229cfe6fd7e042b7b73d2cb84fb75f04778740d7f5dfc234850706a5f48ffb96

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Peam.exe
Size

20.6MB
MD5

66dd4a784a2f05ccde36c2aebd5ade99
SHA1

3e654231d413eed3bef307fa8aaf2377c9ccc934
SHA256

229cfe6fd7e042b7b73d2cb84fb75f04778740d7f5dfc234850706a5f48ffb96
SHA512

224b6611312cbfab62c2587d11ec7100246b655f0ce76a0c9f81b43fc6403d8a85b6c9f00ace3ff3c96fa799f8481a36495548e51848e3f00f61077e04d3cce6
SSDEEP

393216:Aq+Jsv6tWKFdu9C2KS1P7nEscpZr8LE10MT4xwGyxBKP1JztKuUyvUTAzayj+lhe:hP1nxcpZ9z4xsB4z/JvUTWZjlXykJ

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	GoToAssistUnattended.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook32.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x32.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-3-x64.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM32.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x32.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook64.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\legacy.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-3-x64.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM64.exe	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\old\5.12.1.3601	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM32.exe	Peam.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json.tmp	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook64.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook32.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook64.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll	GoToAssist_Remote_Support_Unattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM64.exe	Peam.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-3-x64.dll	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\old\5.12.1.3601\GoToAssistCrashHandler.exe	GoToAssist_Remote_Support_Unattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp	GoToAssistUnattended.exe

Executes dropped EXE 17 IoCs

pid	Process
3784	GoToAssistUnattended.exe
4212	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2376	GoToAssistCrashHandler.exe
2052	GoToAssistUnattended.exe
1396	GoToAssistCrashHandler.exe
1116	GoToAssistLoggerProcess.exe
2308	GoToAssistCrashHandler.exe
3728	GoToAssist_Remote_Support_Unattended.exe
4632	GoToAssistCrashHandler.exe
2408	GoToAssistProcessChecker.exe
2056	GoToAssistProcessChecker.exe
4224	GoToAssistCrashHandler.exe
1924	GoToAssistUnattended.exe
1984	GoToAssistCrashHandler.exe
2560	GoToAssistLoggerProcess.exe
388	GoToAssistCrashHandler.exe

Loads dropped DLL 40 IoCs

pid	Process
3784	GoToAssistUnattended.exe
3784	GoToAssistUnattended.exe
3784	GoToAssistUnattended.exe
3784	GoToAssistUnattended.exe
4212	GoToAssistProcessChecker.exe
4212	GoToAssistProcessChecker.exe
4212	GoToAssistProcessChecker.exe
4212	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
1116	GoToAssistLoggerProcess.exe
1116	GoToAssistLoggerProcess.exe
1116	GoToAssistLoggerProcess.exe
1116	GoToAssistLoggerProcess.exe
1116	GoToAssistLoggerProcess.exe
2052	GoToAssistUnattended.exe
2408	GoToAssistProcessChecker.exe
2408	GoToAssistProcessChecker.exe
2408	GoToAssistProcessChecker.exe
2408	GoToAssistProcessChecker.exe
2056	GoToAssistProcessChecker.exe
2056	GoToAssistProcessChecker.exe
2056	GoToAssistProcessChecker.exe
2056	GoToAssistProcessChecker.exe
1924	GoToAssistUnattended.exe
1924	GoToAssistUnattended.exe
1924	GoToAssistUnattended.exe
1924	GoToAssistUnattended.exe
1924	GoToAssistUnattended.exe
2560	GoToAssistLoggerProcess.exe
2560	GoToAssistLoggerProcess.exe
2560	GoToAssistLoggerProcess.exe
2560	GoToAssistLoggerProcess.exe
2560	GoToAssistLoggerProcess.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Peam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssist_Remote_Support_Unattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2576	timeout.exe
2720	timeout.exe
4736	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv"	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToAssistUnlock64.dll"	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment"	GoToAssistUnattended.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2052	GoToAssistUnattended.exe
2052	GoToAssistUnattended.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe
2700	GoToAssistProcessChecker.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 3784	280	Peam.exe	78
PID 280 wrote to memory of 3784	280	Peam.exe	78
PID 280 wrote to memory of 3784	280	Peam.exe	78
PID 280 wrote to memory of 3320	280	Peam.exe	79
PID 280 wrote to memory of 3320	280	Peam.exe	79
PID 280 wrote to memory of 3320	280	Peam.exe	79
PID 3320 wrote to memory of 2576	3320	cmd.exe	81
PID 3320 wrote to memory of 2576	3320	cmd.exe	81
PID 3320 wrote to memory of 2576	3320	cmd.exe	81
PID 3784 wrote to memory of 4212	3784	GoToAssistUnattended.exe	82
PID 3784 wrote to memory of 4212	3784	GoToAssistUnattended.exe	82
PID 3784 wrote to memory of 4212	3784	GoToAssistUnattended.exe	82
PID 2700 wrote to memory of 2376	2700	GoToAssistProcessChecker.exe	86
PID 2700 wrote to memory of 2376	2700	GoToAssistProcessChecker.exe	86
PID 2700 wrote to memory of 2376	2700	GoToAssistProcessChecker.exe	86
PID 2700 wrote to memory of 2052	2700	GoToAssistProcessChecker.exe	87
PID 2700 wrote to memory of 2052	2700	GoToAssistProcessChecker.exe	87
PID 2700 wrote to memory of 2052	2700	GoToAssistProcessChecker.exe	87
PID 2052 wrote to memory of 1396	2052	GoToAssistUnattended.exe	88
PID 2052 wrote to memory of 1396	2052	GoToAssistUnattended.exe	88
PID 2052 wrote to memory of 1396	2052	GoToAssistUnattended.exe	88
PID 2052 wrote to memory of 1116	2052	GoToAssistUnattended.exe	89
PID 2052 wrote to memory of 1116	2052	GoToAssistUnattended.exe	89
PID 2052 wrote to memory of 1116	2052	GoToAssistUnattended.exe	89
PID 1116 wrote to memory of 2308	1116	GoToAssistLoggerProcess.exe	91
PID 1116 wrote to memory of 2308	1116	GoToAssistLoggerProcess.exe	91
PID 1116 wrote to memory of 2308	1116	GoToAssistLoggerProcess.exe	91
PID 3320 wrote to memory of 2720	3320	cmd.exe	92
PID 3320 wrote to memory of 2720	3320	cmd.exe	92
PID 3320 wrote to memory of 2720	3320	cmd.exe	92
PID 3320 wrote to memory of 4736	3320	cmd.exe	93
PID 3320 wrote to memory of 4736	3320	cmd.exe	93
PID 3320 wrote to memory of 4736	3320	cmd.exe	93
PID 2052 wrote to memory of 3728	2052	GoToAssistUnattended.exe	94
PID 2052 wrote to memory of 3728	2052	GoToAssistUnattended.exe	94
PID 2052 wrote to memory of 3728	2052	GoToAssistUnattended.exe	94
PID 3728 wrote to memory of 4632	3728	GoToAssist_Remote_Support_Unattended.exe	95
PID 3728 wrote to memory of 4632	3728	GoToAssist_Remote_Support_Unattended.exe	95
PID 3728 wrote to memory of 4632	3728	GoToAssist_Remote_Support_Unattended.exe	95
PID 2056 wrote to memory of 4224	2056	GoToAssistProcessChecker.exe	98
PID 2056 wrote to memory of 4224	2056	GoToAssistProcessChecker.exe	98
PID 2056 wrote to memory of 4224	2056	GoToAssistProcessChecker.exe	98
PID 2056 wrote to memory of 1924	2056	GoToAssistProcessChecker.exe	99
PID 2056 wrote to memory of 1924	2056	GoToAssistProcessChecker.exe	99
PID 2056 wrote to memory of 1924	2056	GoToAssistProcessChecker.exe	99
PID 1924 wrote to memory of 1984	1924	GoToAssistUnattended.exe	100
PID 1924 wrote to memory of 1984	1924	GoToAssistUnattended.exe	100
PID 1924 wrote to memory of 1984	1924	GoToAssistUnattended.exe	100
PID 1924 wrote to memory of 2560	1924	GoToAssistUnattended.exe	102
PID 1924 wrote to memory of 2560	1924	GoToAssistUnattended.exe	102
PID 1924 wrote to memory of 2560	1924	GoToAssistUnattended.exe	102
PID 2560 wrote to memory of 388	2560	GoToAssistLoggerProcess.exe	103
PID 2560 wrote to memory of 388	2560	GoToAssistLoggerProcess.exe	103
PID 2560 wrote to memory of 388	2560	GoToAssistLoggerProcess.exe	103

C:\Users\Admin\AppData\Local\Temp\Peam.exe
"C:\Users\Admin\AppData\Local\Temp\Peam.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:280
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe" -regsvc
  2⤵
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -regsvc -expectadmin -starterpid 3784 -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType 4
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\Peam.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\Peam.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2576
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2720
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4736

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=version=5.12.0.3440 --initial-client-data=0x528,0x52c,0x530,0x500,0x534,0x74a54574,0x74a54584,0x74a54594
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "2700" "-WtsStartingUsername" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Drops file in System32 directory
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=installationid=HZfL4rHct9 --annotation=version=5.12.0.3440 --initial-client-data=0x550,0x554,0x558,0x528,0x55c,0x74a54574,0x74a54584,0x74a54594
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:1396
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -ParentProcessId 2052 -CompanyId 3125152135071953924 -InstallationId HZfL4rHct9 -MonitoringUrl https://dumpster.console.gotoassist.com -HostId 0405f273e88700e2ba1b12dbb95a6779 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log" "--attachment=attachment_logger.json=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924\logger.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=installationid=HZfL4rHct9 --annotation=version=5.12.0.3440 --initial-client-data=0x4e0,0x4e4,0x4e8,0x4b8,0x4ec,0x74a54574,0x74a54584,0x74a54594
      4⤵
      Executes dropped EXE
      PID:2308
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\xAxPSQDXYM\GoToAssist_Remote_Support_Unattended.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\xAxPSQDXYM\GoToAssist_Remote_Support_Unattended.exe" -ServiceName G2ARemoteSupport_3125152135071953924 -wd "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -updateMode -updateMode -CompanyId 3125152135071953924 -InstallationId HZfL4rHct9 -MonitoringUrl https://dumpster.console.gotoassist.com -Lang en -Offline 0 -ServiceName G2ARemoteSupport_3125152135071953924
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\xAxPSQDXYM\appdata\UnattendedUpdaterCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\xAxPSQDXYM\appdata\UnattendedUpdaterCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=installationid=HZfL4rHct9 --annotation=version=5.12.1.3601 --initial-client-data=0x324,0x328,0x32c,0x31c,0x330,0x12b6a44,0x12b6a54,0x12b6a64
      4⤵
      Executes dropped EXE
      PID:4632

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2408

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=version=5.12.1.3601 --initial-client-data=0x524,0x528,0x52c,0x4fc,0x530,0x6f824574,0x6f824584,0x6f824594
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:4224
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "2056" "-WtsStartingUsername" "QUPHTQUR\Admin" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=installationid=HZfL4rHct9 --annotation=version=5.12.1.3601 --initial-client-data=0x558,0x55c,0x560,0x530,0x564,0x6f824574,0x6f824584,0x6f824594
    3⤵
    - Executes dropped EXE
    PID:1984
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -ParentProcessId 1924 -CompanyId 3125152135071953924 -InstallationId HZfL4rHct9 -MonitoringUrl https://dumpster.console.gotoassist.com -ApplicationType 4 -HostId 0405f273e88700e2ba1b12dbb95a6779 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess.log" "--attachment=attachment_logger.json=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924\logger.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump --annotation=format=minidump --annotation=hostname=Quphtqur --annotation=installationid=HZfL4rHct9 --annotation=version=5.12.1.3601 --initial-client-data=0x4e0,0x4e4,0x4e8,0x4b8,0x4ec,0x6f824574,0x6f824584,0x6f824594
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe

Filesize
1.1MB

MD5
454cc5ad59a1c6748834fdfe1350a6b3

SHA1
12f165e17e9b191f3f7e784b3b87bcc2ddb56d80

SHA256
303d733b4a54ab08a6308ad50779a3fc6e3d9a8f07248bf12ea69aa425d42bc2

SHA512
71fb8440500343e0a11b13b27708fdac87f610e3fcd313978fe39f02131cf1f7eee7243880b0356ebbb5a2b909b6926ca9b559b2006348115c9b69e775930227

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
401KB

MD5
f70be96a4234a01e3925ab963b58360a

SHA1
80124b0010198b3fd836959d8997fb7f9d79cc64

SHA256
b3b00144ecbb776475eea8b8344be7cded2c401b0287ecc512f3fc064fd43033

SHA512
99ad916980db9cf524a663eb28a6527936a111c7603cc12c763e589d481326fa8cabe0b9a1ea78d2680518e90b0b5bef8d8d4b460b5801c37ede1b4d2fbb3667

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
401KB

MD5
682062ae46607a596e687f3edda987ae

SHA1
d7611bd2b3bbb0441c6b25e8cdd09c5e836656c4

SHA256
5743d0dac5ccb74b4a2f57c6cba5b6bf0078464d0ba4b8dd2fc92d107d49828d

SHA512
1d2c6d77fe01cb9380d33d76d6ae55dc2d9a1ea88f442103302bf8ba7f0e08e3826e8ca526a57658c0f569e83798e3476df0b7d7ffbc51d4b777fd729ddb5ab7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
400KB

MD5
d35e40946b9576199c40a6aa178f2d5f

SHA1
fc69faac029b9a44a9b38982b678ce0a8e5ae287

SHA256
0edf36ec7e7499f6d91d4e6b1beb6dffc68fe1c0bf2ea5276e9a35b937a1b38a

SHA512
0fc19801c0e70f66d97725bb33790afacc4edc84de8d284f885d5919fbcdcb0885ced3082449676dc8150930cc11286b665b1607e550502a1ef22d7df3b27f16

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
400KB

MD5
6d8ea3e93cc80a9d2dd8c0c630fb8802

SHA1
13725a1865732a3cf395c42ee548410135f61520

SHA256
ef74976546d4a9236974fcec9e9f3e1866691d7e04e075426fec5b2c9d452ac4

SHA512
08285905059d1ce99b8760befeac3396f6d73168abaddd85ae577c4622cafa8f23d779dea303aa0df24eab80c1b32a8994588c12d4970065ee3aa9ebc5043498

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe

Filesize
1.0MB

MD5
6bad63ccb15e20e0dd3d1fbe4a95262d

SHA1
4ff2297af7475ffa0fdb5c46fa4d3763ec50a2f6

SHA256
2275209ee480a291afd2c14246491b0d5aa1c915672c085ed3277a334cd76100

SHA512
2f3c533864a5f4574c6a296d94fd9e3fe175b7092ac5084b6a5240792df5a624c1cc08d1c58cc94d82140d31ce0251dc2d999bef2e870971853508ce11c2141b

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe

Filesize
1.3MB

MD5
fae009795550682c2e75ecbb26812b18

SHA1
bd36784c5ac0c80849d9ad4236d8298a660341dd

SHA256
60d95f9b91758ce62dc998dd54a56c8d5084c169f99ca51097e96887a17132cf

SHA512
82498810a0802767c79cc43e8a13139a297de61e36a2329a6312122712c1ce30e014c150de3281faa51e2e24ae5fb7ed93cde35ace4b656d209fe9423f1b9f0d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe

Filesize
401KB

MD5
0fa46cd4f59fcf77dd6620b66226362f

SHA1
0918f1cff836b75836325a3490308cd45c0e7c3e

SHA256
9932d84bcd4e26897ad0001d0350b476fc03e73a5358c41b078c0edefcaa2828

SHA512
a673c21185e0b9617ca710109c0327a04b69e7a83e245900332495a8280b73fa638a08fea2f184de8810ad1cde4a77e846c9df7041ed00879cc038927f62cf10

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe

Filesize
401KB

MD5
9a05d066b6e1f581809b26c238e1f634

SHA1
7ae1720fa1965945160014efe07c5385d00852f5

SHA256
a854c5a6f4d52ff37c62d254fb0b12efd15eaa4e7a22324cffd224839145f231

SHA512
2d1eb260c1721d994fa929b717c12b5d7ef64dffb1b4231d2109d5ce3bd946ed6ed5fd5b867dff447ae4158fb7e52a323c5b2facfe0bba53f819508e45f29610

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe

Filesize
400KB

MD5
33729091b2632150acf6327a37919e60

SHA1
0d215434161bb1b64b9f4bea8a84501139b7494d

SHA256
5ee9af795bdf815f6b6c69c1f220160bbab3f1ab2d211ef4e2b07a6791bb75a4

SHA512
2af502291f457c15e0b37c1e5127df69a635fe1a415c1153648500c0b6e971ba507f8cd4cedc92f08b9577e7e181abbd3db0d4e9b488f0661b554772f8bd5513

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
401KB

MD5
1626b25bbac17be7d08aa091f47a175c

SHA1
95247f262e1f95ea4657d2a6a1869b369bc19db8

SHA256
627ab0df66312319741a69da6fc5a77f10301c76547a3fabaf4e0a416dee2c10

SHA512
f9e423ecdcb3cd0f91bcc9dbac71bca9ecf78ad42e83fd82e737edca50e7558931edf0c7547f828c1d28c6613ec089ab62ef8e539b75ac2c48bf9a82afab0cc1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
401KB

MD5
3671b81de11a612d3a339a351fcf9f06

SHA1
505245eaab2cee1bcb8ce51229dda467458686b8

SHA256
bb9a73815cc3b262d79420a15731f7083ae03b5f3fcdd774d2604e1598678cb2

SHA512
369d0753b0f4d2292ec20d0dced0a842e1f4925f1e680638d836f741f010956d802e658e9be2837e292c4e2978df73b3a04f40415cacd169b44fd350924a8201

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll

Filesize
108KB

MD5
decd9ebc95d53cc41a0b974e49f642df

SHA1
af7a1fc531ef93c494ab5518897c0262921145ec

SHA256
454af5be3500704656779eb3833824dee1e25d742b1608869362e5160fead3d6

SHA512
64acec6e5562ce83bc620d3274584abb6a1bd166a583adf3a8a41a4a5e52757b71c7a671399d8afaf6999140c209a802c251d4d62053b006de592a6cc92d7b5b

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll

Filesize
142KB

MD5
23a642cab02d4c85d586627b560ed57d

SHA1
34f1dee26bb19d6ec32280a098f905e62521983f

SHA256
cfe5de2b8c591387f7d338b6193aa53997a1384a35579d361c73646f62375c3b

SHA512
076fd123956ad87e6208a71c65bde5662fb89dc09dca09e1d1ed103cdd53015cbdf0ea904754102eeae86508ca0e9d0b38fc1924b65d9d451cade5ac7d0b364d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook32.dll

Filesize
120KB

MD5
a6417cee466f30e0d7811951383301c8

SHA1
53ab48ba02fd2c5f1d0a47cdca294d73a9fa03bb

SHA256
6f9e28e493f73b03b060b8a4810fe9c91971b393455cb47d6f2a6cf2710acc57

SHA512
e9f0622a41eaea7610f6ec4c865063fd01c6010f0736e7587aaa81269d3450766114bf501cf93bd8cfdc2b00b428c4321c40d16725190b05622fa758981a0e87

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook64.dll

Filesize
134KB

MD5
a6d023cf8bdd4408e7c03fdbd5455558

SHA1
d120d432662135f4642958859deba1c853d4d99d

SHA256
6c4686ddea4d765ad66146c77f8c9ce1a84fc2c73d585b778c055635f35e5b95

SHA512
15607c7780cf034e457b2efe255ffb11c940988fdb647f06a92bddc1247b63a5dc8b59f3be36cda19cda73cfb90846807ca86e3e9c9e8bb8f803958f3aeb7f42

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll

Filesize
118KB

MD5
53ad329542c952cb5c3663ad753d8f17

SHA1
92503093ef13960aeee2a67815b6d21e26981751

SHA256
bfb6a5a12a0ccdefb51c6622221a21e10d426f7250c8de62e6b00510955a5dc1

SHA512
39be99eea91794d768039fa6008f629b1c57433dec917fed24bd8689fa19c1ade3f985f1d269a66751bada1f95cc3bb1d50ecb876022db8f464b2927f5502ec2

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll

Filesize
17.4MB

MD5
78d1fc04af8eb213a91924dc5f093028

SHA1
e816555ab1bdf7b652076e9f307025519ccb58ba

SHA256
c72ec9eee570f144dd318c404438dfa718dd7d612f8b5e89c397615de695bc5d

SHA512
5472bb7968b779ecef05eacf940b866a2d21bee18b575eece57212a7d9e489e8f41e28eb621c670559663b4c900ab162f3510bfd227902916fd6523d7e8441d4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll

Filesize
13.9MB

MD5
2770f365cd1316969bb36a9f10387c9d

SHA1
b98c630287c28f21397802e28b924db8e4fdb7a6

SHA256
80bba06e2b4385da16b239698a8b7cec0e08e56437e39e18e584c91ea2c03123

SHA512
5aef848e82074c8a64b3c3a89395f4a87d4d8b893373431fc995c76334c0f69bf64a7d2b84f7e48e2869fecf6fe8770706ed23d2dc7e3358aec346d9f9665638

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll

Filesize
1.1MB

MD5
d9223c3601a1318b82f57c02c74066f0

SHA1
47d6ff9c4ddcb9f6be93f0bfd80d797e741b359e

SHA256
5d84c724071155d1306d0b61c80d298cf4e7a8a46a463cc7b4269f3ef45c787a

SHA512
bbab5d9ad02ae412d4c0fb8ae7d96082d158f833dc5acbfa3729f31af0ac2d993fdcd9ad169dfc70caef22c852d883ce3bef8851e74dce0ae75e8cd64a7bbcbe

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log

Filesize
4KB

MD5
5f0088dd2a755f68569c8b0387d4bade

SHA1
86adc2f1ccc5555f7717857247b50bcff1e9768a

SHA256
0d78928d7a0427fde408b8651e8071c0516046b5debdcabca002e5d50d063a41

SHA512
b495617101b2eb2208add4288046e7ffc065802c7ef4d6103e8b18ac46f55e24fff7750b40059fd634ee9af325a45de9b5612f0345dd4ec4510a614eca35845d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log

Filesize
15KB

MD5
fa1d1a273b3299772c9888db2704d2f0

SHA1
f6aea5aea920889173f2ce5ac32e1693b2b6d575

SHA256
f05821da79923efd261fbc13f6e221bdb8f686bc7d6f2dff316904b0e90bc73a

SHA512
989e7c129c502b3048775d69c765e04169bf148dc55e2cbe4518208d3d7659f5fad7c9bc622726d6b29da3b88212df31cba592867f0cd7718772a22de6688240

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv

Filesize
3KB

MD5
33e88ba91b6cf405ea284bcfcb215790

SHA1
505033f9f7de5fbe9f827e61b80b8cd29b37d190

SHA256
bf95ea66562624b354ab9dec3fec5baa32bb68a31ea7167a0c687655b7746aeb

SHA512
b56780bb319bae1613041b08a5c1a31491e8eb432f8b4730278f04dd1d26685d9bf6489719fcfd3faf0eb262184dad857ec173e53aa1ef352ca04e67d83ef494

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log

Filesize
3KB

MD5
4326fd0391947e3894336628b7d1ecf3

SHA1
dc9cbac0be3869b317cc69ec0b045bc7b5eb8263

SHA256
dc27c125b4c072be22df8b77ae4a1ddb850b76f96bbf3eef1bf6120ac330f5be

SHA512
7fb6c12ca0e8224f48e78b1d062cc8ac957e53452eb75fe8431be8ed5b03f6f116f00590efc57c1f2052b19f507474b8200727576b09133627b430acdc37e223

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\downloads\xAxPSQDXYM\GoToAssist_Remote_Support_Unattended.exe

Filesize
20.6MB

MD5
1dd8e77bf12e1ec40671215302bf61ba

SHA1
19377b815d2361d3f268528e6141af316fc10026

SHA256
0d98502b1a9f5d5d5c85c1e460e28d8cb0ff887147c502cd11aaafaab8f8524f

SHA512
c656be9f32906fe27fa473040faa2568e8424ee1794c26f34a045839759a85ae7123a147d1d095a8ed43eb92617fb2163b5daf99c7f6985dc96cc25ce7325c34

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\legacy.dll

Filesize
559KB

MD5
32342b64c6d733622c8b716b8095f383

SHA1
0fe4ba01bbaaf04fbc08eeb45461a988c12a69ee

SHA256
c0ab6f151a41a73bec528438ff1aad7a479c9a0ea35cddf26c270a0d327d1433

SHA512
46a185334a388b3d34a5b050f425cdf328078d9b7053363ab2568abecb284387d8aadffb394a91eef5a3a7dce8c99a12daf9ec4ee7b80014993f048dd727c112

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-3-x64.dll

Filesize
5.7MB

MD5
83363ca96b19890720ff2c584f86071b

SHA1
199e9afa3b24380bc2c6eb735e11f7b506d57a9f

SHA256
6eb662dd4c21006da585bf398a4b25cf52be533f7b08005c49f7a62a7375645c

SHA512
2d23bc56c22576f890ca4454fd2c9954097ab5e3d624fc93ed5ba7cd48bd6dbfca97f8ad21a7a3f947b6f6dd189f15bb2f788834990dd87f6b40de829d117a9a

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-3.dll

Filesize
4.2MB

MD5
1849082db4ca1d32afaf3df0ad2e6a78

SHA1
993f17dbe43e2a38e6f2f4e77a84dfdac149412c

SHA256
865579abbc79fa51b81a1f70e9491dcd462dfed7a3c5da30e1334c24b4891847

SHA512
56407b807fa4cbef9f3ecc54e4db5c9877a806e958b2a831e79cff843913a10d4f0d83669d681e49c86b340eb501add685f195ef0dc2a5e69f7d531738267a04

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-3-x64.dll

Filesize
1.3MB

MD5
09da2c1e7e8d96d9b8d61174b2ee731c

SHA1
7ae4dfe02d9bd37729f55490333f486e37618bae

SHA256
c34331c4907dd79a0c46c40f535ffe0fc35410ea9edbb3a38484d4598a64dd59

SHA512
5778abf37091cc76150176bd522e981d95cdf8bab1cbea14af92cec49d6141f38ae752c21e5fda8927d8210132ad43c9b9f6cb861726a2322d3a3d09f8ca846a

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-3.dll

Filesize
1.0MB

MD5
b9d23bfd582495a34097088ea3af38e3

SHA1
2f2268ccbd8d429a61fd505a0e45b2232c1c1596

SHA256
16d038301f3fa8f360ec0a7d11eea25c2c3ef92d67c95608b108801fd907bd23

SHA512
fa8f355364b70bd50d047d114880ed99485ad84dc5755b7177164028aeaa75ae427f1cb27e11dc8b457248ca2407b13b6f50b7a61d37686376b77aa4ba4e470b

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\logger.json.tmp

Filesize
340B

MD5
b4aefa2ead479613a8681e30bcb443db

SHA1
321e03d98023ca59f4fa65460e9de09ed6592447

SHA256
0ff4178afc797a76469f4d189968cee71694a3d06591983c951afb38af447e7c

SHA512
7df49cd7d42b665de5b7c7bd8ef955e7ad269d9383c3bf6ded247ebe43a1febae7c095480c7c73342582429766caa093f256a356a35995247890a14d8fe80eba

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json

Filesize
32B

MD5
d3ea093599df7d2e13721f70eb75d676

SHA1
d524dc6cf5481c47c6e20c8abbc88342928d9596

SHA256
b127bde178006003cd19a51963371180cba042c95ad5146eaa3e0bcc8044f4fa

SHA512
23d61a20d0b5a6866f7d78e9a204153d596b9c77243c73cd7f020f00116da2fb75cf63900075534b7eb5c363cb942c05f627190c31e4f90787f4b35f0cf116d4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json.tmp

Filesize
1KB

MD5
0a377cb29eef15c2a7ae179a495f7693

SHA1
488389e27d2e963fdcbdbf3aca31f1fd0a7175c5

SHA256
9cd8ca1907a5bd17b77a15388ffbc86bb06b975df325d62d683c6e899250fe99

SHA512
b0d8465befda8d27cdb65588e0558249416dc09a7dae4ef5c2f973fc7dc0b2512b63a2f0345231f29b4228206784e1186fefcd76e6bc21b7b9d25647db2128d1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json

Filesize
37B

MD5
8de92e3b1f3ee7bb1e7b2003cb49d51f

SHA1
1cc71945eb1c08727606a9ef3477b78e77ad2a3b

SHA256
4c2cff2e491745a9fd06a43d07e5126e0a8ce18be8bf2760e2d8a6fb50ab6179

SHA512
47abd4f938bd1a40b6695f19e1a1e417667fe5de0bdb27cbce72f63fee9934148f8e8438a5361faf74b602bc59768a7b29d9ffcd8b31739e3dac298345ad7be9

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp

Filesize
91B

MD5
14daabb836f4f7c8d32dd0e1abd5b2a0

SHA1
306fa77f7e8df54e45b6e5601026bee6df7d770e

SHA256
737ed2b21ccf35a7174659f98ea686709b229edceab150f4dd27d640f9280238

SHA512
5ed36e8af07f38c0c5c1c59fcc8b5602cc91ef4ad94cc85c3db61594c11d55fcaeac33579e76f0cdb48390fc627c0cf0aa4f406d0db6ad378e2c6f5928b94e04

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json.tmp

Filesize
170B

MD5
0bfdfd4f414160ce87d98c7564541c27

SHA1
cc7605d9329c34bde10caf5b3b1cf8dde704fd9d

SHA256
23df548137ed7127615a57cd13851d4d3147be5e602e394e655ed1ff2f1b5ce9

SHA512
d909d8d1bd066ae20bd61f522c9a72a8901721c1715c1f5afb100332e0951f27b83ca0b6f31185ec128231ca98dcca2816c5a5c621fa3f186b6056ecc2813eb1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
727B

MD5
2129be0059240c6b3c294e68bb7a9309

SHA1
7fd4d8ba2704a163f3063261126bbac66e6dccde

SHA256
e624ec3dc5f813a7c396c0991a7a7e337e161550c5acea923354bcd39f22df63

SHA512
eb305bcbb58b0ffe2485acb577a54c84f6f478fc4a01d5d0ea43f62b9ba2125184ad0aed8b8696b8b1be9b103508540370ca4f88fd540e8adfdd52ba4c22e1e3

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
827B

MD5
0efc75fba8860afd9a512f467628c0cb

SHA1
b6c53697e2334c7ba8fe437a810274f7d845d8cb

SHA256
bd49166ab65df740e00f89c964921489df0af62ec9e9a69eadd54eedeb9a34ae

SHA512
7dc2e71e8685bdd40b439a40da8700b0e81f14c1721ab5b129521e6f8e9cbab6465591c519e7ef338f4be114234e947eb57439eabe821643185052c60500159e

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
753e85bdca5b18c0239adb720a6c8b89

SHA1
2a96acf58b51498f2c054e8ac117b481e845a091

SHA256
181b4666a18f871b9f4294e54e7afcf345ac29826c54a981606f75d23404df25

SHA512
246a81857fe18e75c746a26fd34f87b18c73bed2d6f3a630d31c1ff4de24090b9cb7699e7a6b80ba866f640f4aa826747e7c16752a7e276e98d5a560a58ee5d6

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
4f6e01b2700753ab42fdc004729fe7a6

SHA1
2e7e45ee2d303a7e902db5fbe8d612490444091a

SHA256
2709bda84dd358c9024ca8e5862ba2aefd1358f3467425f836b2299c75f7b829

SHA512
0b65236c0b4e7b9b2182f572be068468a53c0bc62c5e9579a331c3ece8d2dc48a5ff9dd38789e0cb3860bc75fa18d026ca57c0504bc68b712deed0dfcd6d3c5c

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
195c8158fb537a883c02bc82e7bdd851

SHA1
bb5f394be5a92351213e59397ddf81497b17b284

SHA256
017057b72f6b8b8c099b6c33bf9b9bb39b1e00fbd34199fe6b8f0feafd4567df

SHA512
5d3df33f0e64390ce6a4955588d8bb634cfb66c2807999ca4dd5cdaf152f1b97ef9f997fcf70ea9d464ca37c5afdc229985d0f1a251195163663d637fe11ad83

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json.tmp

Filesize
1KB

MD5
0c0554d1d7f2e4e8ada368146ad9dcff

SHA1
48d1023c088c6c9d3ae80713e32b3c55d13205d0

SHA256
2bcd0144c52f88459384a982e5ccd845b1974257aca2c1ae964df10781375d74

SHA512
a505f380e00c48d13a48e503b9b85db67a3042bbc20acae316f5babbdd709057288097fd9c99fe0dfc572b2d8b57e59b98ca033e81eed9a6ef7694224e926d58

Download Submit
C:\Users\Admin\AppData\Local\GoToAssist Remote Support Installer\GoTo0001.tmp\UnattendedUpdater.csv

Filesize
2KB

MD5
cca9a169aa37f61d0b534edf3a1bda99

SHA1
a34ed067fdd301fb16d2533aa5c2761f684cf09d

SHA256
00a03bbeea64c3c97f31a5befaf4771099e685bb06d45ab2b2b1e52ec7415f7b

SHA512
2560f79a967159cde039bcfd056d56c4d73043550e6317d180b7ddf6f5f63c5866c4e68c44b03ed7f5bd8a194c8bc3f28722173d533c9e0ec385979d1eb22106

Download Submit
C:\Users\Admin\AppData\Local\Temp\Peam.exe.cmd

Filesize
537B

MD5
2d1ec5c3d0d2fd67e0aa148f4e523d93

SHA1
24a6528837fe7c825f44be9e0c2bd942203bb9b0

SHA256
5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b

SHA512
7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25

Download Submit
memory/1116-318-0x0000000073870000-0x0000000073991000-memory.dmp

Filesize
1.1MB

Download
memory/1116-320-0x0000000071620000-0x00000000725B5000-memory.dmp

Filesize
15.6MB

Download
memory/1116-652-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/1116-655-0x0000000071620000-0x00000000725B5000-memory.dmp

Filesize
15.6MB

Download
memory/1116-316-0x0000000000F30000-0x0000000000F95000-memory.dmp

Filesize
404KB

Download
memory/1116-654-0x0000000073280000-0x00000000736B2000-memory.dmp

Filesize
4.2MB

Download
memory/1116-319-0x0000000073280000-0x00000000736B2000-memory.dmp

Filesize
4.2MB

Download
memory/1116-317-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/1116-592-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/1116-653-0x0000000073870000-0x0000000073991000-memory.dmp

Filesize
1.1MB

Download
memory/1396-315-0x0000000000C40000-0x0000000000D59000-memory.dmp

Filesize
1.1MB

Download
memory/2052-313-0x0000000071620000-0x00000000725B5000-memory.dmp

Filesize
15.6MB

Download
memory/2052-314-0x0000000070850000-0x000000007095F000-memory.dmp

Filesize
1.1MB

Download
memory/2052-311-0x0000000073870000-0x0000000073991000-memory.dmp

Filesize
1.1MB

Download
memory/2052-309-0x00000000001E0000-0x0000000000245000-memory.dmp

Filesize
404KB

Download
memory/2052-324-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/2052-310-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/2052-312-0x0000000073280000-0x00000000736B2000-memory.dmp

Filesize
4.2MB

Download
memory/2308-321-0x0000000000C40000-0x0000000000D59000-memory.dmp

Filesize
1.1MB

Download
memory/2376-308-0x0000000000C40000-0x0000000000D59000-memory.dmp

Filesize
1.1MB

Download
memory/2700-598-0x00000000006F0000-0x0000000000754000-memory.dmp

Filesize
400KB

Download
memory/2700-599-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/2700-588-0x0000000071620000-0x00000000725B5000-memory.dmp

Filesize
15.6MB

Download
memory/2700-585-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/2700-587-0x0000000073280000-0x00000000736B2000-memory.dmp

Filesize
4.2MB

Download
memory/2700-600-0x0000000073870000-0x0000000073991000-memory.dmp

Filesize
1.1MB

Download
memory/2700-601-0x0000000073280000-0x00000000736B2000-memory.dmp

Filesize
4.2MB

Download
memory/2700-586-0x0000000073870000-0x0000000073991000-memory.dmp

Filesize
1.1MB

Download
memory/2700-602-0x0000000071620000-0x00000000725B5000-memory.dmp

Filesize
15.6MB

Download
memory/2700-303-0x00000000006F0000-0x0000000000754000-memory.dmp

Filesize
400KB

Download
memory/2700-307-0x0000000071620000-0x00000000725B5000-memory.dmp

Filesize
15.6MB

Download
memory/2700-304-0x00000000739B0000-0x0000000074B30000-memory.dmp

Filesize
17.5MB

Download
memory/2700-305-0x0000000073870000-0x0000000073991000-memory.dmp

Filesize
1.1MB

Download
memory/2700-306-0x0000000073280000-0x00000000736B2000-memory.dmp

Filesize
4.2MB

Download
memory/4632-322-0x0000000000C40000-0x0000000000D59000-memory.dmp

Filesize
1.1MB

Download