229cfe6fd7e042b7b73d2cb84fb75f04778740d7f5dfc234850706a5f48ffb96

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Peam.exe
Size

20.6MB
MD5

66dd4a784a2f05ccde36c2aebd5ade99
SHA1

3e654231d413eed3bef307fa8aaf2377c9ccc934
SHA256

229cfe6fd7e042b7b73d2cb84fb75f04778740d7f5dfc234850706a5f48ffb96
SHA512

224b6611312cbfab62c2587d11ec7100246b655f0ce76a0c9f81b43fc6403d8a85b6c9f00ace3ff3c96fa799f8481a36495548e51848e3f00f61077e04d3cce6
SSDEEP

393216:Aq+Jsv6tWKFdu9C2KS1P7nEscpZr8LE10MT4xwGyxBKP1JztKuUyvUTAzayj+lhe:hP1nxcpZ9z4xsB4z/JvUTWZjlXykJ

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	GoToAssistUnattended.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA	GoToAssistUnattended.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook32.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log	GoToAssistUnattendedUi.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\eZ8HyEDpZR\GoToAssist_Remote_Support_Unattended.exe	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json.tmp	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-3.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-3.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdaterCopy.csv	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\old\5.12.1.3601	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook64.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\legacy.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-3-x64.dll	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook64.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\old\5.12.1.3601\GoToAssistCrashHandler.exe	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM32.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM64.exe	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv	GoToAssist_Remote_Support_Unattended.exe

Executes dropped EXE 20 IoCs

pid	Process
4984	GoToAssistUnattended.exe
2460	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
3908	GoToAssistCrashHandler.exe
2416	GoToAssistUnattended.exe
3384	GoToAssistCrashHandler.exe
4760	GoToAssistLoggerProcess.exe
3816	GoToAssistCrashHandler.exe
3012	GoToAssistUnattendedUi.exe
2816	GoToAssistCrashHandler.exe
4912	GoToAssist_Remote_Support_Unattended.exe
4924	GoToAssistCrashHandler.exe
5688	GoToAssistProcessChecker.exe
5748	GoToAssistCrashHandler.exe
5808	GoToAssistUnattended.exe
5924	GoToAssistCrashHandler.exe
1632	GoToAssistLoggerProcess.exe
1340	GoToAssistCrashHandler.exe
4320	GoToAssistUnattendedUi.exe
5132	GoToAssistCrashHandler.exe

Loads dropped DLL 44 IoCs

pid	Process
4984	GoToAssistUnattended.exe
4984	GoToAssistUnattended.exe
4984	GoToAssistUnattended.exe
4984	GoToAssistUnattended.exe
2460	GoToAssistProcessChecker.exe
2460	GoToAssistProcessChecker.exe
2460	GoToAssistProcessChecker.exe
2460	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
4760	GoToAssistLoggerProcess.exe
4760	GoToAssistLoggerProcess.exe
4760	GoToAssistLoggerProcess.exe
4760	GoToAssistLoggerProcess.exe
4760	GoToAssistLoggerProcess.exe
2416	GoToAssistUnattended.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
5688	GoToAssistProcessChecker.exe
5688	GoToAssistProcessChecker.exe
5688	GoToAssistProcessChecker.exe
5688	GoToAssistProcessChecker.exe
5808	GoToAssistUnattended.exe
5808	GoToAssistUnattended.exe
5808	GoToAssistUnattended.exe
5808	GoToAssistUnattended.exe
5808	GoToAssistUnattended.exe
1632	GoToAssistLoggerProcess.exe
1632	GoToAssistLoggerProcess.exe
1632	GoToAssistLoggerProcess.exe
1632	GoToAssistLoggerProcess.exe
1632	GoToAssistLoggerProcess.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattendedUi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssist_Remote_Support_Unattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattendedUi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2968	timeout.exe
1632	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv"	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToAssistUnlock64.dll"	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment"	GoToAssistUnattended.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3012	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
2416	GoToAssistUnattended.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe
5104	GoToAssistProcessChecker.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
3012	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe
4320	GoToAssistUnattendedUi.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4984	212	Peam.exe	89
PID 212 wrote to memory of 4984	212	Peam.exe	89
PID 212 wrote to memory of 4984	212	Peam.exe	89
PID 212 wrote to memory of 2180	212	Peam.exe	90
PID 212 wrote to memory of 2180	212	Peam.exe	90
PID 212 wrote to memory of 2180	212	Peam.exe	90
PID 2180 wrote to memory of 2968	2180	cmd.exe	92
PID 2180 wrote to memory of 2968	2180	cmd.exe	92
PID 2180 wrote to memory of 2968	2180	cmd.exe	92
PID 4984 wrote to memory of 2460	4984	GoToAssistUnattended.exe	94
PID 4984 wrote to memory of 2460	4984	GoToAssistUnattended.exe	94
PID 4984 wrote to memory of 2460	4984	GoToAssistUnattended.exe	94
PID 5104 wrote to memory of 3908	5104	GoToAssistProcessChecker.exe	97
PID 5104 wrote to memory of 3908	5104	GoToAssistProcessChecker.exe	97
PID 5104 wrote to memory of 3908	5104	GoToAssistProcessChecker.exe	97
PID 5104 wrote to memory of 2416	5104	GoToAssistProcessChecker.exe	98
PID 5104 wrote to memory of 2416	5104	GoToAssistProcessChecker.exe	98
PID 5104 wrote to memory of 2416	5104	GoToAssistProcessChecker.exe	98
PID 2416 wrote to memory of 3384	2416	GoToAssistUnattended.exe	100
PID 2416 wrote to memory of 3384	2416	GoToAssistUnattended.exe	100
PID 2416 wrote to memory of 3384	2416	GoToAssistUnattended.exe	100
PID 2416 wrote to memory of 4760	2416	GoToAssistUnattended.exe	99
PID 2416 wrote to memory of 4760	2416	GoToAssistUnattended.exe	99
PID 2416 wrote to memory of 4760	2416	GoToAssistUnattended.exe	99
PID 4760 wrote to memory of 3816	4760	GoToAssistLoggerProcess.exe	103
PID 4760 wrote to memory of 3816	4760	GoToAssistLoggerProcess.exe	103
PID 4760 wrote to memory of 3816	4760	GoToAssistLoggerProcess.exe	103
PID 2180 wrote to memory of 1632	2180	cmd.exe	106
PID 2180 wrote to memory of 1632	2180	cmd.exe	106
PID 2180 wrote to memory of 1632	2180	cmd.exe	106
PID 5104 wrote to memory of 3012	5104	GoToAssistProcessChecker.exe	107
PID 5104 wrote to memory of 3012	5104	GoToAssistProcessChecker.exe	107
PID 5104 wrote to memory of 3012	5104	GoToAssistProcessChecker.exe	107
PID 3012 wrote to memory of 2816	3012	GoToAssistUnattendedUi.exe	108
PID 3012 wrote to memory of 2816	3012	GoToAssistUnattendedUi.exe	108
PID 3012 wrote to memory of 2816	3012	GoToAssistUnattendedUi.exe	108
PID 2416 wrote to memory of 4912	2416	GoToAssistUnattended.exe	117
PID 2416 wrote to memory of 4912	2416	GoToAssistUnattended.exe	117
PID 2416 wrote to memory of 4912	2416	GoToAssistUnattended.exe	117
PID 4912 wrote to memory of 4924	4912	GoToAssist_Remote_Support_Unattended.exe	118
PID 4912 wrote to memory of 4924	4912	GoToAssist_Remote_Support_Unattended.exe	118
PID 4912 wrote to memory of 4924	4912	GoToAssist_Remote_Support_Unattended.exe	118
PID 5688 wrote to memory of 5748	5688	GoToAssistProcessChecker.exe	121
PID 5688 wrote to memory of 5748	5688	GoToAssistProcessChecker.exe	121
PID 5688 wrote to memory of 5748	5688	GoToAssistProcessChecker.exe	121
PID 5688 wrote to memory of 5808	5688	GoToAssistProcessChecker.exe	122
PID 5688 wrote to memory of 5808	5688	GoToAssistProcessChecker.exe	122
PID 5688 wrote to memory of 5808	5688	GoToAssistProcessChecker.exe	122
PID 5808 wrote to memory of 5924	5808	GoToAssistUnattended.exe	123
PID 5808 wrote to memory of 5924	5808	GoToAssistUnattended.exe	123
PID 5808 wrote to memory of 5924	5808	GoToAssistUnattended.exe	123
PID 5808 wrote to memory of 1632	5808	GoToAssistUnattended.exe	127
PID 5808 wrote to memory of 1632	5808	GoToAssistUnattended.exe	127
PID 5808 wrote to memory of 1632	5808	GoToAssistUnattended.exe	127
PID 1632 wrote to memory of 1340	1632	GoToAssistLoggerProcess.exe	128
PID 1632 wrote to memory of 1340	1632	GoToAssistLoggerProcess.exe	128
PID 1632 wrote to memory of 1340	1632	GoToAssistLoggerProcess.exe	128
PID 5688 wrote to memory of 4320	5688	GoToAssistProcessChecker.exe	129
PID 5688 wrote to memory of 4320	5688	GoToAssistProcessChecker.exe	129
PID 5688 wrote to memory of 4320	5688	GoToAssistProcessChecker.exe	129
PID 4320 wrote to memory of 5132	4320	GoToAssistUnattendedUi.exe	130
PID 4320 wrote to memory of 5132	4320	GoToAssistUnattendedUi.exe	130
PID 4320 wrote to memory of 5132	4320	GoToAssistUnattendedUi.exe	130

C:\Users\Admin\AppData\Local\Temp\Peam.exe
"C:\Users\Admin\AppData\Local\Temp\Peam.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe" -regsvc
  2⤵
  - Checks computer location settings
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -regsvc -expectadmin -starterpid 4984 -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType 4
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\Peam.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\Peam.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2968
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1632

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.0.3440 --initial-client-data=0x500,0x504,0x508,0x4d4,0x50c,0x750f4574,0x750f4584,0x750f4594
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:3908
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "5104" "-WtsStartingUsername" "HVDPCYGS\Admin" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Drops file in System32 directory
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -ParentProcessId 2416 -CompanyId 3125152135071953924 -InstallationId RSy9pkvqYj -MonitoringUrl https://dumpster.console.gotoassist.com -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -HostId f3632d9d4cae2b90dc3d34c2783b9f42 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.0.3440 --initial-client-data=0x4c4,0x4c8,0x4cc,0x48c,0x4d0,0x750f4574,0x750f4584,0x750f4594
      4⤵
      Executes dropped EXE
      PID:3816
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.0.3440 --initial-client-data=0x548,0x54c,0x550,0x51c,0x554,0x750f4574,0x750f4584,0x750f4594
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:3384
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\eZ8HyEDpZR\GoToAssist_Remote_Support_Unattended.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\eZ8HyEDpZR\GoToAssist_Remote_Support_Unattended.exe" -ServiceName G2ARemoteSupport_3125152135071953924 -wd "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -updateMode -updateMode -CompanyId 3125152135071953924 -InstallationId RSy9pkvqYj -MonitoringUrl https://dumpster.console.gotoassist.com -WorkFolder C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924 -Lang en -Offline 0 -ServiceName G2ARemoteSupport_3125152135071953924
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\eZ8HyEDpZR\appdata\UnattendedUpdaterCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\eZ8HyEDpZR\appdata\UnattendedUpdaterCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.1.3601 --initial-client-data=0x300,0x304,0x308,0x2f8,0x30c,0x6f6a44,0x6f6a54,0x6f6a64
      4⤵
      Executes dropped EXE
      PID:4924
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattendedUi.exe" "-CompanyId" "3125152135071953924" "-InstallationId" "RSy9pkvqYj" "-MonitoringUrl" "https://dumpster.console.gotoassist.com" "-WorkFolder" "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" "-Lang" "en" "-WebsiteUrl" "https://console.gotoassist.com/UnattendedConnection.ashx"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattendedUi.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.0.3440 --initial-client-data=0x578,0x57c,0x580,0x554,0x584,0x750f4574,0x750f4584,0x750f4594
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:2816

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.1.3601 --initial-client-data=0x4fc,0x500,0x504,0x4d0,0x508,0x6fea4574,0x6fea4584,0x6fea4594
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:5748
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "5688" "-WtsStartingUsername" "HVDPCYGS\Admin" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.1.3601 --initial-client-data=0x534,0x538,0x53c,0x4a0,0x540,0x6fea4574,0x6fea4584,0x6fea4594
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:5924
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -ParentProcessId 5808 -CompanyId 3125152135071953924 -InstallationId RSy9pkvqYj -MonitoringUrl https://dumpster.console.gotoassist.com -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType 4 -HostId f3632d9d4cae2b90dc3d34c2783b9f42 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.1.3601 --initial-client-data=0x4c8,0x4cc,0x4d0,0x49c,0x4d4,0x6fea4574,0x6fea4584,0x6fea4594
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:1340
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattendedUi.exe" "-CompanyId" "3125152135071953924" "-InstallationId" "RSy9pkvqYj" "-MonitoringUrl" "https://dumpster.console.gotoassist.com" "-WorkFolder" "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" "-Lang" "en" "-WebsiteUrl" "https://console.gotoassist.com/UnattendedConnection.ashx"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattendedUi.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Hvdpcygs --annotation=installationid=RSy9pkvqYj --annotation=version=5.12.1.3601 --initial-client-data=0x568,0x56c,0x570,0x53c,0x574,0x6fea4574,0x6fea4584,0x6fea4594
    3⤵
    - Executes dropped EXE
    PID:5132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe

Filesize
1.1MB

MD5
454cc5ad59a1c6748834fdfe1350a6b3

SHA1
12f165e17e9b191f3f7e784b3b87bcc2ddb56d80

SHA256
303d733b4a54ab08a6308ad50779a3fc6e3d9a8f07248bf12ea69aa425d42bc2

SHA512
71fb8440500343e0a11b13b27708fdac87f610e3fcd313978fe39f02131cf1f7eee7243880b0356ebbb5a2b909b6926ca9b559b2006348115c9b69e775930227

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
401KB

MD5
f70be96a4234a01e3925ab963b58360a

SHA1
80124b0010198b3fd836959d8997fb7f9d79cc64

SHA256
b3b00144ecbb776475eea8b8344be7cded2c401b0287ecc512f3fc064fd43033

SHA512
99ad916980db9cf524a663eb28a6527936a111c7603cc12c763e589d481326fa8cabe0b9a1ea78d2680518e90b0b5bef8d8d4b460b5801c37ede1b4d2fbb3667

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
401KB

MD5
682062ae46607a596e687f3edda987ae

SHA1
d7611bd2b3bbb0441c6b25e8cdd09c5e836656c4

SHA256
5743d0dac5ccb74b4a2f57c6cba5b6bf0078464d0ba4b8dd2fc92d107d49828d

SHA512
1d2c6d77fe01cb9380d33d76d6ae55dc2d9a1ea88f442103302bf8ba7f0e08e3826e8ca526a57658c0f569e83798e3476df0b7d7ffbc51d4b777fd729ddb5ab7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
400KB

MD5
d35e40946b9576199c40a6aa178f2d5f

SHA1
fc69faac029b9a44a9b38982b678ce0a8e5ae287

SHA256
0edf36ec7e7499f6d91d4e6b1beb6dffc68fe1c0bf2ea5276e9a35b937a1b38a

SHA512
0fc19801c0e70f66d97725bb33790afacc4edc84de8d284f885d5919fbcdcb0885ced3082449676dc8150930cc11286b665b1607e550502a1ef22d7df3b27f16

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
400KB

MD5
6d8ea3e93cc80a9d2dd8c0c630fb8802

SHA1
13725a1865732a3cf395c42ee548410135f61520

SHA256
ef74976546d4a9236974fcec9e9f3e1866691d7e04e075426fec5b2c9d452ac4

SHA512
08285905059d1ce99b8760befeac3396f6d73168abaddd85ae577c4622cafa8f23d779dea303aa0df24eab80c1b32a8994588c12d4970065ee3aa9ebc5043498

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe

Filesize
1.0MB

MD5
6bad63ccb15e20e0dd3d1fbe4a95262d

SHA1
4ff2297af7475ffa0fdb5c46fa4d3763ec50a2f6

SHA256
2275209ee480a291afd2c14246491b0d5aa1c915672c085ed3277a334cd76100

SHA512
2f3c533864a5f4574c6a296d94fd9e3fe175b7092ac5084b6a5240792df5a624c1cc08d1c58cc94d82140d31ce0251dc2d999bef2e870971853508ce11c2141b

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe

Filesize
1.3MB

MD5
fae009795550682c2e75ecbb26812b18

SHA1
bd36784c5ac0c80849d9ad4236d8298a660341dd

SHA256
60d95f9b91758ce62dc998dd54a56c8d5084c169f99ca51097e96887a17132cf

SHA512
82498810a0802767c79cc43e8a13139a297de61e36a2329a6312122712c1ce30e014c150de3281faa51e2e24ae5fb7ed93cde35ace4b656d209fe9423f1b9f0d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe

Filesize
401KB

MD5
0fa46cd4f59fcf77dd6620b66226362f

SHA1
0918f1cff836b75836325a3490308cd45c0e7c3e

SHA256
9932d84bcd4e26897ad0001d0350b476fc03e73a5358c41b078c0edefcaa2828

SHA512
a673c21185e0b9617ca710109c0327a04b69e7a83e245900332495a8280b73fa638a08fea2f184de8810ad1cde4a77e846c9df7041ed00879cc038927f62cf10

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe

Filesize
401KB

MD5
9a05d066b6e1f581809b26c238e1f634

SHA1
7ae1720fa1965945160014efe07c5385d00852f5

SHA256
a854c5a6f4d52ff37c62d254fb0b12efd15eaa4e7a22324cffd224839145f231

SHA512
2d1eb260c1721d994fa929b717c12b5d7ef64dffb1b4231d2109d5ce3bd946ed6ed5fd5b867dff447ae4158fb7e52a323c5b2facfe0bba53f819508e45f29610

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe

Filesize
401KB

MD5
427ad381c1f2cee8b20fbaf3bb052974

SHA1
13f754a82c5503e3fa86820b91d3f2ac365b5b3b

SHA256
64665969ce447cdc7f01740a7709d765c21cc61bb214857eb80a3dd5cd324b6e

SHA512
201a78baebd9ef081f087ddfdf02f5e267c47ce4fe32c33b1305e13c9fb582a52243334b72ac6d30e0ab744c574279e65cb61bd9e76ff3e8a6fdf7343ebbe9b7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe

Filesize
400KB

MD5
33729091b2632150acf6327a37919e60

SHA1
0d215434161bb1b64b9f4bea8a84501139b7494d

SHA256
5ee9af795bdf815f6b6c69c1f220160bbab3f1ab2d211ef4e2b07a6791bb75a4

SHA512
2af502291f457c15e0b37c1e5127df69a635fe1a415c1153648500c0b6e971ba507f8cd4cedc92f08b9577e7e181abbd3db0d4e9b488f0661b554772f8bd5513

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
401KB

MD5
1626b25bbac17be7d08aa091f47a175c

SHA1
95247f262e1f95ea4657d2a6a1869b369bc19db8

SHA256
627ab0df66312319741a69da6fc5a77f10301c76547a3fabaf4e0a416dee2c10

SHA512
f9e423ecdcb3cd0f91bcc9dbac71bca9ecf78ad42e83fd82e737edca50e7558931edf0c7547f828c1d28c6613ec089ab62ef8e539b75ac2c48bf9a82afab0cc1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
401KB

MD5
3671b81de11a612d3a339a351fcf9f06

SHA1
505245eaab2cee1bcb8ce51229dda467458686b8

SHA256
bb9a73815cc3b262d79420a15731f7083ae03b5f3fcdd774d2604e1598678cb2

SHA512
369d0753b0f4d2292ec20d0dced0a842e1f4925f1e680638d836f741f010956d802e658e9be2837e292c4e2978df73b3a04f40415cacd169b44fd350924a8201

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll

Filesize
108KB

MD5
decd9ebc95d53cc41a0b974e49f642df

SHA1
af7a1fc531ef93c494ab5518897c0262921145ec

SHA256
454af5be3500704656779eb3833824dee1e25d742b1608869362e5160fead3d6

SHA512
64acec6e5562ce83bc620d3274584abb6a1bd166a583adf3a8a41a4a5e52757b71c7a671399d8afaf6999140c209a802c251d4d62053b006de592a6cc92d7b5b

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll

Filesize
142KB

MD5
23a642cab02d4c85d586627b560ed57d

SHA1
34f1dee26bb19d6ec32280a098f905e62521983f

SHA256
cfe5de2b8c591387f7d338b6193aa53997a1384a35579d361c73646f62375c3b

SHA512
076fd123956ad87e6208a71c65bde5662fb89dc09dca09e1d1ed103cdd53015cbdf0ea904754102eeae86508ca0e9d0b38fc1924b65d9d451cade5ac7d0b364d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll

Filesize
17.4MB

MD5
78d1fc04af8eb213a91924dc5f093028

SHA1
e816555ab1bdf7b652076e9f307025519ccb58ba

SHA256
c72ec9eee570f144dd318c404438dfa718dd7d612f8b5e89c397615de695bc5d

SHA512
5472bb7968b779ecef05eacf940b866a2d21bee18b575eece57212a7d9e489e8f41e28eb621c670559663b4c900ab162f3510bfd227902916fd6523d7e8441d4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll

Filesize
13.9MB

MD5
2770f365cd1316969bb36a9f10387c9d

SHA1
b98c630287c28f21397802e28b924db8e4fdb7a6

SHA256
80bba06e2b4385da16b239698a8b7cec0e08e56437e39e18e584c91ea2c03123

SHA512
5aef848e82074c8a64b3c3a89395f4a87d4d8b893373431fc995c76334c0f69bf64a7d2b84f7e48e2869fecf6fe8770706ed23d2dc7e3358aec346d9f9665638

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll

Filesize
1.1MB

MD5
d9223c3601a1318b82f57c02c74066f0

SHA1
47d6ff9c4ddcb9f6be93f0bfd80d797e741b359e

SHA256
5d84c724071155d1306d0b61c80d298cf4e7a8a46a463cc7b4269f3ef45c787a

SHA512
bbab5d9ad02ae412d4c0fb8ae7d96082d158f833dc5acbfa3729f31af0ac2d993fdcd9ad169dfc70caef22c852d883ce3bef8851e74dce0ae75e8cd64a7bbcbe

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log

Filesize
7KB

MD5
b8f1539432746b19b7099de7fa03b6ba

SHA1
3e51a4918117050e329efcbf81a10a5b360b9e73

SHA256
bff6c04b78835c8d05cdd6502feb84fc2588c295a0e1277a2e09836c6b037007

SHA512
8dbbbd89f2f93d52246360047c017f19ab049a5609be23d615cf58ce06ce6929cf1d0baf6920f04b05f9e442a9a987ec9082eae467c6833750a00769ce4be9cd

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log

Filesize
10KB

MD5
42463ec733ddae298671748b06a3e680

SHA1
99f0df3829effd0b669d7158809b0abc8432b8d0

SHA256
0561c04e54c06377d0ea59bc9becd77c0964107d0d4ce1d83f6b25df03e7a08c

SHA512
fb47509132f9eca4631e30cf0b00ba4f6cc72616a66a1fb28c670534c7ffdff1af818789cf800ed7dca0dbd6c6eb678eec85ad472cb60664aab39b4cdb379948

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log

Filesize
2KB

MD5
ff1b14f4c1b460f32f2e735ce6006d71

SHA1
15b63dfbcfb994df54e68db72545e6cd011773a1

SHA256
09fa506e50b445bee32bdad69c2421c0c33761eca3a620a92ce4888a43b13f83

SHA512
1202894de0a735d5a7aa6e9a6ed19fb9f2dcfd2c4909f1eacca0330322d4a8e6d7abf51b35a59e94780a780a7d99ca85c7f92a9d1411ee1a549fbe491e55c7fe

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\eZ8HyEDpZR\GoToAssist_Remote_Support_Unattended.exe

Filesize
20.6MB

MD5
1dd8e77bf12e1ec40671215302bf61ba

SHA1
19377b815d2361d3f268528e6141af316fc10026

SHA256
0d98502b1a9f5d5d5c85c1e460e28d8cb0ff887147c502cd11aaafaab8f8524f

SHA512
c656be9f32906fe27fa473040faa2568e8424ee1794c26f34a045839759a85ae7123a147d1d095a8ed43eb92617fb2163b5daf99c7f6985dc96cc25ce7325c34

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-3.dll

Filesize
4.2MB

MD5
1849082db4ca1d32afaf3df0ad2e6a78

SHA1
993f17dbe43e2a38e6f2f4e77a84dfdac149412c

SHA256
865579abbc79fa51b81a1f70e9491dcd462dfed7a3c5da30e1334c24b4891847

SHA512
56407b807fa4cbef9f3ecc54e4db5c9877a806e958b2a831e79cff843913a10d4f0d83669d681e49c86b340eb501add685f195ef0dc2a5e69f7d531738267a04

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-3.dll

Filesize
1.0MB

MD5
b9d23bfd582495a34097088ea3af38e3

SHA1
2f2268ccbd8d429a61fd505a0e45b2232c1c1596

SHA256
16d038301f3fa8f360ec0a7d11eea25c2c3ef92d67c95608b108801fd907bd23

SHA512
fa8f355364b70bd50d047d114880ed99485ad84dc5755b7177164028aeaa75ae427f1cb27e11dc8b457248ca2407b13b6f50b7a61d37686376b77aa4ba4e470b

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp

Filesize
445B

MD5
eec65015fb1e90aad5c53d216723fdc5

SHA1
b9fa378a60e4af116d088d519884d86f1d978f36

SHA256
f28a671f21e40b97a12e45455ccbffeafedcc9f566ff9d7d808049e8929b84d6

SHA512
aca61be1e8619e74afc00c645715e46975beebab31e6e5b3e7a4e0237f78f9e3e91cbf0b3e79ec97c1ddfe7b3791fad40f7729968da2cc9c5784169618e03314

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp

Filesize
122B

MD5
54835dd3e8977ecfa5983fdd7d7daa30

SHA1
9377cd842383430a1e015e98863e4b26976f5f8b

SHA256
6051acc0067e0e65cdcf10fc48e24374e8dcd4ff5e2e4ea6b7c7e4366b7e7fcf

SHA512
d9cc8e8370f4365b74077257a1b6d14b276846d39c73dbe25a28ae951e4acaaadce00f2b9673d34d6d9e66eb0e155507d28f337dffca914bc3b280ad5baf1452

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json

Filesize
32B

MD5
d3ea093599df7d2e13721f70eb75d676

SHA1
d524dc6cf5481c47c6e20c8abbc88342928d9596

SHA256
b127bde178006003cd19a51963371180cba042c95ad5146eaa3e0bcc8044f4fa

SHA512
23d61a20d0b5a6866f7d78e9a204153d596b9c77243c73cd7f020f00116da2fb75cf63900075534b7eb5c363cb942c05f627190c31e4f90787f4b35f0cf116d4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json.tmp

Filesize
1KB

MD5
795e22fd692909e3ca6048f58d3912a0

SHA1
dfc0a139ee1c4aeb26b340d77bf73e189327c7a3

SHA256
37e1a65211a69cd64f85f9bf74eb414f017102953588c9ffa867340f46a98e52

SHA512
6544ac7c171d5d8589a6c5d076642fc3731beedb42340f486b0199a045d6bf066f11c57b884c2e37fc8ed7fee4c47cc047492ed70ecbbf261a59dbfa5211c03a

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json

Filesize
84B

MD5
8cf25c76ed3ab488af51ebcc83aa6c0a

SHA1
82f883d723d1b0164b8ce9378f51247171739da4

SHA256
d61f80d3db54754abf65afd78ed030c13af70f3cf79470ced87603eb9497c109

SHA512
0190458c8483ed77f196b4e36158ae77f2d1b0791d7b44af3ae1269b82391d0c556e5c6bb9aeabb5c541b3239c1a6270cffc116df6c43e165cc46fee1517d40e

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp

Filesize
125B

MD5
d2fbadfbc6171678e9f5bdcb91a902a8

SHA1
849c3bc3fe2ce96108b566350acefd7f68fcc4f0

SHA256
312a5b46e23dcfbbf29992f6f88bacbe3d1c0f659a0625b886091469b8d6c04e

SHA512
7dd21ccf01d05620c4e14269dd171636a443a954bbda04960648975f1d196dfcd76d4db08c9fdc38ec4603fc24fe511bace6db32d022c2dd136f23558bc64167

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp

Filesize
185B

MD5
473cb71ea38af558dc6de81591dc05ed

SHA1
98d3329e9baa15495854b6bbbfe5a1b3aef61bf1

SHA256
5ed1133aec5c916a8aecfb59fd0c3164dc847baea7a2f7a8637a4c934bd63390

SHA512
9a96956bbbf87158256d660de93a3dc402ebe85da64b0ed943494c2a3e150fb8168374654481415fe3fae60818822409f2676f88ebf25e7bbadfed0334b77a95

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
08209213b54a1d97d057faa33cfb9b4a

SHA1
c295e82e10781c3e18c1f0fa2968c7f916598c53

SHA256
ff480d76f989dea2bb4891972bf5805692b4a6eadab3e1cf53da67a35347b849

SHA512
b55ebd6f6177401322f278d2f51da850605be5826a1a3b8b20e60515a16d98575aaa49dc37b5847ac0110d41276d0e764967731b55ade8d5f55a075753cee265

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
727B

MD5
2129be0059240c6b3c294e68bb7a9309

SHA1
7fd4d8ba2704a163f3063261126bbac66e6dccde

SHA256
e624ec3dc5f813a7c396c0991a7a7e337e161550c5acea923354bcd39f22df63

SHA512
eb305bcbb58b0ffe2485acb577a54c84f6f478fc4a01d5d0ea43f62b9ba2125184ad0aed8b8696b8b1be9b103508540370ca4f88fd540e8adfdd52ba4c22e1e3

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
4ab619a60a75290e45b22bc1fdc15772

SHA1
8fa448c2bf7427427ef47d6cfcb5b329e7a587f9

SHA256
9289950fd872dd8ec099717bf75578210a724ed7e76d3fb4334317e128b1a24c

SHA512
f7fcccd1605eb1d39ca3a2f0eb9ec9bc740dfed0e72e3bf8298befde5eae760abe6f485c35a84d875d216783ac75d9d563b5fa11b7fc4955683408cc68cd0282

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
98608067cc65d2b80a625e406f261584

SHA1
b7a79999bdc0cb1839f51dba2007b7ed6b030796

SHA256
a4cb615aab536e4dcddd14e442a645738843a7c2e5b966930321c4c6d7c98111

SHA512
431305b4f3a8c7e5e7eb545de3fb1dc99027e5292685499a6b7c97463fde63a2e6e15758542dbc1487923994a203ae2c48bba33a463ef0d65ca019f12203aacf

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
282797e6699b34ad6fae3aa1e4a9c10d

SHA1
aa9e9ff677dd09e3c1e88c9bacd4232eae85d675

SHA256
66f7e931f7c17aefb72e1410b83e364b4fc90f51cdd212e33f47e65fc65903c2

SHA512
3ed867ada646c9b059a943a459e1a435f9c7767d903499c4543a6647484f011ca31ea5d933d8fdc657a5eb145298cd6be95bef8ca250f482e2e604c1a8b5dbb0

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
d7ca8e5d7b97c325e38bad4422b106ba

SHA1
73cdbf222f8643dd6a4d97bd2d1313fa0d0eb567

SHA256
1d76e9fae37c34dd1d814363e8afa1e799f9b34a299803f07cf0348628a98bdc

SHA512
04ebd690cc3215e65c3ee74658155f6ef370b1eb567e2b2f4b7b1e555fc73986150a829d39733b116dee25c2632c9e3acffb7a6408467d13e711d4e97ec4d278

Download Submit
C:\Users\Admin\AppData\Local\GoToAssist Remote Support Installer\GoTo0001.tmp\UnattendedUpdater.csv

Filesize
2KB

MD5
b25fb94b24999759e05125c0c8f1c578

SHA1
42e2b419964c36eb0707f75e6ec2c9016951e268

SHA256
94fd4e2d8a471ad1b05b8accbff67995d3d1b662074f1eaeb9a15fe45f4a4dd2

SHA512
24c21158f66930b4686efddb58931f6be8040069ff0e8579e8f050ac6ed0e780b99f6cefcd7e81c862672da824304339245b594e7924eb1dee78f412e4bb8be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peam.exe.cmd

Filesize
537B

MD5
2d1ec5c3d0d2fd67e0aa148f4e523d93

SHA1
24a6528837fe7c825f44be9e0c2bd942203bb9b0

SHA256
5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b

SHA512
7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25

Download Submit
memory/2416-317-0x0000000000DD0000-0x0000000000E35000-memory.dmp

Filesize
404KB

Download
memory/2416-318-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/2416-321-0x0000000073960000-0x0000000073D92000-memory.dmp

Filesize
4.2MB

Download
memory/2416-320-0x00000000728C0000-0x0000000073855000-memory.dmp

Filesize
15.6MB

Download
memory/2416-322-0x0000000070CA0000-0x0000000070DAF000-memory.dmp

Filesize
1.1MB

Download
memory/2416-319-0x0000000073F10000-0x0000000074031000-memory.dmp

Filesize
1.1MB

Download
memory/2816-776-0x0000000000260000-0x0000000000379000-memory.dmp

Filesize
1.1MB

Download
memory/3012-309-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/3012-308-0x0000000000450000-0x00000000004B5000-memory.dmp

Filesize
404KB

Download
memory/3012-310-0x0000000073F10000-0x0000000074031000-memory.dmp

Filesize
1.1MB

Download
memory/3012-312-0x00000000728C0000-0x0000000073855000-memory.dmp

Filesize
15.6MB

Download
memory/3012-311-0x0000000073960000-0x0000000073D92000-memory.dmp

Filesize
4.2MB

Download
memory/3384-774-0x0000000000260000-0x0000000000379000-memory.dmp

Filesize
1.1MB

Download
memory/3816-775-0x0000000000260000-0x0000000000379000-memory.dmp

Filesize
1.1MB

Download
memory/3908-768-0x0000000000260000-0x0000000000379000-memory.dmp

Filesize
1.1MB

Download
memory/4760-770-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/4760-825-0x0000000000750000-0x00000000007B5000-memory.dmp

Filesize
404KB

Download
memory/4760-771-0x0000000073F10000-0x0000000074031000-memory.dmp

Filesize
1.1MB

Download
memory/4760-772-0x0000000073960000-0x0000000073D92000-memory.dmp

Filesize
4.2MB

Download
memory/4760-829-0x00000000728C0000-0x0000000073855000-memory.dmp

Filesize
15.6MB

Download
memory/4760-769-0x0000000000750000-0x00000000007B5000-memory.dmp

Filesize
404KB

Download
memory/4760-827-0x0000000073F10000-0x0000000074031000-memory.dmp

Filesize
1.1MB

Download
memory/4760-773-0x00000000728C0000-0x0000000073855000-memory.dmp

Filesize
15.6MB

Download
memory/4760-826-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/4760-828-0x0000000073960000-0x0000000073D92000-memory.dmp

Filesize
4.2MB

Download
memory/4760-805-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/4760-815-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/4924-799-0x0000000000260000-0x0000000000379000-memory.dmp

Filesize
1.1MB

Download
memory/5104-328-0x0000000074050000-0x00000000751D0000-memory.dmp

Filesize
17.5MB

Download
memory/5104-331-0x00000000728C0000-0x0000000073855000-memory.dmp

Filesize
15.6MB

Download
memory/5104-330-0x0000000073960000-0x0000000073D92000-memory.dmp

Filesize
4.2MB

Download
memory/5104-329-0x0000000073F10000-0x0000000074031000-memory.dmp

Filesize
1.1MB

Download
memory/5104-327-0x0000000001000000-0x0000000001064000-memory.dmp

Filesize
400KB

Download