8eba6d5995304f246"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "1B06000000000000040004000102060000000000010000001C390B01010000002FD60F02010000006B507E0018000000795344025C000000A19F5E0001000000F062570204000100000054000000276B69012F00000056737D00060000006B507E0006000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000020B0000E6C5310006000000F0E0B60000"), "GoToResolveUnattended.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F00000000050000000000000049A8A801010203005C4614A6000000000A00000000000000D1A8A8010102030064B65611000000000A00000000000000D1A8A80101000400FB3B54EB000000000F0000000000000023ACAD0102010400546DD0B40000000001000000810000002B7ABA010202070017EB54670000000002000000070000009F49DD010100008045734BE10000000007000000000000004959DD0101000400F34A296B0000000002000000300500000C84EA010101010077F4574600000000010000001D000000BFDE08020100008065B49D6B00000000040000001C0000005F37110201000080856D77FF000000000200000003000000FDBE49020102008003520DB6000000000200000068090000487C4D0201000080127A123700000000280000000700000093FE59020100010098FBB9D600000000010000000000000000"), "GoToResolveProcessChecker.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOTO RESOLVE UNATTENDED 1600971844239445521"; Key: "DISPLAYNAME"; Value: "LogMeIn Resolve Unattended 1600971844239445521"), "GoToResolveProcessChecker.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\NETWORK\GOTORESOLVE_1600971844239445521"; Key: "(DEFAULT)"; Value: "Service")7b:T522,Dropped file: "UnattendedUpdater.csv" - Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv]- [targetUID: 00000000-00004960] Dropped file: "UnattendedUpdater.log" - Location: [%LOCALAPPDATA%\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log]- [targetUID: 00000000-00004960] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00002896] Dropped file: "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00002896] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5]- [targetUID: 00000000-00002896] Dropped file: "0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A]- [targetUID: 00000000-00002896]7c:Tab2,Found string "InitializeProcThreadAttributeList" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "UpdateProcThreadAttribute" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "CreateHardLinkW" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "CreateSymbolicLinkW" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "NtCreateFile" (Source: DamicoStockstillPolicy.exe, API is part of module: NTDLL.DLL) Found string "NtQueryDirectoryFile" (Source: DamicoStockstillPolicy.exe, API is part of module: NTDLL.DLL) Found string "GetCurrentPackageId" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "GetTempPath2W" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "SleepConditionVariableCS" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: DamicoStockstillPolicy.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: DamicoStockstillPolicy.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: DamicoStockstillPolicy.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: DamicoStockstillPolicy.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: DamicoStockstillPolicy.exe, API is part of module: MSVCRT.DLL) Found string "EnumSystemLocalesEx" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNELBASE.DLL) Found string "RoInitialize" (Source: DamicoStockstillPolicy.exe, API is part of module: COMBASE.DLL) Found string "RoUninitialize" (Source: DamicoStockstillPolicy.exe, API is part of module: COMBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "AppPolicyGetThreadInitializationType" (Source: DamicoStockstillPolicy.exe, API is part of module: KERNEL.APPCORE.DLL)7d:T580,"DamicoStockstillPolicy.exe" was detected as "VC8 -> Microsoft Corporation" "libcrypto-3.dll" was detected as "Microsoft visual C++ 8.0" "libssl-3-x64.dll" was detected as "Microsoft visual C++ 8.0" "PasswordPrivacyDll.dll" was detected as "Borland Delphi 3.0 (???)" "libssl-3.dll" was detected as "Microsoft visual C++ 8.0" "GoToResolveTools32.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveCrashHandler.exe" was detected as "VC8 -> Microsoft Corporation" "legacy.dll" was detected as "Microsoft visual C++ 8.0" "GoToResolveUnlock32.dll" was detected as "Borland Delphi 3.0 (???)" "GoToResolveUnattendedRemover.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveRemoteControl.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveLoggerProcess.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveProcessChecker.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveUnattendedUi.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveUnattended.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveExternalModuleHandler.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveRegistryEditor.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveNetworkChecker.exe" was detected as "VC8 -> Microsoft Corporation" "GoToResolveServiceManager.exe" was detected as "VC8 -> Microsoft Corporation"7e:T8d5,"GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX"; Key: "PHANTOM") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "PHANTOM") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&743AEA3&0&000000") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&743AEA3&0&000000"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_SATA_HAR\5&354AE4D7&0&000000"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_VMWARE__INC.&PROD_VMWARE7_1"; Key: "CONFIGFLAGS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SWD\COMPUTER\MFG_INNOTEK_GMBH&FAM_VIRTUAL_MACHINE&PROD_VIRTUALBOX"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD01\5&354AE4D7&0&010000"; Key: "HARDWAREID") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&743AEA3&0&000000"; Key: "COMPATIBLEIDS") "GoToResolveTools64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&743AEA3&0&000000"; Key: "HARDWAREID")7f:T12ff0,"POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2519 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdaterGlobal", "level": "info", "message": "Add 2 sinks to logger.", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.742", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "****************** Backtrace Start ******************", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.747", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Parameters extracted from certificate area.", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.588", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "****************** Backtrace End ********************", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.750", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Using CompanyID from injected params it wasn't overriden by the user. Value: 1600971844239445521", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.756", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2443 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Cleaning up previous installation...", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.765", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Service name: GoToResolve_1600971844239445521", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.766", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "_installerParams.companyID : 1600971844239445521", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.767", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "_installerParams.forceInstall : false", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.767", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "_installerParams.offline : false", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.768", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2625 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "_installerParams.publicKey : 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.769", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "_installerParams.type : Unattended", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.770", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Service GoToResolve_1600971844239445521 is not running, deleting folder contents and service entry then continue the deployment process...", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.771", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "info", "message": "Force kill service", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.772", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 0: error: (system:87) The parameter is incorrect", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.782", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2754 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 4:System, error: (system:31) A device attached to the system is not functioning", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.784", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 92:Registry error: (system:31) A device attached to the system is not functioning", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.785", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 364:smss.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.786", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 508:csrss.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.787", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 608:wininit.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.788", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2701 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 616:csrss.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.789", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 744:services.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.795", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 764:lsass.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.796", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 876:svchost.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.797", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 904:fontdrvhost.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.798", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2744 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 908:fontdrvhost.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.800", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 996:svchost.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.801", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 620:dwm.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.807", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 1096:svchost.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.813", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 2032:Memory Compression, error: (system:31) A device attached to the system is not functioning", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.882", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2716 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 2672:svchost.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.961", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 4000:WmiPrvSE.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.016", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 4860:WmiPrvSE.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.128", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 7504:TiWorker.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.238", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 4356:MoUsoCoreWorker.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.253", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2461 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "info", "message": "Successfully stopped all processes", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.299", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "UnattendedUpdater starting!", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.317", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Working directory: C:/Program Files (x86)/GoTo Resolve Unattended/1600971844239445521", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.318", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "---- DEPLOYING ----", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.319", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Parameters extracted from certificate area.", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.320", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2682 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Saving params to: C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.321", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "JsonFileParams", "level": "debug", "message": "Opening input file in read-only mode: C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:52.325", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Files and params extracted!", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:54.788", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Run command: \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattended.exe\" -regsvc ", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:54.790", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Service started successfully with version number: 1.27.1.3232!", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:54.841", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2577 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "WTS:common::wts::RunProcess", "level": "debug", "message": "create process...", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:54.842", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "WTS:common::wts::RunProcess", "level": "debug", "message": "Process started! Command: [\"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveTools64.exe\" -InstallVDD]. Started ProcessId: 8124. SessionId: 1", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:54.952", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "common::util::moveWindowAboveOtherWindow", "level": "error", "message": "Cannot get process id for other window error code: 1400", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:55.695", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "Temp directory path is empty.", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:59.645", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "UnattendedUpdater", "level": "info", "message": "finished", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:59.646", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2609 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "GlobalLogger", "facility": "LoggerProcess", "level": "info", "message": "Add 2 sinks to logger.", "processId": "7776", "sessionId": "", "threadId": "3432", "time": "2026-02-23T12:33:22.079", "utcTime": "2026-02-23T20:33:22.079" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "debug", "message": "[ default ] Application started successfully.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.167", "utcTime": "2026-02-23T20:33:22.167" }, { "app": "LoggerProcess", "facility": "Params", "level": "debug", "message": "Persisting all parameters to file: logger.json", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.167", "utcTime": "2026-02-23T20:33:22.167" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "warning", "message": "Error checking if input file logger.json exists: The system cannot find the file specified", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.167", "utcTime": "2026-02-23T20:33:22.167" }, { "app": "LoggerProcess", "facility": "JsonFileParams::getFileContentAsString", "level": "error", "message": "Failed to get file's contents logger.json, (system:2) The system cannot find the file specified", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.167", "utcTime": "2026-02-23T20:33:22.167" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2595 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "The parsed json is not an object, setting it as an object. Filename: logger.json", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.167", "utcTime": "2026-02-23T20:33:22.167" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: ApplicationType, 4", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.167", "utcTime": "2026-02-23T20:33:22.167" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: CompanyId, 1600971844239445521", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.168", "utcTime": "2026-02-23T20:33:22.168" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: Environment, Production", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.168", "utcTime": "2026-02-23T20:33:22.168" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: HostId, 9f9bc5fc91db7ab1a784cca5210db5ad", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.169", "utcTime": "2026-02-23T20:33:22.169" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 3174 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: LogLevel, 2", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.169", "utcTime": "2026-02-23T20:33:22.169" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: ParentProcessId, 7876", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.169", "utcTime": "2026-02-23T20:33:22.169" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: SessionType, Unattended", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.170", "utcTime": "2026-02-23T20:33:22.170" }, { "app": "LoggerProcess", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: WorkFolder, C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.170", "utcTime": "2026-02-23T20:33:22.170" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ default ] \"Param layer Id: 1\\nApplicationType: 4\\nCompanyId: 1600971844239445521\\nEnvironment: Production\\nHostId: 9f9bc5fc91db7ab1a784cca5210db5ad\\nLogLevel: 2\\nParentProcessId: 7876\\nSessionType: Unattended\\nWorkFolder: C:\\\\Program Files (x86)\\\\GoTo Resolve Unattended\\\\1600971844239445521\\nParam layer Id: 0\\nApplicationType: 4\\nCompanyId: 1600971844239445521\\nEnvironment: Production\\nHostId: 9f9bc5fc91db7ab1a784cca5210db5ad\\nInstallationId: H6l9SRwVhM\\nLogLevel: 2\\nParentProcessId: 7876\\nSessionType: Unattended\\nWorkFolder: C:\\\\Program Files (x86)\\\\GoTo Resolve Unattended\\\\1600971844239445521\\n\"", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.170", "utcTime": "2026-02-23T20:33:22.170" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:35 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2539 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "SetupCrashHandler", "level": "debug", "message": "Successfully added HostName (DESKTOP-8LD9T6N) to Crash Handler", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.248", "utcTime": "2026-02-23T20:33:22.248" }, { "app": "LoggerProcess", "facility": "SetupCrashHandler", "level": "debug", "message": "Successfully added InstallationId (H6l9SRwVhM) to Crash Handler", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.249", "utcTime": "2026-02-23T20:33:22.249" }, { "app": "LoggerProcess", "facility": "SetupCrashHandler", "level": "info", "message": "Crash Handler started successfully!", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.398", "utcTime": "2026-02-23T20:33:22.398" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LogCollector ] Checking for updater logs", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.477", "utcTime": "2026-02-23T20:33:22.477" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LogCollector ] Finished signal found.", "processId": "7776", "sessionId": "", "threadId": "9076", "time": "2026-02-23T12:33:22.488", "utcTime": "2026-02-23T20:33:22.488" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2774 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "QtPlatform", "level": "warning", "message": "[ LogCollector ] Could not create JsonLogEvents. (\"2026-02-23 12:29:51.751\", \"\", \"info\", \"UnattendedUpdaterGlobal\", \"UnattendedUpdater\", \"\", \"\", \"Command line params: Param layer Id: 0\")", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.489", "utcTime": "2026-02-23T20:33:22.489" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "warning", "message": "[ LogCollector ] Could not create JsonLogEvents. (\"\", \"4960\", \"8824\")", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.489", "utcTime": "2026-02-23T20:33:22.489" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ FileCacheHandler ] No logs were cached before.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.603", "utcTime": "2026-02-23T20:33:22.603" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] LocalSocket name: \"GoToResolve_1600971844239445521\"", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.603", "utcTime": "2026-02-23T20:33:22.603" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] LocalSocket server is listening: \"GoToResolve_1600971844239445521\"", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:22.604", "utcTime": "2026-02-23T20:33:22.604" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2530 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.307", "utcTime": "2026-02-23T20:33:26.307" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.307", "utcTime": "2026-02-23T20:33:26.307" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] Identified owner process LocalSocket.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.307", "utcTime": "2026-02-23T20:33:26.307" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.307", "utcTime": "2026-02-23T20:33:26.307" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.308", "utcTime": "2026-02-23T20:33:26.308" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2520 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.308", "utcTime": "2026-02-23T20:33:26.308" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.308", "utcTime": "2026-02-23T20:33:26.308" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.308", "utcTime": "2026-02-23T20:33:26.308" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.309", "utcTime": "2026-02-23T20:33:26.309" }, { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.309", "utcTime": "2026-02-23T20:33:26.309" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2611 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "LoggerProcess", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocketServer ] New LocalSocket connection.", "processId": "7776", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:26.309", "utcTime": "2026-02-23T20:33:26.309" }, { "app": "ProcessChecker", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocket ] Connected LocalSocket: \"GoToResolve_1600971844239445521\" , number of buffered messages: 68 , sending them now", "processId": "6276", "sessionId": "", "threadId": "9160", "time": "2026-02-23T12:33:23.110", "utcTime": "2026-02-23T20:33:23.110" }, { "app": "GlobalLogger", "facility": "ProcessChecker", "level": "info", "message": "Add 2 sinks to logger.", "processId": "6276", "sessionId": "", "threadId": "7968", "time": "2026-02-23T12:33:20.114", "utcTime": "2026-02-23T20:33:20.114" }, { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Opening input file in read-only mode: unattended.json", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.115", "utcTime": "2026-02-23T20:33:20.115" }, { "app": "ProcessChecker", "facility": "ProcessMutex", "level": "debug", "message": "Create mutex Global\\GoToResolveUnattended_1600971844239445521_Service", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.115", "utcTime": "2026-02-23T20:33:20.115" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 4669 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Opening input file in read-only mode: mandatory.json", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.115", "utcTime": "2026-02-23T20:33:20.115" }, { "app": "ProcessChecker", "facility": "PowerEvent", "level": "debug", "message": "Modern Standby supported: false", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.117", "utcTime": "2026-02-23T20:33:20.117" }, { "app": "ProcessChecker", "facility": "PowerEvent", "level": "info", "message": "System power status - AC: online, no battery", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.117", "utcTime": "2026-02-23T20:33:20.117" }, { "app": "ProcessChecker", "facility": "ServiceApplicationController", "level": "info", "message": "params: 'Param layer Id: 3\nService: 1\nServiceName: GoToResolve_1600971844239445521\nWtsRdpMode: 2\nWtsStartingSessionId: 1\nParam layer Id: 2\nApplicationType: 4\nService: 1\nWorkFolder: C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\nParam layer Id: 1\nAppletGeneratorUrl: https://applet.console.gotoresolve.com\nApplicationType: 4\nBaseUrl: https://devices-iot.console.gotoresolve.com/\nCompanyId: 1600971844239445521\nCreatedAt: 1761158774111\nCustomBranding: false\nCustomBrandingTitle: \nCustomBrandingUrl: https://custombranding.console.gotoresolve.com\nEnvironment: Production\nFleetTemplateName: syn-prd-ava-unattended\nHealthCheckUrl: https://devices.console.gotoresolve.com/health\nHostName: DESKTOP-8LD9T6N\nLang: en\nLogLevel: 2\nNamespace: syn-prd-ava-unattended\nOffline: 0\nProduct: 6\nRegion: global\nSalt: rgnaOWYoH22uyrWz\nServiceName: GoToResolve_1600971844239445521\nSessionBackendUrl: https://sessions.console.gotoresolve.com\nSessionType: Unattended\nWebsiteUrl: devices-iot.console.gotoresolve.com\nWorkFolder: C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\npublickey: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1\nParam layer Id: 0\nAppletGeneratorUrl: https://applet.console.gotoresolve.com\nApplicationType: 4\nBaseUrl: https://devices-iot.console.gotoresolve.com/\nCompanyId: 1600971844239445521\nCreatedAt: 1761158774111\nCustomBranding: false\nCustomBrandingTitle: \nCustomBrandingUrl: https://custombranding.console.gotoresolve.com\nFleetTemplateName: syn-prd-ava-unattended\nHealthCheckUrl: https://devices.console.gotoresolve.com/health\nHostId: 885334ed23799ec8eba6d5995304f246\nInstallationId: H6l9SRwVhM\nLang: en\nLogLevel: 2\nNamespace: syn-prd-ava-unattended\nOffline: 0\nProduct: 6\nRegion: global\nSalt: rgnaOWYoH22uyrWz\nServiceName: GoToResolve_1600971844239445521\nSessionBackendUrl: https://sessions.console.gotoresolve.com\nWebsiteUrl: devices-iot.console.gotoresolve.com\nWorkFolder: C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\npublickey: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1\n'", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.118", "utcTime": "2026-02-23T20:33:20.118" }, { "app": "ProcessChecker", "facility": "ServiceApplicationController", "level": "info", "message": "service starting (1.27.1.3232) =========================================", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.118", "utcTime": "2026-02-23T20:33:20.118" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2566 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "ServiceApplicationController", "level": "info", "message": "working path: 'C:/Program Files (x86)/GoTo Resolve Unattended/1600971844239445521'", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.118", "utcTime": "2026-02-23T20:33:20.118" }, { "app": "ProcessChecker", "facility": "ServiceApplicationController", "level": "info", "message": "language: 'en'", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.118", "utcTime": "2026-02-23T20:33:20.118" }, { "app": "ProcessChecker", "facility": "ServiceApplicationController", "level": "info", "message": "application installation id: 'H6l9SRwVhM'", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.118", "utcTime": "2026-02-23T20:33:20.118" }, { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: Service, 1", "processId": "6276", "sessionId": "", "threadId": "Main", "time": "2026-02-23T12:33:20.119", "utcTime": "2026-02-23T20:33:20.119" }, { "app": "ProcessChecker", "facility": "ServiceWrap", "level": "debug", "message": "ServiceMain start 0: GoToResolve_1600971844239445521", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2493 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "PowerEvent", "level": "debug", "message": "Modern Standby supported: false", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" }, { "app": "ProcessChecker", "facility": "PowerEvent", "level": "info", "message": "System power status - AC: online, no battery", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" }, { "app": "ProcessChecker", "facility": "ServiceWrap", "level": "info", "message": "Service exit code: 0", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "User: HAPUBWS, SessionId: 1, Type: Console, State: Active", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "warning", "message": "_activeSessionId is not valid: 4294967295", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2536 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: WtsRdpMode, 2", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "Session id changed from 4294967295 to 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "Session id valid and changed from 4294967295 to 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" }, { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: WtsStartingSessionId, 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" }, { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: WtsStartingSessionId, 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.124", "utcTime": "2026-02-23T20:33:20.124" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2670 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "info", "message": "Active session id: 1, starting session id: 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.124", "utcTime": "2026-02-23T20:33:20.124" }, { "app": "ProcessChecker", "facility": "ProcessChecker", "level": "info", "message": "LocalSocket name to connect: GoToResolve_1600971844239445521", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.124", "utcTime": "2026-02-23T20:33:20.124" }, { "app": "ProcessChecker", "facility": "JsonFileParams", "level": "debug", "message": "Value added successfully: ServiceName, GoToResolve_1600971844239445521", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.126", "utcTime": "2026-02-23T20:33:20.126" }, { "app": "ProcessChecker", "facility": "QtPlatform", "level": "info", "message": "[ LocalSocket ] LocalSocket anomaly occurred: QLocalSocket::ServerNotFoundError - \"QLocalSocket::connectToServer: Invalid name\"", "processId": "6276", "sessionId": "", "threadId": "9160", "time": "2026-02-23T12:33:20.130", "utcTime": "2026-02-23T20:33:20.130" }, { "app": "ProcessChecker", "facility": "QtPlatform", "level": "debug", "message": "[ LocalSocket ] LocalSocket name: \"GoToResolve_1600971844239445521\"", "processId": "6276", "sessionId": "", "threadId": "9160", "time": "2026-02-23T12:33:20.130", "utcTime": "2026-02-23T20:33:20.130" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2543 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "SetupCrashHandler", "level": "debug", "message": "Successfully added HostName (DESKTOP-8LD9T6N) to Crash Handler", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.143", "utcTime": "2026-02-23T20:33:20.143" }, { "app": "ProcessChecker", "facility": "SetupCrashHandler", "level": "debug", "message": "Successfully added InstallationId (H6l9SRwVhM) to Crash Handler", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.143", "utcTime": "2026-02-23T20:33:20.143" }, { "app": "ProcessChecker", "facility": "SetupCrashHandler", "level": "info", "message": "Crash Handler started successfully!", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.189", "utcTime": "2026-02-23T20:33:20.189" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "Already in the requested session: 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.189", "utcTime": "2026-02-23T20:33:20.189" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "ProcessChecker started", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.189", "utcTime": "2026-02-23T20:33:20.189" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon, 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body, "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2609 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "IpcController.ProcessChecker", "level": "info", "message": "Starting server at ProcessChecker_H6l9SRwVhM", "processId": "6276", "sessionId": "", "threadId": "9160", "time": "2026-02-23T12:33:20.189", "utcTime": "2026-02-23T20:33:20.189" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "will do event 'IpcListening' in 'Init'", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.219", "utcTime": "2026-02-23T20:33:20.219" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "OnIpcListening: ProcessChecker_H6l9SRwVhM", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.219", "utcTime": "2026-02-23T20:33:20.219" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "state change from 'Init' to 'IpcReady'", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.219", "utcTime": "2026-02-23T20:33:20.219" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "rescueassist::processchecker::ProcessCheckerApplication::waitForQuitApplicationWithTimeout", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.234", "utcTime": "2026-02-23T20:33:20.234" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" HTTP/1.1 202 Accepted Date: Mon 23 Feb 2026 12:31:36 GMT Content-Length: 0 Connection: keep-alive Server: Kestrel with no response body80:T2499,"libcrypto-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3-x64.dll]- [targetUID: 00000000-00004960] "FileManager.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll]- [targetUID: 00000000-00002896] "LibGoToResolve.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll]- [targetUID: 00000000-00002896] "MediaClientLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll]- [targetUID: 00000000-00002896] "libcrypto-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll]- [targetUID: 00000000-00002896] "libssl-3-x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 12 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3-x64.dll]- [targetUID: 00000000-00004960] "GoToResolveTools64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools64.exe]- [targetUID: 00000000-00004960] "PasswordPrivacyDll.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll]- [targetUID: 00000000-00002896] "libssl-3.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll]- [targetUID: 00000000-00002896] "GoToResolveTools32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools32.exe]- [targetUID: 00000000-00004960] "GoToResolveUnlock64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock64.dll]- [targetUID: 00000000-00004960] "GoToResolveCrashHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveCrashHandler.exe]- [targetUID: 00000000-00004960] "legacy.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\legacy.dll]- [targetUID: 00000000-00004960] "GoToResolveUnlock32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock32.dll]- [targetUID: 00000000-00004960] "LMISupport7x64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x64.dll]- [targetUID: 00000000-00004960] "GoToResolveUnattendedRemover.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedRemover.exe]- [targetUID: 00000000-00004960] "GoToResolveRemoteControl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRemoteControl.exe]- [targetUID: 00000000-00004960] "GoToResolveLoggerProcess.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveLoggerProcess.exe]- [targetUID: 00000000-00004960] "GoToResolveProcessChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveProcessChecker.exe]- [targetUID: 00000000-00004960] "GoToResolveUnattendedUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedUi.exe]- [targetUID: 00000000-00004960] "GoToResolveUnattended.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe]- [targetUID: 00000000-00004960] "GoToResolveExternalModuleHandler.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveExternalModuleHandler.exe]- [targetUID: 00000000-00004960] "GoToResolveRegistryEditor.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRegistryEditor.exe]- [targetUID: 00000000-00004960] "GoToResolveNetworkChecker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveNetworkChecker.exe]- [targetUID: 00000000-00004960] "GoToResolveServiceManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveServiceManager.exe]- [targetUID: 00000000-00004960] "GoToResolveFileManager.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveFileManager.exe]- [targetUID: 00000000-00004960] "GoToResolveQuickView.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveQuickView.exe]- [targetUID: 00000000-00004960] "GoToResolveTerminal.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTerminal.exe]- [targetUID: 00000000-00004960] "GoToResolveUi.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUi.exe]- [targetUID: 00000000-00004960] "LMISupport7x32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x32.dll]- [targetUID: 00000000-00004960] "LMISupportM64.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupportM64.exe]- [targetUID: 00000000-00004960] "LMISupportM32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMISupportM32.exe]- [targetUID: 00000000-00004960] "lmiscrhook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook64.dll]- [targetUID: 00000000-00004960] "lmiscrhook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook32.dll]- [targetUID: 00000000-00004960] "LMIFilterHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook64.dll]- [targetUID: 00000000-00004960] "LMIInputHook64.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook64.dll]- [targetUID: 00000000-00004960] "g2rvdd.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 7 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.dll]- [targetUID: 00000000-00004960] "LMIFilterHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook32.dll]- [targetUID: 00000000-00004960] "LMIInputHook32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook32.dll]- [targetUID: 00000000-00004960] "g2rvdd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.dll]- [targetUID: 00000000-00004960] "sc.exe.bin" has type "PE32+ executable for MS Windows 10.00 (console) x86-64 7 sections"- [targetUID: N/A]81:T4539,"DamicoStockstillPolicy.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveProcessChecker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 25712 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveLoggerProcess.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRemoteControl.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattended.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedUi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26224 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnattendedRemover.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26120 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LibGoToResolve.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26184 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveNetworkChecker.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26160 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveQuickView.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26168 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveFileManager.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26152 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTerminal.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26176 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveServiceManager.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26216 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveExternalModuleHandler.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 26184 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveRegistryEditor.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 54072 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x86\g2rvdd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 13648 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\x64\g2rvdd.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 2632 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 17480 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIFilterHook64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 584 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 13896 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMIInputHook64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 31304 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 9800 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\lmiscrhook64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 10824 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 58952 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMISupport7x64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 44104 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMISupportM32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 25160 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\LMISupportM64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 16448 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\MediaClientLib.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010800 ... "DamicoStockstillPolicy.exe" wrote 57024 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\PasswordPrivacyDll.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 46120 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\FileManager.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000480100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 5816 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000400100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 50872 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveTools64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 12960 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveCrashHandler.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 20576 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock32.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 60000 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\GoToResolveUnlock64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 14344 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\legacy.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 29704 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 10760 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\libcrypto-3-x64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 42504 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DamicoStockstillPolicy.exe" wrote 31752 bytes starting with PE header signature to file "C:\Program Files (x86)\GoTo Resolve Unattended\1600971844239445521\libssl-3-x64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...82:T6f7,YARA signature to detect logmein RMM tool file "LMISupportM32.exe" YARA signature to detect gotoassist RMM tool file "GoToResolveLoggerProcess.exe" YARA signature to detect gotoassist RMM tool file "GoToResolveUnattendedRemover.exe" YARA signature to detect gotoassist RMM tool file "GoToResolveExternalModuleHandler.exe" YARA signature to detect gotoassist RMM tool file "GoToResolveQuickView.exe" YARA signature to detect logmein RMM tool file "g2rvdd.dll" YARA signature to detect desktopnow RMM tool file "g2rvdd.dll" YARA signature to detect gotoassist RMM tool file "GoToResolveRemoteControl.exe" YARA signature to detect logmein RMM tool file "LMIInputHook64.dll" YARA signature to detect logmein RMM tool file "LMISupport7x64.dll" YARA signature to detect gotoassist RMM tool file "GoToResolveProcessChecker.exe" YARA signature to detect logmein RMM tool file "LMIFilterHook64.dll" YARA signature to detect gotoassist RMM tool file "GoToResolveNetworkChecker.exe" YARA signature to detect gotoassist RMM tool file "GoToResolveFileManager.exe" YARA signature to detect gotoassist RMM tool file "sample.bin" YARA signature to detect logmein RMM tool file "lmiscrhook64.dll" YARA signature to detect gotoassist RMM tool file "GoToResolveUnattended.exe" YARA signature to detect logmein RMM tool file "lmiscrhook32.dll" YARA signature to detect gotoassist RMM tool file "GoToResolveTerminal.exe" YARA signature to detect logmein RMM tool file "LMISupport7x32.dll" YARA signature to detect logmein RMM tool file "LMIFilterHook32.dll" YARA signature to detect gotoassist RMM tool file "PasswordPrivacyDll.dll" YARA signature to detect gotoassist RMM tool file "GoToResolveServiceManager.exe" YARA signature to detect logmein RMM tool file "LMISupportM64.exe"83:T414,"GoToResolveTools64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\SET5CF3.tmp" with delete access "GoToResolveTools64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\SET5D42.tmp" with delete access "GoToResolveTools64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\SET5D62.tmp" with delete access "GoToResolveTools64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\g2rvdd.cat" with delete access "GoToResolveTools64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\g2rvdd.dll" with delete access "GoToResolveTools64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\g2rvdd.inf" with delete access "cmd.exe" opened "C:\DamicoStockstillPolicy.exe" with delete access "cmd.exe" opened "C:\DAMICO~1.EXE" with delete access "cmd.exe" opened "C:\DamicoStockstillPolicy.exe.cmd" with delete access84:T67c,"DamicoStockstillPolicy.exe" claimed CRC 24480479 while the actual is CRC 24476565 "libssl-3-x64.dll" claimed CRC 1492449 while the actual is CRC 4446169 "GoToResolveTools64.exe" claimed CRC 1407354 while the actual is CRC 1492449 "PasswordPrivacyDll.dll" claimed CRC 1227370 while the actual is CRC 1407354 "libssl-3.dll" claimed CRC 1175555 while the actual is CRC 1227370 "GoToResolveTools32.exe" claimed CRC 1133859 while the actual is CRC 1175555 "GoToResolveUnlock64.dll" claimed CRC 716047 while the actual is CRC 1133859 "GoToResolveCrashHandler.exe" claimed CRC 668695 while the actual is CRC 716047 "legacy.dll" claimed CRC 614617 while the actual is CRC 668695 "GoToResolveUnlock32.dll" claimed CRC 608064 while the actual is CRC 614617 "LMISupport7x64.dll" claimed CRC 516268 while the actual is CRC 608064 "GoToResolveUnattendedRemover.exe" claimed CRC 433384 while the actual is CRC 516268 "GoToResolveRemoteControl.exe" claimed CRC 462394 while the actual is CRC 433384 "GoToResolveLoggerProcess.exe" claimed CRC 470016 while the actual is CRC 462394 "GoToResolveProcessChecker.exe" claimed CRC 448480 while the actual is CRC 470016 "GoToResolveUnattendedUi.exe" claimed CRC 455451 while the actual is CRC 448480 "GoToResolveUnattended.exe" claimed CRC 422722 while the actual is CRC 455451 "GoToResolveExternalModuleHandler.exe" claimed CRC 448989 while the actual is CRC 422722 "GoToResolveRegistryEditor.exe" claimed CRC 452660 while the actual is CRC 448989 "GoToResolveNetworkChecker.exe" claimed CRC 430218 while the actual is CRC 452660 "GoToResolveServiceManager.exe" claimed CRC 451526 while the actual is CRC 43021885:T673,RegCreateKeyExW ChangeServiceConfig2W StartServiceW RegOpenKeyExA RegDeleteKeyExA RegCloseKey RegCreateKeyExA RegDeleteKeyW CertDeleteCertificateFromStore GetFileAttributesExW GetCommandLineW ExitThread GetFileAttributesW FindFirstFileExW GetStartupInfoW LoadLibraryExW OutputDebugStringW TerminateProcess GetModuleFileNameW CreateFileW OpenProcess UnhandledExceptionFilter CreateDirectoryW GetFileSizeEx WriteFile CreateFileMappingW GetModuleHandleW MapViewOfFile GetFileSize GetVersionExW LoadLibraryA GetDriveTypeW GetCommandLineA IsDebuggerPresent FindResourceW SleepEx LockResource CreateProcessW DeleteFileW CopyFileExW GetProcAddress Sleep GetModuleHandleExW DeviceIoControl SleepConditionVariableSRW FindNextFileW CreateDirectoryExW LoadLibraryW CreateThread ShellExecuteW ShellExecuteExW FindWindowW GetWindowThreadProcessId WSAStartup GetSystemInfo GetSystemDirectoryA VirtualProtect VirtualAlloc FindFirstFileW GetTempPathW send bind connect recv closesocket sendto recvfrom listen accept socket RegOpenKeyExW GetComputerNameW VirtualAllocEx GetSystemDirectoryW CreateRemoteThread ReadProcessMemory WriteProcessMemory GetFileAttributesA GetNativeSystemInfo RegEnumKeyExW RegDeleteValueW CreateProcessAsUserW SetSecurityDescriptorDacl OpenProcessToken GetModuleFileNameA GetModuleHandleA GetTickCount CreateToolhelp32Snapshot Process32NextW Process32FirstW EnumProcesses GetModuleFileNameExW OpenFileMappingW ConnectNamedPipe GetThreadContext DisconnectNamedPipe LoadLibraryExA FindResourceExW VirtualProtectEx FindFirstFileExA FindNextFileA86:T1765,"POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2754 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload:==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 4:System, error: (system:31) A device attached to the system is not functioning", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.784", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 92:Registry error: (system:31) A device attached to the system is not functioning", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.785", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 364:smss.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.786", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 508:csrss.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.787", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 608:wininit.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.788", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}", "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2701 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload:==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 616:csrss.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.789", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 744:services.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.795", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 764:lsass.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.796", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 876:svchost.exe, error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.797", "utcTime": "" }, { "app": "UnattendedUpdaterGlobal", "facility": "forceKillServiceProcesses", "level": "trace", "message": "Couldn't query executable path 904:fontdrvhost.exe error: (system:5) Access is denied", "processId": "4960", "sessionId": "", "threadId": "8824", "time": "2026-02-23 12:29:51.798", "utcTime": "" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}"87:T1610,"POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2493 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload:==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "PowerEvent", "level": "debug", "message": "Modern Standby supported: false", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" }, { "app": "ProcessChecker", "facility": "PowerEvent", "level": "info", "message": "System power status - AC: online no battery", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" }, { "app": "ProcessChecker", "facility": "ServiceWrap", "level": "info", "message": "Service exit code: 0", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.120", "utcTime": "2026-02-23T20:33:20.120" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "User: HAPUBWS SessionId: 1 Type: Console State: Active", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "warning", "message": "_activeSessionId is not valid: 4294967295", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.123", "utcTime": "2026-02-23T20:33:20.123" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}" "POST /api/sendEventsV2 HTTP/1.1 Host: dumpster.console.gotoresolve.com Content-Type: application/json Authorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 Content-Length: 2621 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload:==> "{ "Records": { "companyId": "1600971844239445521", "component": "Unattended", "computerId": "9f9bc5fc91db7ab1a784cca5210db5ad", "deviceId": "", "events": [ { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "debug", "message": "waitForQuitApplicationWithTimeout: _pauseChecking: true", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.235", "utcTime": "2026-02-23T20:33:20.235" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "drop event 'MainApplicationStopped' in 'IpcReady'", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.235", "utcTime": "2026-02-23T20:33:20.235" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "User: HAPUBWS SessionId: 1 Type: Console State: Active", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.237", "utcTime": "2026-02-23T20:33:20.237" }, { "app": "ProcessChecker", "facility": "ProcessCheckerApplication", "level": "info", "message": "Start application: Unattended", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.237", "utcTime": "2026-02-23T20:33:20.237" }, { "app": "ProcessChecker", "facility": "ApplicationBundle", "level": "debug", "message": "common::ApplicationBundle::startMainComponent active session id: 1 startingSession id: 1", "processId": "6276", "sessionId": "", "threadId": "1028", "time": "2026-02-23T12:33:20.237", "utcTime": "2026-02-23T20:33:20.237" } ], "installationId": "H6l9SRwVhM", "platform": "win", "productVersion": "1.27.1.3232", "sessionId": "" }}"88:T3413,Spawned process "DamicoStockstillPolicy.exe" (UID: 00000000-00004960) Spawned process "GoToResolveUnattended.exe" with commandline "-regsvc" (UID: 00000000-00007224) Spawned process "GoToResolveTools64.exe" with commandline "-InstallVDD" (UID: 00000000-00008124) Spawned process "cmd.exe" with commandline "/S /C ""C:\\DamicoStockstillPolicy.exe.cmd" "C:\\DamicoStockstillPolicy.exe""" (UID: 00000000-00003824) Spawned process "timeout.exe" with commandline "timeout /T 3" (UID: 00000000-00006312) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=version=1.24.0.142 --initial-client-data=0x390,0x394,0x398,0x388,0x39c,0x7ff6b777baf8,0x7ff6b777bb10,0x7ff6b777bb28" (UID: 00000000-00007476) Spawned process "GoToResolveProcessChecker.exe" with commandline "-regsvc -expectadmin -starterpid 7224 -InstallationId H6l9SRwVhM -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521" -ApplicationType 4 -Environment "Production" -ForceInstall 0" (UID: 00000000-00002896) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521" -ApplicationType "4"" (UID: 00000000-00004388) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4388 -ip 4388" (UID: 00000000-00006736) Spawned process "WerFault.exe" with commandline "-u -p 4388 -s 2088" (UID: 00000000-00008284) Spawned process "WerFault.exe" with commandline "-u -p 4388 -s 2088" (UID: 00000000-00006240) Spawned process "GoToResolveProcessChecker.exe" with commandline "-Service -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521" -ApplicationType "4"" (UID: 00000000-00006276) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ProcessCheckerCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x7fc,0x7d4,0x7d0,0x724,0x804,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00001084) Spawned process "GoToResolveUnattended.exe" with commandline ""-RegisteredProcess" "1" "-ParentProcessId" "6276" "-InstallationId" "H6l9SRwVhM" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_1600971844239445521" "-Service" "-LogLevel" "2"" (UID: 00000000-00007876) Spawned process "GoToResolveLoggerProcess.exe" with commandline "-ParentProcessId 7876 -CompanyId 1600971844239445521 -InstallationId H6l9SRwVhM -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521" -Environment Production -ApplicationType 4 -HostId 9f9bc5fc91db7ab1a784cca5210db5ad -LogLevel 2 -SessionType Unattended" (UID: 00000000-00007776) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveUnattended.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json" "--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x754,0x73c,0x738,0x7a4,0x758,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00004296) Spawned process "GoToResolveExternalModuleHandler.exe" with commandline "-InstallationId H6l9SRwVhM -CompanyId 1600971844239445521 -publickey 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 -LogLevel 2 -Environment Production" (UID: 00000000-00008624) Spawned process "GoToResolveFileManager.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -InstallationId H6l9SRwVhM -LogLevel 2" (UID: 00000000-00003268) Spawned process "GoToResolveQuickView.exe" with commandline "-InstallationId H6l9SRwVhM -LogLevel 2 -Environment Production" (UID: 00000000-00007756) Spawned process "GoToResolveTerminal.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -InstallationId H6l9SRwVhM -LogLevel 2" (UID: 00000000-00008956) Spawned process "GoToResolveServiceManager.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -InstallationId H6l9SRwVhM -LogLevel 2" (UID: 00000000-00002548) Spawned process "GoToResolveRemoteControl.exe" with commandline "-CompanyId 1600971844239445521 -InstallationId H6l9SRwVhM -WorkFolder "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 1" (UID: 00000000-00002608) Spawned process "GoToResolveRegistryEditor.exe" with commandline "-CompanyId 1600971844239445521 -Environment Production -InstallationId H6l9SRwVhM -LogLevel 2" (UID: 00000000-00007952) Spawned process "GoToResolveNetworkChecker.exe" with commandline "-BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId H6l9SRwVhM -CompanyId 1600971844239445521 -Environment Production" (UID: 00000000-00003704) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveLoggerProcess.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\logger.json" "--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\LoggerProcessCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x760,0x764,0x768,0x73c,0x774,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00004724) Spawned process "GoToResolveUnattendedUi.exe" with commandline ""-CompanyId" "1600971844239445521" "-InstallationId" "H6l9SRwVhM" "-WorkFolder" "%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"" (UID: 00000000-00003884) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ExternalModuleHandlerCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x778,0x77c,0x780,0x6bc,0x784,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00006464) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveRemoteControl.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveRemoteControl.log" "--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RemoteControlCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x7cc,0x7d0,0x7d4,0x6ec,0x7d8,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00008016) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\QuickViewCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x7bc,0x7c0,0x7c4,0x5e4,0x7c8,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00000984) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\FileManagerCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x85c,0x860,0x864,0x7b4,0x868,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00008616) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\NetworkCheckerCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x7c4,0x7c8,0x7cc,0x7a0,0x7d0,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00002572) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\TerminalCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x868,0x86c,0x870,0x7c0,0x874,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00008804) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--attachment=attachment_GoToResolveUnattendedUi.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json" "--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedUiCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x7b0,0x7b4,0x7b8,0x6f0,0x7bc,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00003708) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ServiceManagerCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x868,0x86c,0x870,0x84c,0x874,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00007920) Spawned process "GoToResolveCrashHandler.exe" with commandline ""--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RegistryEditorCrashReportDB" "--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=H6l9SRwVhM --annotation=version=1.27.1.3232 --initial-client-data=0x874,0x878,0x87c,0x84c,0x880,0x6fdf6fac,0x6fdf6fbc,0x6fdf6fcc" (UID: 00000000-00003576) Spawned process "sc.exe" with commandline "start GoToResolve_1600971844239445521" (UID: 00000000-00004044)89:T5b3,Found string "extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "could not build approximate chain for newly enrolled cert, resorting to received extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "OSSL_CMP_CTX_get1_extraCertsIn" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "OSSL_CMP_CTX_set1_extraCertsOut" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "ossl_cmp_msg_add_extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "no acceptable cert in extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "normal mode failed; trying now 3GPP mode trusting extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "no self-issued extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "self-issued extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp") Found string "received CMP message contains more than 10 extraCerts" (Indicator: "tracert"; Source: "00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp")8a:T692,YARA signature to detect medium entropy file file "LMISupportM32.exe" YARA signature to detect medium entropy file process "00000000-00004408" YARA signature to detect medium entropy file file "GoToResolveLoggerProcess.exe" YARA signature to detect medium entropy file process "00000000-00008984" YARA signature to detect medium entropy file file "libcrypto-3.dll" YARA signature to detect medium entropy file file "GoToResolveUnattendedRemover.exe" YARA signature to detect medium entropy file file "FileManager.dll" YARA signature to detect medium entropy file file "GoToResolveUnlock32.dll" YARA signature to detect medium entropy file file "GoToResolveExternalModuleHandler.exe" YARA signature to detect medium entropy file file "GoToResolveQuickView.exe" YARA signature to detect medium entropy file file "GoToResolveCrashHandler.exe" YARA signature to detect medium entropy file process "00000000-00004172" YARA signature to detect medium entropy file file "g2rvdd.dll" YARA signature to detect medium entropy file process "00000000-00006156" YARA signature to detect medium entropy file file "GoToResolveRemoteControl.exe" YARA signature to detect medium entropy file process "00000000-00008264" YARA signature to detect medium entropy file file "LMIInputHook64.dll" YARA signature to detect medium entropy file process "00000000-00008628" YARA signature to detect medium entropy file file "GoToResolveProcessChecker.exe" YARA signature to detect medium entropy file file "LMIFilterHook64.dll" YARA signature to detect medium entropy file file "GoToResolveNetworkChecker.exe" YARA signature to detect medium entropy file file "GoToResolveFileManager.exe"8b:T70e,YARA signature for RC4 encryption matched on file "LMISupportM32.exe" YARA signature for RC4 encryption matched on file "libssl-3-x64.dll" YARA signature for RC4 encryption matched on process "00000000-00004408" YARA signature for RC4 encryption matched on file "GoToResolveLoggerProcess.exe" YARA signature for RC4 encryption matched on file "libcrypto-3.dll" YARA signature for RC4 encryption matched on file "GoToResolveUnattendedRemover.exe" YARA signature for RC4 encryption matched on file "FileManager.dll" YARA signature for RC4 encryption matched on file "GoToResolveUnlock32.dll" YARA signature for RC4 encryption matched on file "libssl-3.dll" YARA signature for RC4 encryption matched on file "GoToResolveExternalModuleHandler.exe" YARA signature for RC4 encryption matched on file "GoToResolveQuickView.exe" YARA signature for RC4 encryption matched on file "GoToResolveCrashHandler.exe" YARA signature for RC4 encryption matched on file "g2rvdd.dll" YARA signature for RC4 encryption matched on file "GoToResolveRemoteControl.exe" YARA signature for RC4 encryption matched on process "00000000-00008628" YARA signature for RC4 encryption matched on file "LMISupport7x64.dll" YARA signature for RC4 encryption matched on file "GoToResolveProcessChecker.exe" YARA signature for RC4 encryption matched on file "GoToResolveNetworkChecker.exe" YARA signature for RC4 encryption matched on file "GoToResolveFileManager.exe" YARA signature for RC4 encryption matched on file "sample.bin" YARA signature for RC4 encryption matched on file "lmiscrhook64.dll" YARA signature for RC4 encryption matched on file "GoToResolveUnattended.exe" YARA signature for RC4 encryption matched on process "00000000-00006156" YARA signature for RC4 encryption matched on file "lmiscrhook32.dll"8c:T741,YARA signature matched on R0R instruction used in file "LMISupportM32.exe" YARA signature matched on R0R instruction used in file "libssl-3-x64.dll" YARA signature matched on R0R instruction used in file "GoToResolveLoggerProcess.exe" YARA signature matched on R0R instruction used in file "libcrypto-3.dll" YARA signature matched on R0R instruction used in file "GoToResolveUnattendedRemover.exe" YARA signature matched on R0R instruction used in file "FileManager.dll" YARA signature matched on R0R instruction used in file "GoToResolveUnlock32.dll" YARA signature matched on R0R instruction used in file "libssl-3.dll" YARA signature matched on R0R instruction used in file "GoToResolveExternalModuleHandler.exe" YARA signature matched on R0R instruction used in file "GoToResolveQuickView.exe" YARA signature matched on R0R instruction used in file "GoToResolveCrashHandler.exe" YARA signature matched on R0R instruction used in file "g2rvdd.dll" YARA signature matched on R0R instruction used in file "GoToResolveRemoteControl.exe" YARA signature matched on R0R instruction used in file "LMIInputHook64.dll" YARA signature matched on R0R instruction used in file "LMISupport7x64.dll" YARA signature matched on R0R instruction used in file "GoToResolveProcessChecker.exe" YARA signature matched on R0R instruction used in file "LMIFilterHook64.dll" YARA signature matched on R0R instruction used in file "GoToResolveNetworkChecker.exe" YARA signature matched on R0R instruction used in file "GoToResolveFileManager.exe" YARA signature matched on R0R instruction used in file "lmiscrhook64.dll" YARA signature matched on R0R instruction used in file "GoToResolveUnattended.exe" YARA signature matched on R0R instruction used in file "lmiscrhook32.dll" YARA signature matched on R0R instruction used in file "GoToResolveUnlock64.dll"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791551309589,"unified_at":"2026-10-09T13:08:29.589Z","metadata":{"hashes":{"sha256":"77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e","sha1":"b478f2279777f5b399d733c01e6ac49526e736bf","md5":"11c4be3afdb16bfffb843567d74846cb","sha512":"96b7875ce7b280a14558d4aec0a76413001b40e38bd10954f0d7519381b7d7ff5fd08a8579bd4f8a805063af31ed9da6739e7f83d48bc166d1113d756cb7bdae","ssdeep":"393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpD:q9WtLzgOTbjZvk/ekS/mcpD","ssdeep_chunks":["393216:sIGdBtI","393216:IGdBtID","393216:GdBtIDi","393216:dBtIDiC","393216:BtIDiCq","393216:tIDiCqW","393216:IDiCqWt","393216:DiCqWtL","393216:iCqWtLx","393216:CqWtLxX","393216:qWtLxXB","393216:WtLxXBi","393216:tLxXBi1","393216:LxXBi1/","393216:xXBi1/6","393216:XBi1/62","393216:Bi1/62O","393216:i1/62Oc","393216:1/62Ocw","393216:/62Ocwf","393216:62Ocwf2","393216:2Ocwf2o","393216:Ocwf2o0","393216:cwf2o0b","393216:wf2o0b8","393216:f2o0b8M","393216:2o0b8MA","393216:o0b8MAN","393216:0b8MANH","393216:b8MANHj","393216:8MANHjL","393216:MANHjLi","393216:ANHjLiB","393216:NHjLiB/","393216:HjLiB/e","393216:jLiB/ek","393216:LiB/ekS","393216:iB/ekS/","393216:B/ekS/m","393216:/ekS/md","393216:ekS/mdV","393216:kS/mdVh","393216:S/mdVhR","393216:/mdVhRe","393216:mdVhReX","393216:dVhReXp","393216:VhReXpD","786432:sIGdBtI","786432:IGdBtID","786432:GdBtIDi","786432:dBtIDiC","786432:BtIDiCq","786432:tIDiCqW","786432:IDiCqWt","786432:DiCqWtL","786432:iCqWtLx","786432:CqWtLxX","786432:qWtLxXB","786432:WtLxXBi","786432:tLxXBi1","786432:LxXBi1/","786432:xXBi1/6","786432:XBi1/62","786432:Bi1/62O","786432:i1/62Oc","786432:1/62Ocw","786432:/62Ocwf","786432:62Ocwf2","786432:2Ocwf2o","786432:Ocwf2o0","786432:cwf2o0b","786432:wf2o0b8","786432:f2o0b8M","786432:2o0b8MA","786432:o0b8MAN","786432:0b8MANH","786432:b8MANHj","786432:8MANHjL","786432:MANHjLi","786432:ANHjLiB","786432:NHjLiB/","786432:HjLiB/e","786432:jLiB/ek","786432:LiB/ekS","786432:iB/ekS/","786432:B/ekS/m","786432:/ekS/md","786432:ekS/mdV","786432:kS/mdVh","786432:S/mdVhR","786432:/mdVhRe","786432:mdVhReX","786432:dVhReXp","786432:VhReXpD","393216:q9WtLzg","393216:9WtLzgO","393216:WtLzgOT","393216:tLzgOTb","393216:LzgOTbj","393216:zgOTbjZ","393216:gOTbjZv","393216:OTbjZvk","393216:TbjZvk/","393216:bjZvk/e","393216:jZvk/ek","393216:Zvk/ekS","393216:vk/ekS/","393216:k/ekS/m","393216:/ekS/mc","393216:ekS/mcp","393216:kS/mcpD"],"imphash":"f8e4a22bcb1b836585534b93f63c1414"},"file_info":{"file_name":"DamicoStockstillPolicy.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":24446944,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1761241841000,"last_seen":1771849744000,"last_multi_scan":1771849744000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","rat"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":107},"sandbox_signatures":{"informative_count":309,"suspicious_count":26,"malicious_count":14,"total":349},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Unwanted/Win.LogMeIn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AVI.Agent.eifri","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Scam.LConnect.AE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win32_LogMeIn_C_trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/LogMeIn.C trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Risk.Win32.RemoteAdmin.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d23bc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusC.HLF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.LogMeIn.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Application.Scam.LConnect","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Starts service using SC.exe"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"malicious","value":"Contains ability to change service configuration"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"},{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - Cyclic XOR decryption routine for 64-bit samples"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Calls an API typically used to performs encryption on the data"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Safe Mode Boot","attack_id":"T1562.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/009","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"},{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy file"},{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"suspicious","value":"Tries to retrieve system manufacturer/productname details"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"suspicious","value":"Calls an API typically used to enumerate services"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Observed system process names in POST request"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Imports crypto-related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to schedule tasks using COM objects"}],"sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"DamicoStockstillPolicy.exe\")\n Found string \"stopAndDeleteService\" (File: \"DamicoStockstillPolicy.exe\")\n Found string \"common::serviceutils::deleteServiceEntry\" (File: \"DamicoStockstillPolicy.exe\")\n Found string \"{\"time\":\"2026-02-23T12:31:24.979\",\"utcTime\":\"2026-02-23T20:31:24.979\",\"processId\":\"2896\",\"threadId\":\"Main\",\"level\":\"info\",\"app\":\"ProcessChecker\",\"facility\":\"stopAndDeleteService\",\"message\":\"stop and remove service entry\",\"sessionId\":\"\"}\" (Source: \"00000000-00002896.00000001.129761.05E06000.00000004.mdmp\")\n file/memory contains long string(Source: \"00000000-00002896.00000001.129761.05E06000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"DamicoStockstillPolicy.exe\" called \"FindResourceW\" with parameter \"32000\" - (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"DamicoStockstillPolicy.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '10314088'}\" (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00002896.00000001.129761.6F3F2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 723C0000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 723C0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"GoToResolveTools64.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5CF3.tmp\" to \"%TEMP%\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\g2rvdd.cat\"\n \"GoToResolveTools64.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5D42.tmp\" to \"%TEMP%\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\g2rvdd.dll\"\n \"GoToResolveTools64.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5D62.tmp\" to \"%TEMP%\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\g2rvdd.inf\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00006736]\n Process \"WerFault.exe\" [UID: 00000000-00008284]\n Process \"WerFault.exe\" [UID: 00000000-00006240]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"::NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found reference to API \"NtQueryInformationProcess incorrect size\" (Indicator: \"NtQueryInformationProcess\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-61-00637C9C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-63-006331DA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-2056-005F6580\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-2073-005F7450\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-2074-0062E6B0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-2238-00633D55\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007476-24058-2886-00633EDB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CertDeleteCertificateFromStore\" (Indicator: \"CertDeleteCertificateFromStore\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002896.00000001.129761.031FF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"No public key found, can not store it.\" (Indicator: \"public key\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002896.00000000.128360.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.03140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: DamicoStockstillPolicy.exe]\n Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: GoToResolveTools64.exe]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: GoToResolveTools64.exe]\n Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: GoToResolveTools32.exe]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: GoToResolveTools32.exe]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found reference to API \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetLogicalDrives\" (Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"NtQuerySystemInformation SystemExtendedHandleInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found string \"::NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\GoTo Resolve Unattended\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\GoTo Resolve Unattended 1600971844239445521\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002896.00000001.129761.03229000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"DamicoStockstillPolicy.exe\")\n file/memory contains long string with (Indicator: \"WTSEnumerateProcesses\"; File: \"LMISupportM32.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007224-00000C2C-932272480\")\n Found reference to API \"WTSEnumerateProcessesW\" (Indicator: \"WTSEnumerateProcesses\"; Source: \"00000000-00007224-00000C2C-932272520\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007224-00000C2C-932272651\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007224-00000C2C-932116315\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"LMISupportM32.exe\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"DamicoStockstillPolicy.exe\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"LMISupportM32.exe\")\n file/memory contains long string with (Indicator: \"postmessage\"; File: \"lmiscrhook64.dll\")\n file/memory contains long string with (Indicator: \"postmessage\"; File: \"lmiscrhook32.dll\")\n Found reference to API \"WTSSendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007224-00000C2C-932272614\")\n Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"00000000-00007224-00000C2C-937825057\")\n Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"GoToResolveUnattended.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007224)\n \"GoToResolveProcessChecker.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002896)\n \"GoToResolveProcessChecker.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004388)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"DamicoStockstillPolicy.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004960)\n \"DamicoStockstillPolicy.exe\" called \"EnumServicesStatusW\" with parameters (UID: 00000000-00004960)\n \"DamicoStockstillPolicy.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"DamicoStockstillPolicy.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"GoToResolveUnattended.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"DamicoStockstillPolicy.exe\" called \"IsWow64Process\" with parameter \"4960\" - (UID: 00000000-00004960)\n \"GoToResolveUnattended.exe\" called \"IsWow64Process\" with parameter \"7224\" - (UID: 00000000-00007224)\n \"GoToResolveProcessChecker.exe\" called \"IsWow64Process\" with parameter \"2896\" - (UID: 00000000-00002896)\n \"GoToResolveProcessChecker.exe\" called \"IsWow64Process\" with parameter \"4388\" - (UID: 00000000-00004388)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"GoToResolveUnattended.exe\" called \"EnumWindows\" with parameter \"107345284\" - (UID: 00000000-00007224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"DamicoStockstillPolicy.exe\" called \"GetWindowTextW\" (UID: 00000000-00004960)\n \"DamicoStockstillPolicy.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"DamicoStockstillPolicy.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004960)\n \"GoToResolveUnattended.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007224)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"GoToResolveUnattended.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007224)\n \"GoToResolveProcessChecker.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004388)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: PasswordPrivacyDll.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"::IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00007476-24058-659-006580B0\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007476-24058-1635-00657810\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007476-24058-2343-0064EB86","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00007476-24058-1710-00662840\n GetDriveTypeW@KERNEL32.DLL at 00000000-00007476-24058-1724-00664503","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007476-24058-603-0065B730\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007476-24058-761-0063D338\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00007476-24058-1729-00662491\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007476-24058-2253-00633C4E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00007476-24058-556-005FB0A0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007476-24058-603-0065B730\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007476-24058-761-0063D338\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007476-24058-2253-00633C4E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007476-24058-1021-00621470\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007476-24058-2431-0064E4E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00007476-24058-162-0065C830\n GetVersion@KERNEL32.DLL at 00000000-00007476-24058-2065-00602450","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007476-24058-400-00648E4E\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007476-24058-408-00648938\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-24058-418-00648E0F\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007476-24058-456-0065216C\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007476-24058-457-00651AA0\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007476-24058-458-00651B86\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-24058-460-00651F8A\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00007476-24058-461-00651AEB\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00007476-24058-874-006296A0\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-24058-2455-006519FF\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-24058-2458-00651C13\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-24058-2459-00652090\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007476-24058-2460-00651E67","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$37","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00007476-24058-1037-00620610\n GetSystemInfo@KERNEL32.DLL at 00000000-00007476-24058-1038-00620590\n GetSystemInfo@KERNEL32.DLL at 00000000-00007476-24058-1265-0065A750\n GetSystemInfo@KERNEL32.DLL at 00000000-00007476-24058-2483-0066181B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"EnumDesktopsW\" (Indicator: \"EnumDesktops\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007476-24058-696-006529A0\n OpenProcess@KERNEL32.DLL at 00000000-00007476-24058-768-0062E8C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 06h\" and \"jc 0065C8C3h\" at 00000000-00007476-24058-162-0065C830\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 06h\" and \"jc 00602488h\" at 00000000-00007476-24058-2065-00602450\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0064E613h\" at 00000000-00007476-24058-2431-0064E4E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\1600971844239445521\\PASSWORDPRIVACYDLL.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\1600971844239445521\\FILEMANAGER.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\1600971844239445521\\LIBCRYPTO-3.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\1600971844239445521\\MEDIACLIENTLIB.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\1600971844239445521\\LIBGOTORESOLVE.DLL\n %PROGRAMFILES%\\(X86)\\GOTO RESOLVE UNATTENDED\\1600971844239445521\\LIBSSL-3.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"GoToResolveUnattended.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"GoToResolveUnattended.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"GoToResolveTools64.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"GoToResolveTools64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")\n \"GoToResolveProcessChecker.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"GoToResolveProcessChecker.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{45F5205B-FA7A-11ED-8886-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DamicoStockstillPolicy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GoToResolveUnattended.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GoToResolveTools64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"GoToResolveUnattended.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"DamicoStockstillPolicy.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOTO RESOLVE UNATTENDED 1600971844239445521\")\n \"GoToResolveUnattended.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GOTORESOLVEPROCESSCHECKER.EXE\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOTO RESOLVE UNATTENDED 1600971844239445521\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"GoToResolveUnattended.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed RMM Domain (gotoresolve .com in TLS SNI)\" (SID: 2061992, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"DamicoStockstillPolicy.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"DamicoStockstillPolicy.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"DamicoStockstillPolicy.exe\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"LMISupportM32.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"LMISupport7x32.dll\")\n file/memory contains long string(File: \"LMISupportM32.exe\")\n file/memory contains long string(File: \"lmiscrhook64.dll\")\n file/memory contains long string(File: \"lmiscrhook32.dll\")\n file/memory contains long string(File: \"LMIFilterHook64.dll\")\n file/memory contains long string(File: \"LMIInputHook64.dll\")\n file/memory contains long string(File: \"g2rvdd.dll\")\n file/memory contains long string(File: \"LMIFilterHook32.dll\")\n file/memory contains long string(File: \"LMIInputHook32.dll\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"GoToResolveProcessChecker.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"GoToResolveTools64.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\crashpad_8124_CGQPYKAUWSOLNCUS\" - (UID: 00000000-00008124)\n \"GoToResolveCrashHandler.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\crashpad_8124_CGQPYKAUWSOLNCUS\" - (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip.zscaler.com\"\n \"devices.console.gotoresolve.com\"\n \"dumpster.console.gotoresolve.com\"\n \"devices-iot.console.gotoresolve.com\"\n \"sessions.console.gotoresolve.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"34.227.241.213:443\"\n \"3.220.211.99:443\"\n \"52.223.22.206:80\"\n \"52.203.239.94:443\"\n \"54.86.104.58:443\"\n \"52.5.70.3:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\a\\rescue-native-rescueassist\\rescue-native-rescueassist\\build\\RelWithDebInfo\\GoToResolveUnattendedUpdater.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00007476-24058-2065-00602450","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00007476-24058-166-0063318C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-24058-1884-00602CB0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-24058-1891-00602950\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-24058-1924-00600530\n WaitForSingleObject@KERNEL32.DLL at 00000000-00007476-24058-2115-00600620\n SleepEx@KERNEL32.DLL at 00000000-00007476-24058-2824-0062FFF5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: DamicoStockstillPolicy.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libcrypto-3.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: GoToResolveTools64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PasswordPrivacyDll.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: GoToResolveTools32.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00007476-24058-164-00602410\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007476-24058-2301-00637922\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007476-24058-2378-00648C52\n LoadLibraryExA@KERNEL32.DLL at 00000000-00007476-24058-2493-006619D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ShellExecute failed: {}\" (Indicator: \"ShellExecute\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"bool __thiscall crashpad::PEImageResourceReader::FindResourceByID(unsigned short,unsigned short,unsigned short,unsigned __int64 *,unsigned __int64 *,unsigned int *) const\" (Indicator: \"FindResource\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenProcess failed with error:\" (Indicator: \"OpenProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$44","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: DamicoStockstillPolicy.exe)\n Found MoveFileExW in import section (Source: GoToResolveTools64.exe)\n Found MoveFileExW in import section (Source: GoToResolveTools32.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$46","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$47","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$48","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$49","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\crashpad_%lu_\n Found string - \\\\.\\pipe\\crashpad_8124_CGQPYKAUWSOLNCUS","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"DamicoStockstillPolicy.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 739F0000\n \"DamicoStockstillPolicy.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E00000\n \"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 739F0000\n \"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E00000\n \"GoToResolveTools64.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 9EA70000\n \"GoToResolveTools64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 9F190000\n \"GoToResolveCrashHandler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E00000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 739F0000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DamicoStockstillPolicy.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"GoToResolveUnattended.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"GoToResolveTools64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at A1810000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"GoToResolveCrashHandler.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000\n \"GoToResolveProcessChecker.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75D40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"leavebehind-update-new-application-extracted\"; Source: \"00000000-00002896.00000001.129761.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.031D7000.00000004.mdmp, 00000000-00002896.00000001.129761.031FF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$4f","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$50","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-3-x64.dll\" : \"491\" [Source: libssl-3-x64.dll]\n Observed large number of imported APIs from \"libcrypto-3.dll\" : \"491\" [Source: libssl-3.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$51","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$52","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x117600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x15dbe00\" greater than 0x100000\n Raw size of \".text\" is \"0x334e00\" greater than 0x100000\n Raw size of \".text\" is \"0x109800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x11755c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x15dbc98\" greater than 0x100000\n Virtual size of \".text\" is \"0x334cd8\" greater than 0x100000\n Virtual size of \".text\" is \"0x10970c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"libssl-3-x64.dll\" has high imagebase \"0x180000000\"\n \"GoToResolveTools64.exe\" has high imagebase \"0x140000000\"\n \"GoToResolveUnlock64.dll\" has high imagebase \"0x180000000\"\n \"LMISupport7x64.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\cmd.exe\" [Source: 00000000-00004960-00000BC0-922941459]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\cmd.exe\" [Source: 00000000-00004960-00000BC0-922943039]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00003824-00000BC0-923416545]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\timeout.exe\" [Source: 00000000-00003824-00000BC0-926213521]\n Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00003824-00000BC0-926216914]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"devices-iot.console.gotoresolve.com\"\n \"devices.console.gotoresolve.com\"\n \"dumpster.console.gotoresolve.com\"\n \"ip.zscaler.com\"\n \"sessions.console.gotoresolve.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"GoToResolveUnattended.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$54","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"DamicoStockstillPolicy.exe\" searching for window \"LogMeIn Resolve Unattended\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$58","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET / HTTP/1.1\nHost: devices-iot.console.gotoresolve.com\nContent-Length: 0\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$59","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"GoToResolveTools64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5CF3.tmp\"\n \"GoToResolveTools64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5D42.tmp\"\n \"GoToResolveTools64.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5D62.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"DamicoStockstillPolicy.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GoToResolveUnattended.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"GoToResolveTools64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"g2rvdd.inf\" has type \"Windows setup INFormation\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$5c","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"DamicoStockstillPolicy.exe\" queries basic process information of the \"C:\\DamicoStockstillPolicy.exe\" (UID: 4960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"DamicoStockstillPolicy.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\"\n \"DamicoStockstillPolicy.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\"\n \"DamicoStockstillPolicy.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\tzres.dll.mui\"\n \"DamicoStockstillPolicy.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\KERNELBASE.dll.mui\"\n \"DamicoStockstillPolicy.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\externalmodules\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"DamicoStockstillPolicy.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\goto resolve installer\\goto0001.tmp\\unattendedupdater.log\"\n \"DamicoStockstillPolicy.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\goto resolve installer\\goto0001.tmp\\unattendedupdater.csv\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"DamicoStockstillPolicy.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\GoTo Resolve Installer\\GoTo0001.tmp\\UnattendedUpdater.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"GoToResolveUnattended.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"32d7c00\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"GoToResolveUnattended.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"32c0560\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2bae288\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2bcb1d0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"GoToResolveUnattended.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32d7c00\"\n \"lpReserved\": \"0\"}\n \"GoToResolveUnattended.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"32c0560\"\n \"lpReserved\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2bae288\"\n \"lpReserved\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2bcb1d0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"GET /properties\"\n Found http requests in header \"POST /api/sendEventsV2\"\n Found http requests in header \"GET /api/live\"\n Found http requests in header \"GET /api/health\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"--%s%sContent-Disposition: form-data; name=\"%s\"\"; File: \"00000000-00007476.00000000.127481.005F1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"2.5.29.31\"\n Potential IP \"1.2.13.1\" found in string \"1.2.13.1-motley\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.4.3\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.10\"\n \"2.5.29.17\"\n \"2.5.4.6\"\n \"2.5.4.10\"\n \"2.5.4.7\"\n \"2.5.4.5\"\n \"2.5.4.8\"\n \"2.5.4.15\"\n \"127.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$68","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$69","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$6a","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$6b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"ip.zscaler.com\" has high entropy\n Contacted domain: \"dumpster.console.gotoresolve.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: GoToResolveTools64.exe]\n Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: GoToResolveTools32.exe]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://s\"\n Found HTTPS url \"https://dumpster.console.gotoresolve.com\"\n Found HTTPS url \"https://dumpster.dev01\"\n Found HTTPS url \"https://support.microsoft.com\"\n Found HTTPS url \"https://crashpad.chromium.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://devices.console.gotoresolve.com/properties\n Found HTTPS POST request to https://dumpster.console.gotoresolve.com/api/sendEventsV2\n Found HTTPS GET request to https://dumpster.console.gotoresolve.com/api/live\n Found HTTPS GET request to https://devices-iot.console.gotoresolve.com/\n Found HTTPS GET request to https://sessions.console.gotoresolve.com/api/health","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.227.241.213\" on port \"443\"\n HTTPS traffic to \"3.220.211.99\" on port \"443\"\n HTTPS traffic to \"52.203.239.94\" on port \"443\"\n HTTPS traffic to \"54.86.104.58\" on port \"443\"\n HTTPS traffic to \"52.5.70.3\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on file \"libcrypto-3-x64.dll\"\n YARA signature for AES encryption matched on file \"PasswordPrivacyDll.dll\"\n YARA signature for AES encryption matched on process \"00000000-00007224\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$6c","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: GoToResolveTools64.exe]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: GoToResolveTools32.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"GoToResolveUnattended.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"DamicoStockstillPolicy.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GoToResolveUnattended.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GoToResolveTools64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GoToResolveCrashHandler.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"GoToResolveProcessChecker.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"GoToResolveUnattended.exe\" called \"GetComputerNameW\" (UID: 00000000-00007224)\n \"GoToResolveTools64.exe\" called \"GetComputerNameW\" (UID: 00000000-00008124)\n \"GoToResolveProcessChecker.exe\" called \"GetComputerNameW\" (UID: 00000000-00004388)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"GoToResolveUnattended.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"GoToResolveTools64.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"GoToResolveProcessChecker.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"GoToResolveUnattended.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"GoToResolveProcessChecker.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"GoToResolveUnlock64.dll\" contains export function called \"DllGetClassObject\" at ordinal 12\n \"GoToResolveUnlock32.dll\" contains export function called \"DllGetClassObject\" at ordinal 12","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"health-elevation-username-or-password-incorrect\" (Indicator: \"password\"; Source: \"00000000-00002896.00000001.129761.03140000.00000004.mdmp, 00000000-00002896.00000001.129761.031D7000.00000004.mdmp, 00000000-00002896.00000001.129761.031FF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\GoTo Resolve Unattended\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: DamicoStockstillPolicy.exe\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: DamicoStockstillPolicy.exe\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: DamicoStockstillPolicy.exe\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\GoTo Resolve Unattended 1600971844239445521\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00002896.00000001.129761.03229000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"Successfully added HostName ({}) to Crash Handler\" (Indicator: \"hostname\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002896.00000001.129761.6F3D5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"GoToResolveTools64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\"; Key: \"CLASS\")\n \"GoToResolveTools64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\"; Key: \"NOUSECLASS\")\n \"GoToResolveTools64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\"; Key: \"NOINSTALLCLASS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"sc.exe.bin\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExA\" in file \"DamicoStockstillPolicy.exe\"\n Found registry deletion API: \"RegDeleteTreeA\" in file \"DamicoStockstillPolicy.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"DamicoStockstillPolicy.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"DamicoStockstillPolicy.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"OpenProcess failed with error:\" (Indicator: \"OpenProcess\"; File: \"DamicoStockstillPolicy.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"LMISupportM32.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: DamicoStockstillPolicy.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: DamicoStockstillPolicy.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: DamicoStockstillPolicy.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: GoToResolveTools64.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: PasswordPrivacyDll.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: GoToResolveTools32.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: GoToResolveCrashHandler.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$75","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"format specifier requires numeric argument\" (Indicator: \"format \"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"::InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"::UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"InitializeProcThreadAttributeList (size) succeeded, expected failure\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"InitializeProcThreadAttributeList (size)\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: DamicoStockstillPolicy.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004388.00000000.129182.003A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DamicoStockstillPolicy.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"56C1A02B03A5DC010000000000000000000000000200000000\")\n \"GoToResolveUnattended.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"GoToResolveTools64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"GoToResolveProcessChecker.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$78","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"GoToResolveUnattended.exe\" opened \"\\Device\\KsecDD\"\n \"GoToResolveCrashHandler.exe\" opened \"\\Device\\KsecDD\"\n \"GoToResolveProcessChecker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$79","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$7a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"DamicoStockstillPolicy.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"DamicoStockstillPolicy.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002896.00000001.129761.70A5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5 has high entropy\"\n \"0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$7b","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$7d","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"DamicoStockstillPolicy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"GoToResolveUnattended.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"GoToResolveCrashHandler.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"GoToResolveProcessChecker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"DamicoStockstillPolicy.exe\" has section name .rsrc with entropy \"7.999987714291008\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"$7e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/26 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$7f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"GoToResolveUnattended.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$80","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$81","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.227.241.213 on port 443 is sent without HTTP header\n TCP traffic to 3.220.211.99 on port 443 is sent without HTTP header\n TCP traffic to 52.223.22.206 on port 80 is sent without HTTP header\n TCP traffic to 52.203.239.94 on port 443 is sent without HTTP header\n TCP traffic to 54.86.104.58 on port 443 is sent without HTTP header\n TCP traffic to 52.5.70.3 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3-x64.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3-x64.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"$82","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on Chacha20 instruction used in file \"libcrypto-3.dll\"\n YARA signature matched on AES instruction used in file \"FileManager.dll\"\n YARA signature matched on AES instruction used in file \"libcrypto-3-x64.dll\"\n YARA signature matched on Chacha20 instruction used in file \"libcrypto-3-x64.dll\"\n YARA signature matched on Chacha20 instruction used in process \"00000000-00007224\"\n YARA signature matched on AES instruction used in file \"MediaClientLib.dll\"\n YARA signature matched on Chacha20 instruction used in process \"00000000-00008124\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"DamicoStockstillPolicy.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"19010891\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"DamicoStockstillPolicy.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"101091d\"\n \"cx\": \"350\"\n \"cy\": \"102\"}\n \"DamicoStockstillPolicy.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"19010a3b\"\n \"cx\": \"68\"\n \"cy\": \"23\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate services","description":"\"DamicoStockstillPolicy.exe\" called \"EnumServicesStatusW\" with parameters {\"hSCManager\": \"41cea20\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"3\"}\n \"DamicoStockstillPolicy.exe\" called \"EnumServicesStatusW\" with parameters {\"hSCManager\": \"41ce7c8\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"3\"}\n \"GoToResolveProcessChecker.exe\" called \"EnumServicesStatusExW\" with parameters {\"hSCManager\": \"4622b08\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"3\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-174","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"DamicoStockstillPolicy.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"20000000e0e10b06\"\n \"szDataDescr\": \"0\"\n \"pDataOut\": \"06010000d8f30806\"\n \"$datain\": \"0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00007476-24058-1948-005FDC60\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00007476-24058-2341-006450A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to retrieve system manufacturer/productname details","description":"\"GoToResolveUnattended.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMPRODUCTNAME\")\n \"GoToResolveUnattended.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMMANUFACTURER\")\n \"GoToResolveTools64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMPRODUCTNAME\")\n \"GoToResolveTools64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SYSTEMINFORMATION\"; Key: \"SYSTEMMANUFACTURER\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-115","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$83","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"GoToResolveUnattended.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$84","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$85","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"GoToResolveUnattended.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe\" -regsvc -expectadmin -starterpi\" - (UID: 00000000-00007224)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The digital signature of the object did not verify. (0x80096010)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"DamicoStockstillPolicy.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattended.exe\" (Handle: 804)\n \"GoToResolveUnattended.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe\" (Handle: 2620)\n \"GoToResolveTools64.exe\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe\" (Handle: 932)\n \"GoToResolveTools64.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe\" (Handle: 932)\n \"GoToResolveTools64.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe\" (Handle: 932)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 516)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"Network Related","name":"Observed system process names in POST request","description":"$86","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-57","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$87","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"DamicoStockstillPolicy.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start GoToResolve_1600971844239445521\" (UID: 00000000-00004044)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$88","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"--no-upload-gzip don't use gzip compression when uploading\" (Source: \"00000000-00000936.00000000.281627.00205000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007312.00000000.282493.04AD4000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007312.00000000.282493.05110000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver LogMeIn Resolve\" (Indicator: \"ver \") in Source: 00000000-00000968.00000000.281022.060E0000.00000004.mdmp\n Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00000968.00000000.281022.060E0000.00000004.mdmp\n 00000000-00000968.00000001.281341.060E6000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"void __thiscall crashpad::CrashReportDatabaseWin::CleanOrphanedAttachments(void)\" (Source: \"00000000-00000936.00000000.281627.00205000.00000002.mdmp\")\n Found string \"class crashpad::FileWriter *__thiscall crashpad::CrashReportDatabase::NewReport::AddAttachment(const class std::basic_string,class std::allocator > &)\" (Source: \"00000000-00000936.00000000.281627.00205000.00000002.mdmp\")\n Found string \"void __thiscall crashpad::CrashReportDatabaseWin::CleanOrphanedAttachments(void)\" (Source: \"00000000-00000968.00000000.281022.009C9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00007308.00000001.284215.02D20000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007308.00000001.284215.02D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007308.00000001.284215.02D20000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00007308.00000001.284215.02D20000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00007308.00000001.284215.02D20000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007308.00000001.284215.02D20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"9829977446,6488,3024,,RtlGetVersion,NTDLL.dll,\"01:13:10.390\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000968.00000000.281022.060E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"JordanWolfPymnt.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00008628-13702-1380-0115BC90\n Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00008628-13702-3614-010DA270","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: PasswordPrivacyDll.dll]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$89","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"GoToResolveUnattended.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004500)\n \"GoToResolveProcessChecker.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00004172.00000001.127066.6F9D6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file file \"sample.bin\"\n YARA signature to detect high entropy file process \"00000000-00006156\"\n YARA signature to detect high entropy file process \"00000000-00004172\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"$8a","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$8b","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00006156\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"$8c","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00008628-13702-4187-01097DC0\n FindResourceW@KERNEL32.DLL at 00000000-00008628-13702-4373-010CBC00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"libcrypto-3-x64.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"libcrypto-3-x64.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Cyclic XOR decryption routine for 64-bit samples","description":"YARA signature to detect cyclic XOR decryption routine for 64 bit samples file \"libcrypto-3-x64.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-599","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"cmd.exe\" marked \"C:\\JordanWolfPymnt.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"General","name":"Contains ability to change service configuration","description":"ChangeServiceConfig2W@ADVAPI32.DLL at 00000000-00008628-13702-3553-010E2050\n ChangeServiceConfig2W@ADVAPI32.DLL at 00000000-00008628-13702-3574-010DFDF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543.003","relevance":5,"id":"stream-73","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00000000-00008628-13702-1486-01153C10\n DeviceIoControl@KERNEL32.DLL at 00000000-00008628-13702-1491-01153470\n DeviceIoControl@KERNEL32.DLL at 00000000-00008628-13702-5458-011557CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" classified process \"00000000-00008628\" as \"rat\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQuerySystemInformation@NTDLL.DLL at 00000000-00008628-13702-2917-0111BC90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Reads VM-specific registry key"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 5 domains and 5 hosts"}],"sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]}]},"activity":{"stats":{"process_count":41,"spawned_processes_count":41,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":67,"imported_dlls_count":152,"dropped_files_count":0,"extracted_files_count":49,"files_written_count":101,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":5,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["evasive","rat"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"699c480e5b5b013719037379","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.LogMeIn","contacted_countries":["USA"],"submit_name":"DamicoStockstillPolicy.exe","analysis_start_time":"2026-02-23T12:29:06+00:00","indicators_count":{"informative":287,"suspicious":79,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"69827acef3dca582060fbdb7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.LogMeIn","contacted_countries":["USA"],"submit_name":"DamicoStockstillPolicy.exe","analysis_start_time":"2026-02-03T22:46:41+00:00","indicators_count":{"informative":288,"suspicious":79,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"68fa6aed53693d2cb90adcbd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"JordanWolfPymnt.exe","analysis_start_time":"2025-10-23T17:50:43+00:00","indicators_count":{"informative":258,"suspicious":85,"malicious":10},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.227.241.213","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"address":"3.220.211.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"address":"52.223.22.206","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"address":"52.203.239.94","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"address":"54.86.104.58","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"address":"52.5.70.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"address":"34.194.82.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"address":"54.197.175.181","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"address":"54.225.66.141","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"address":"23.21.219.167","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]}],"dns_resolutions":[{"domain":"devices-iot.console.gotoresolve.com","address":"52.203.239.94","ttl":49,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"domain":"devices.console.gotoresolve.com","address":"3.220.211.99","ttl":46,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"domain":"dumpster.console.gotoresolve.com","address":"34.227.241.213","ttl":42,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"domain":"ip.zscaler.com","address":"52.223.22.206","ttl":38,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"domain":"sessions.console.gotoresolve.com","address":"54.86.104.58","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]}],"http_requests":[{"host":"ip.zscaler.com","host_ip":"52.223.22.206:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: ip.zscaler.com\nContent-Length: 0\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"host":"devices.console.gotoresolve.com","host_ip":"3.220.211.99:443","url":"/properties","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /properties HTTP/1.1\nHost: devices.console.gotoresolve.com\nX-CompanyId: 1600971844239445521\nX-Version: 1.27.1.3232\nX-ZeroTrust-Hash: 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1\nContent-Length: 0\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"host":"dumpster.console.gotoresolve.com","host_ip":"34.227.241.213:443","url":"/api/sendEventsV2","method":"POST","response_code":"202","response_phrase":"Accepted","header":"POST /api/sendEventsV2 HTTP/1.1\nHost: dumpster.console.gotoresolve.com\nContent-Type: application/json\nAuthorization: API-KEY cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3\nContent-Length: 2519\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"host":"dumpster.console.gotoresolve.com","host_ip":"34.227.241.213:443","url":"/api/live","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/live HTTP/1.1\nHost: dumpster.console.gotoresolve.com\nContent-Length: 0\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"host":"sessions.console.gotoresolve.com","host_ip":"54.86.104.58:443","url":"/api/health","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/health HTTP/1.1\nHost: sessions.console.gotoresolve.com\nContent-Length: 0\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}],"processes":[{"pid":968,"ppid":0,"name":"DamicoStockstillPolicy.exe","command_line":"","sha256":"77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e","normalized_path":"C:\\DamicoStockstillPolicy.exe","uid":"00000000-00000968","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":8740,"ppid":968,"name":"GoToResolveUnattended.exe","command_line":"-regsvc","sha256":"3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattended.exe","parent_uid":"00000000-00000968","uid":"00000000-00008740"},{"pid":7312,"ppid":8740,"name":"GoToResolveProcessChecker.exe","command_line":"-regsvc -expectadmin -starterpid 8740 -InstallationId Zjceo22Jn1 -WorkFolder \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" -ApplicationType 4 -Environment \"Production\" -ForceInstall 0","sha256":"7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe","parent_uid":"00000000-00008740","uid":"00000000-00007312"},{"pid":8200,"ppid":8740,"name":"GoToResolveProcessChecker.exe","command_line":"\"-ApplicationType\" \"4\"","sha256":"7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe","parent_uid":"00000000-00008740","uid":"00000000-00008200"},{"pid":8508,"ppid":968,"name":"GoToResolveTools64.exe","command_line":"-InstallVDD","sha256":"bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveTools64.exe","parent_uid":"00000000-00000968","uid":"00000000-00008508"},{"pid":936,"ppid":8508,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=version=1.24.0.142 --initial-client-data=0x38c,0x388,0x398,0x394,0x3a0,0x7ff6135bbaf8,0x7ff6135bbb10,0x7ff6135bbb28","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00008508","uid":"00000000-00000936"},{"pid":4880,"ppid":968,"name":"cmd.exe","command_line":"/S /C \"\"C:\\DamicoStockstillPolicy.exe.cmd\" \"C:\\DamicoStockstillPolicy.exe\"\"","sha256":"678652bb50abb92de91a69c05ea018c160fb4be0902ace14b15749246788cb40","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00000968","uid":"00000000-00004880"},{"pid":524,"ppid":4880,"name":"timeout.exe","command_line":"timeout /T 3","sha256":"42552e5859912c79242bc25ecca5912b10969e1a3e91c68e2521e6fdb9fa998a","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00004880","uid":"00000000-00000524"},{"pid":7308,"ppid":0,"name":"GoToResolveProcessChecker.exe","command_line":"-Service -WorkFolder \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" -ApplicationType \"4\"","sha256":"7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe","uid":"00000000-00007308","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":3308,"ppid":7308,"name":"WerFault.exe","command_line":"-u -p 7308 -s 2056","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007308","uid":"00000000-00003308"},{"pid":6424,"ppid":7308,"name":"WerFault.exe","command_line":"-u -p 7308 -s 2056","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007308","uid":"00000000-00006424"},{"pid":6008,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 468 -p 7308 -ip 7308","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006008","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":8448,"ppid":0,"name":"GoToResolveProcessChecker.exe","command_line":"-Service -WorkFolder \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" -ApplicationType \"4\"","sha256":"7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe","uid":"00000000-00008448","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":7696,"ppid":8448,"name":"WerFault.exe","command_line":"-u -p 8448 -s 1880","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008448","uid":"00000000-00007696"},{"pid":6800,"ppid":8448,"name":"WerFault.exe","command_line":"-u -p 8448 -s 1880","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008448","uid":"00000000-00006800"},{"pid":3676,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 8448 -ip 8448","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003676","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":6112,"ppid":0,"name":"GoToResolveProcessChecker.exe","command_line":"-Service -WorkFolder \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" -ApplicationType \"4\"","sha256":"7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe","uid":"00000000-00006112","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":7952,"ppid":6112,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ProcessCheckerCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ProcessCheckerCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x5c0,0x5d0,0x5e0,0x5a4,0x5d4,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00006112","uid":"00000000-00007952"},{"pid":2572,"ppid":6112,"name":"GoToResolveUnattended.exe","command_line":"\"-RegisteredProcess\" \"1\" \"-ParentProcessId\" \"6112\" \"-InstallationId\" \"Zjceo22Jn1\" \"-WtsStartingSessionId\" \"1\" \"-ServiceName\" \"GoToResolve_1600971844239445521\" \"-Service\" \"-LogLevel\" \"2\"","sha256":"3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattended.exe","parent_uid":"00000000-00006112","uid":"00000000-00002572"},{"pid":1668,"ppid":2572,"name":"GoToResolveLoggerProcess.exe","command_line":"-ParentProcessId 2572 -CompanyId 1600971844239445521 -InstallationId Zjceo22Jn1 -WorkFolder \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" -Environment Production -ApplicationType 4 -HostId be2d492a21aaddd606307bcd63042fd4 -LogLevel 2 -SessionType Unattended","sha256":"ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveLoggerProcess.exe","parent_uid":"00000000-00002572","uid":"00000000-00001668"},{"pid":4176,"ppid":1668,"name":"GoToResolveCrashHandler.exe","command_line":"\"--attachment=attachment_GoToResolveLoggerProcess.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveLoggerProcess.log\" \"--attachment=attachment_logger.json=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\logger.json\" \"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\LoggerProcessCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\LoggerProcessCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x76c,0x770,0x774,0x740,0x778,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00001668","uid":"00000000-00004176"},{"pid":2084,"ppid":2572,"name":"GoToResolveCrashHandler.exe","command_line":"\"--attachment=attachment_GoToResolveUnattended.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveUnattended.log\" \"--attachment=attachment_unattended.json=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json\" \"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x7e8,0x7ec,0x7f0,0x774,0x7f4,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00002572","uid":"00000000-00002084"},{"pid":5932,"ppid":2572,"name":"GoToResolveExternalModuleHandler.exe","command_line":"-InstallationId Zjceo22Jn1 -CompanyId 1600971844239445521 -publickey 0ece7b080cf445e329d79515b611641764322fa3a1d19f21831e3412af4e00a1 -LogLevel 2 -Environment Production","sha256":"d249d6eca804d917db79144c8651b8a21e41a3489d91f7414c5663f0d4f360fd","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveExternalModuleHandler.exe","parent_uid":"00000000-00002572","uid":"00000000-00005932"},{"pid":2792,"ppid":5932,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ExternalModuleHandlerCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ExternalModuleHandlerCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x7b8,0x7bc,0x7c0,0x6c4,0x7c4,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00005932","uid":"00000000-00002792"},{"pid":8272,"ppid":2572,"name":"GoToResolveFileManager.exe","command_line":"-CompanyId 1600971844239445521 -Environment Production -InstallationId Zjceo22Jn1 -LogLevel 2","sha256":"915a69a02ff1e9251b7085fe41c4be05ad7a377d809de3e00c515fc2eae44101","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveFileManager.exe","parent_uid":"00000000-00002572","uid":"00000000-00008272"},{"pid":5752,"ppid":8272,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\FileManagerCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\FileManagerCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x874,0x878,0x87c,0x7c0,0x880,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00008272","uid":"00000000-00005752"},{"pid":9096,"ppid":2572,"name":"GoToResolveQuickView.exe","command_line":"-InstallationId Zjceo22Jn1 -LogLevel 2 -Environment Production","sha256":"54c6b696e640d65e14098fc3a51a5f9dacb7e5aaa9157fb6a7c9e2cfe32564e4","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveQuickView.exe","parent_uid":"00000000-00002572","uid":"00000000-00009096"},{"pid":7096,"ppid":9096,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\QuickViewCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\QuickViewCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x7b4,0x7bc,0x7c0,0x6e0,0x7c4,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00009096","uid":"00000000-00007096"},{"pid":3256,"ppid":2572,"name":"GoToResolveTerminal.exe","command_line":"-CompanyId 1600971844239445521 -Environment Production -InstallationId Zjceo22Jn1 -LogLevel 2","sha256":"65722a9ab943b13ff70bd953fe3c3f720b85c2ab6f5ac87ed799e791dd793c53","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveTerminal.exe","parent_uid":"00000000-00002572","uid":"00000000-00003256"},{"pid":4208,"ppid":3256,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\TerminalCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\TerminalCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x868,0x86c,0x870,0x7b4,0x874,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00003256","uid":"00000000-00004208"},{"pid":2716,"ppid":2572,"name":"GoToResolveServiceManager.exe","command_line":"-CompanyId 1600971844239445521 -Environment Production -InstallationId Zjceo22Jn1 -LogLevel 2","sha256":"fc5716c03674456110bd35e6b967770186e97e872dc4c6039cfa3710621f3c07","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveServiceManager.exe","parent_uid":"00000000-00002572","uid":"00000000-00002716"},{"pid":8188,"ppid":2716,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ServiceManagerCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\ServiceManagerCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x878,0x87c,0x880,0x7c4,0x884,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00002716","uid":"00000000-00008188"},{"pid":4484,"ppid":2572,"name":"GoToResolveRemoteControl.exe","command_line":"-CompanyId 1600971844239445521 -InstallationId Zjceo22Jn1 -WorkFolder \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 1","sha256":"3dedfed0ef80ce86d2e108ca486799134b29a03b24baa23e4a0db7a01a8d6bcf","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveRemoteControl.exe","parent_uid":"00000000-00002572","uid":"00000000-00004484"},{"pid":4376,"ppid":4484,"name":"GoToResolveCrashHandler.exe","command_line":"\"--attachment=attachment_GoToResolveRemoteControl.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveRemoteControl.log\" \"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RemoteControlCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RemoteControlCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x7cc,0x7d0,0x7d4,0x5b8,0x7d8,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00004484","uid":"00000000-00004376"},{"pid":2016,"ppid":2572,"name":"GoToResolveRegistryEditor.exe","command_line":"-CompanyId 1600971844239445521 -Environment Production -InstallationId Zjceo22Jn1 -LogLevel 2","sha256":"517cdc8d458685c824c62dfac8c717135151e8eb350f7f340ae0670f3898b699","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveRegistryEditor.exe","parent_uid":"00000000-00002572","uid":"00000000-00002016"},{"pid":7348,"ppid":2016,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RegistryEditorCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\RegistryEditorCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x870,0x874,0x878,0x7bc,0x87c,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00002016","uid":"00000000-00007348"},{"pid":6936,"ppid":2572,"name":"GoToResolveNetworkChecker.exe","command_line":"-BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId Zjceo22Jn1 -CompanyId 1600971844239445521 -Environment Production","sha256":"9c933863eea435971dfa1c7702763d38fedd5b9a173d5a4d2c890fde93f814be","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveNetworkChecker.exe","parent_uid":"00000000-00002572","uid":"00000000-00006936"},{"pid":8468,"ppid":6936,"name":"GoToResolveCrashHandler.exe","command_line":"\"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\NetworkCheckerCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\NetworkCheckerCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x78c,0x790,0x794,0x5ac,0x798,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00006936","uid":"00000000-00008468"},{"pid":8080,"ppid":6112,"name":"GoToResolveUnattendedUi.exe","command_line":"\"-CompanyId\" \"1600971844239445521\" \"-InstallationId\" \"Zjceo22Jn1\" \"-WorkFolder\" \"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\" \"-Environment\" \"Production\" \"-ApplicationType\" \"4\" \"-Lang\" \"en\" \"-WebsiteUrl\" \"devices-iot.console.gotoresolve.com\"","sha256":"4cb046e6405659e9413c5399e08bcc4ba92bf45419da93e2df88c8eb72ce72ac","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattendedUi.exe","parent_uid":"00000000-00006112","uid":"00000000-00008080"},{"pid":3528,"ppid":8080,"name":"GoToResolveCrashHandler.exe","command_line":"\"--attachment=attachment_GoToResolveUnattendedUi.log=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveUnattendedUi.log\" \"--attachment=attachment_unattended.json=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json\" \"--database=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedUiCrashReportDB\" \"--metrics-dir=%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedUiCrashReportDB\" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=DESKTOP-8LD9T6N --annotation=installationid=Zjceo22Jn1 --annotation=version=1.27.1.3232 --initial-client-data=0x7a0,0x7a4,0x7a8,0x6e8,0x7ac,0x6fea6fac,0x6fea6fbc,0x6fea6fcc","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","normalized_path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","parent_uid":"00000000-00008080","uid":"00000000-00003528"},{"pid":7012,"ppid":0,"name":"sc.exe","command_line":"start GoToResolve_1600971844239445521","sha256":"67cbe3a7b9c9b7a2e9fb10a33c1a9a3fd297b6f1598aea374bd9b5d2dee352ec","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00007012","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"}],"all_imported_dlls":["mpr.dll","msi.dll","msasn1.dll","imagehlp.dll","propsys.dll","OneCoreUAPCommonProxyStub.dll","shlwapi.dll","CoreUIComponents.dll","sspicli.dll","KernelBase.dll","gdi32.dll","xmllite.dll","powrprof.dll","inetmib1.dll","wshbth.dll","ServicingCommon.dll","cryptsp.dll","rsaenh.dll","advapi32.dll","crypt32.dll","libssl-3.dll","WofUtil.dll","drvstore.dll","comctl32.dll","win32u.dll","VxSSL32.dll","TextShaping.dll","dwmapi.dll","mswsock.dll","webio.dll","atlthunk.dll","cryptnet.dll","windows.storage.dll","netapi32.dll","psapi.dll","snmpapi.dll","dhcpcsvc6.dll","wow64cpu.dll","imm32.dll","d2d1.dll","winhttp.dll","cabinet.dll","taskschd.dll","ucrtbase.dll","msctf.dll","kernel.appcore.dll","dxgi.dll","BCP47Langs.dll","devobj.dll","shell32.dll","FWPUCLNT.DLL","MediaClientLib.dll","wldp.dll","cmdext.dll","dpapi.dll","secur32.dll","wsock32.dll","pcacli.dll","devrtl.dll","GdiPlus.dll","pdh.dll","msvcrt.dll","ncrypt.dll","TextInputFramework.dll","wintrust.dll","winnsi.dll","rpcrt4.dll","IPHLPAPI.DLL","profapi.dll","cfgmgr32.dll","gdi32full.dll","d3d11.dll","wow64win.dll","uxtheme.dll","msimg32.dll","netutils.dll","NapiNSP.dll","ntdll.dll","sas.dll","edputil.dll","AppResolver.dll","wow64.dll","sppc.dll","dnsapi.dll","wow64con.dll","avrt.dll","samcli.dll","umpdc.dll","dhcpcsvc.dll","srvcli.dll","ws2_32.dll","wow64base.dll","iertutil.dll","VxSSL64.dll","kernel32.dll","SHCore.dll","wtsapi32.dll","version.dll","spinf.dll","RstrtMgr.dll","fltLib.dll","setupapi.dll","rasadhlp.dll","sfc_os.dll","ntasn1.dll","duser.dll","bcryptprimitives.dll","dbghelp.dll","FileManager.dll","libcrypto-3.dll","newdev.dll","sechost.dll","ntmarta.dll","apphelp.dll","pnrpnsp.dll","urlmon.dll","Windows.StateRepositoryPS.dll","cryptbase.dll","userenv.dll","winmm.dll","winrnr.dll","nlansp_c.dll","winsta.dll","virtdisk.dll","clbcatq.dll","LibGoToResolve.dll","msvcp_win.dll","combase.dll","oleaut32.dll","WinTypes.dll","CoreMessaging.dll","gpapi.dll","ole32.dll","user32.dll","msdmo.dll","libcrypto-3-x64.dll","bcrypt.dll","DWrite.dll","slwga.dll","nsi.dll","OnDemandConnRouteHelper.dll","PasswordPrivacyDll.dll","Faultrep.dll","msIso.dll","wersvc.dll","wer.dll","weretw.dll","nlaapi.dll","dbgcore.dll","winmmbase.dll","cldapi.dll","aepic.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"FileManager.dll","sha256":"6e2621b09928fe70b82b5f14da799c81b0d5089d1fcc0293e53f428ef45b99eb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LibGoToResolve.dll","sha256":"22fd40415cc28bcfb35c0277e1ac74a9c0910d17b2a9b9a1405219c549a92017","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"MediaClientLib.dll","sha256":"cb045f5f9aa4ffee5229db616499e3a71ce6be9bd908d20d9a8ed4c69161054d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveCrashHandler.exe","sha256":"a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveLoggerProcess.exe","sha256":"ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveProcessChecker.exe","sha256":"7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveRemoteControl.exe","sha256":"3dedfed0ef80ce86d2e108ca486799134b29a03b24baa23e4a0db7a01a8d6bcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveTools32.exe","sha256":"74287487a4909ff809c9349fe5791154254d2250c9ece37d944a7bc9a190533d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveTools64.exe","sha256":"bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveUnattendedRemover.exe","sha256":"f617ad5914bd63b8fff4c9d04ff98d123c5ea930091fd6bbcdf53c30b189793f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveUnattendedUi.exe","sha256":"4cb046e6405659e9413c5399e08bcc4ba92bf45419da93e2df88c8eb72ce72ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveUnlock32.dll","sha256":"99aa6be58ba24677af730bf1e7ba74054fe9bd68c43f94096c8258c5538cc4ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveUnlock64.dll","sha256":"9c898e45934e56ceaca736b269a0d3f45f42b1d6932980296a4a511f1e293516","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMISupport7x64.dll","sha256":"09ec4d7343ca86892ec8a7dcd5c7a2ef126a103d5824d859480527d80aa83769","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"PasswordPrivacyDll.dll","sha256":"e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"legacy.dll","sha256":"d7c9b94466ef8f37999b2344624062422cfaf5c8e38aea2b44eff126f80a6bc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"libcrypto-3-x64.dll","sha256":"92c72eec3c38a9c94ca7f2bbeb8463ec20d1ebdd3c341476ec10acbfa33e9e25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"libcrypto-3.dll","sha256":"20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"libssl-3-x64.dll","sha256":"116de46842e4e19fb7977ab98a3a28c871feb66dbbc8ff8f3179c28c2efe3aed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"libssl-3.dll","sha256":"9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"DamicoStockstillPolicy.exe.cmd","sha256":"5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"GoToResolveExternalModuleHandler.exe","sha256":"d249d6eca804d917db79144c8651b8a21e41a3489d91f7414c5663f0d4f360fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveFileManager.exe","sha256":"915a69a02ff1e9251b7085fe41c4be05ad7a377d809de3e00c515fc2eae44101","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveNetworkChecker.exe","sha256":"9c933863eea435971dfa1c7702763d38fedd5b9a173d5a4d2c890fde93f814be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveQuickView.exe","sha256":"54c6b696e640d65e14098fc3a51a5f9dacb7e5aaa9157fb6a7c9e2cfe32564e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveRegistryEditor.exe","sha256":"517cdc8d458685c824c62dfac8c717135151e8eb350f7f340ae0670f3898b699","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveServiceManager.exe","sha256":"fc5716c03674456110bd35e6b967770186e97e872dc4c6039cfa3710621f3c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveTerminal.exe","sha256":"65722a9ab943b13ff70bd953fe3c3f720b85c2ab6f5ac87ed799e791dd793c53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveUi.exe","sha256":"f1b8cc6dbfd0467ef4c6e6b9403dfc535f8052e3fce4a75ea592324844d2f546","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"GoToResolveUnattended.exe","sha256":"3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMIFilterHook32.dll","sha256":"890ba9b2b7c2b29e534ff08794384c9a59a73a2596cc0de914370ceaf53dc19a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMIFilterHook64.dll","sha256":"6d4a06f9c9d3e629bf2b9397fe898cebc580e164a717df9c75a9ac3b0c115ca5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMIInputHook32.dll","sha256":"ddcadf239f430e1d2626de0d926843f9d335d934c4a81505d56338e8bf063673","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMIInputHook64.dll","sha256":"b85a2384e8755a715c0ee7e38b0187d817a41a3401e1cf654a53fdad66c629b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMISupport7x32.dll","sha256":"780e41d1be392078490ca420c27454a67b27bfee6785337256ba43c61da98684","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMISupportM32.exe","sha256":"1681ee2d33f738fc7b810fe054bf27dec12e6496ef1e298c21486baba57047cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"LMISupportM64.exe","sha256":"c7193d7dae1a2ba63097588418e4c5bfdc6afb55a137a34fabc753485ca71de8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"lmiscrhook32.dll","sha256":"172467a212328928481b7ed972a8febf13f96ccc8bf361ab9e7ebd4cee0fc78d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"lmiscrhook64.dll","sha256":"f4cbb914925ec058a4d643aebeafb0ad21effed525e961e2ecd685b951ce090c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"g2rvdd.dll","sha256":"484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"UnattendedUpdater.csv","sha256":"ef53b2c0bbb9b914078f835f42a772b1cc23f2e2f06c5d2acc319d64fea3bef1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"UnattendedUpdater.log","sha256":"15dca6498e1ae4ce3142c4341372fcacbf2c5aa77575bd0d8dbb944d6a4def29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A","sha256":"4fc580e2e9b6374d57ab16b1164de16faccdb51413990379789bf484bf160b99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5","sha256":"a80a7875ec96dafd39145a390a91dcfea36d7be3028a3ed3f1e6eb5d0998e3dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"g2rvdd.cat","sha256":"6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"g2rvdd.inf","sha256":"0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"sc.exe.bin","sha256":"67cbe3a7b9c9b7a2e9fb10a33c1a9a3fd297b6f1598aea374bd9b5d2dee352ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"JordanWolfPymnt.exe.cmd","sha256":"5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"33B65948FA5A494FD849A9882CBE888A","sha256":"71445c5cf7dd7a5db0a0b307e9d8ed13fd836b436caa9dfc86d44360f57c25d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\GoTo Resolve Installer\\GoTo0001.tmp\\UnattendedUpdater.log","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\GoTo Resolve Installer\\GoTo0001.tmp\\UnattendedUpdater.csv","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveProcessChecker.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUi.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveLoggerProcess.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveRemoteControl.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattended.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattendedUi.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnattendedRemover.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LibGoToResolve.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveNetworkChecker.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveQuickView.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveFileManager.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveTerminal.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveServiceManager.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveExternalModuleHandler.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveRegistryEditor.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\x86\\g2rvdd.cat","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"C:\\x86","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\x86\\g2rvdd.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\x86\\g2rvdd.inf","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\x64\\g2rvdd.cat","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"C:\\x64","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\x64\\g2rvdd.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\x64\\g2rvdd.inf","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMIFilterHook32.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMIFilterHook64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMIInputHook32.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMIInputHook64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\lmiscrhook32.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\lmiscrhook64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMISupport7x32.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMISupport7x64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMISupportM32.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\LMISupportM64.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\MediaClientLib.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\PasswordPrivacyDll.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\FileManager.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveTools32.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveTools64.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveCrashHandler.exe","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnlock32.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\GoToResolveUnlock64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\legacy.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\libcrypto-3-x64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\libssl-3.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\libssl-3-x64.dll","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"C:\\DamicoStockstillPolicy.exe.cmd","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedUpdater.csv","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\UnattendedUpdater.log","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveUnattended.log","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\unattended.json.tmp","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\mandatory.json.tmp","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"pipe\\GoToResolve_1600971844239445521","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"Q:\\_5.15.17-273-win-x86\\qt-5.15.17-win-x86-v143-static-dynamicssl\\qtlogging.ini","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveProcessChecker.log","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\GoToResolveTools64.log","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB\\settings.dat","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"pipe\\crashpad_8124_CGQPYKAUWSOLNCUS","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"path":"GLOBALROOT\\C:\\WINDOWS","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\wvmbusvideo.inf_amd64_27923191abb55ed0\\wvmbusvideo.PNF","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\virtualdisplayadapter.inf_amd64_dab3e47961bd4184\\virtualdisplayadapter.PNF","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vrd.inf_amd64_df3fa89d8f6bbc88\\vrd.PNF","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\c_display.inf_amd64_95c99fadf120797f\\c_display.PNF","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\displayoverride.inf_amd64_c96ea0fb3af7d052\\displayoverride.PNF","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\rdpidd.inf_amd64_0ae105f572981c3a\\rdpidd.PNF","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\INF\\setupapi.dev.log","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%TEMP%\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5CF3.tmp","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"path":"%TEMP%\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5D42.tmp","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"path":"%TEMP%\\{76c4cef6-c52f-8449-aedc-a029e5bec2ce}\\SET5D62.tmp","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB\\reports","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB\\attachments","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\appdata\\CrashReportDB\\metadata","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%PROGRAMFILES%\\(x86)\\GoTo Resolve Unattended\\1600971844239445521\\pc.json.tmp","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"pipe\\crashpad_8508_GAADLLMBNLVNCOMT","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%TEMP%\\{0ca60e0c-44a9-4b4e-8bd3-69ca688b93b5}\\SET1D75.tmp","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%TEMP%\\{0ca60e0c-44a9-4b4e-8bd3-69ca688b93b5}\\SET1D95.tmp","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"%TEMP%\\{0ca60e0c-44a9-4b4e-8bd3-69ca688b93b5}\\SET1DC5.tmp","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"path":"C:\\JordanWolfPymnt.exe.cmd","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\33B65948FA5A494FD849A9882CBE888A","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\33B65948FA5A494FD849A9882CBE888A","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\33B65948FA5A494FD849A9882CBE888A","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\33B65948FA5A494FD849A9882CBE888A","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOTO RESOLVE UNATTENDED 1600971844239445521\\","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4960:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4960:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\SM0:4960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\SM0:4960:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"SM0:4960:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\SM0:7224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"SM0:7224:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\SM0:2896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8124:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"SM0:8124:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"Local\\SM0:3824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\BaseNamedObjects\\GoToResolveUnattended_1600971844239445521_Service","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"},{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"},{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:4388:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699c480e5b5b013719037379"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:8740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:8740:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"SM0:8740:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8740:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8740:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:7312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\BaseNamedObjects\\GoToResolveUnattended_1600971844239445521_User","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8200:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:8200:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"SM0:8508:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:936:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:936:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"Local\\SM0:4880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7308:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:8448:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69827acef3dca582060fbdb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8628:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8628:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"SM0:8628:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Local\\SM0:8628:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4500:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Local\\SM0:4500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"Local\\SM0:4500:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"SM0:4500:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4500:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68fa6aed53693d2cb90adcbd"}]}]}},"report_ids":{"sandbox_job_ids":["68fa6aed53693d2cb90adcbd","699c480e5b5b013719037379","69827acef3dca582060fbdb7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Application.Scam.LConnect Sample 77e22f4e1af7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 77e22f4e1af7…. Malware family: Application.Scam.LConnect. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e"}],["$","meta","4",{"property":"og:title","content":"Malicious Application.Scam.LConnect Sample 77e22f4e1af7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 77e22f4e1af7…. Malware family: Application.Scam.LConnect. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Application.Scam.LConnect Sample 77e22f4e1af7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 77e22f4e1af7…. Malware family: Application.Scam.LConnect. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8d","11",{}]]