ed65a9e54a1848b75bbcc1bf629b7b9e99324189dba4bc35117307be17306611

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RadView.msi
Size

15.0MB
MD5

9d8ef6b002e928618f2a4bd15a185f2b
SHA1

f5de1d4bdb25774610d7c07948d9656788c112b9
SHA256

ed65a9e54a1848b75bbcc1bf629b7b9e99324189dba4bc35117307be17306611
SHA512

710f0de2ec530c8c38f5c587aadee656d7ff8458a1406b206bda79233958bf91f71736a543da28f23d69bfbc544f91c8a12b499548d546999fca7706dd33e708
SSDEEP

393216:vbf2jK8zXuAUE9yw7Y86XGavRJ7ti90r/F0zC/A08LKG/D:vz+zSAUE9F7N0Nti94mzg8uGr

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1936	msiexec.exe
3	1936	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\SysWOW64\unattended.json	unattended-updater.exe
File created	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM64.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook32.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\U5yWDYC2fs.lck	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess_20240824__23_41_53_366.log	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdaterCopy.csv	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM32.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1-x64.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log	GoToAssistUnattendedUi.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe	msiexec.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe.cmd	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook32.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1-x64.dll	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook64.dll	unattended-updater.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe	unattended-updater.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv	unattended-updater.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57ae22.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF06F75AAD3BD13F9.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF5A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{20608DC2-7809-D54B-27FD-C105D31B171E}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCFEBF76C75A1547E.TMP	msiexec.exe
File created	C:\Windows\Installer\e57ae22.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9AD736E2F3A3DE7A.TMP	msiexec.exe
File created	C:\Windows\Installer\{20608DC2-7809-D54B-27FD-C105D31B171E}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{20608DC2-7809-D54B-27FD-C105D31B171E}	msiexec.exe
File created	C:\Windows\Installer\e57ae24.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA5B0405E68EE9660.TMP	msiexec.exe

Executes dropped EXE 11 IoCs

pid	Process
1352	unattended-updater.exe
1120	GoToAssistUnattended.exe
4716	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
4584	GoToAssistCrashHandler.exe
1212	GoToAssistUnattended.exe
840	GoToAssistCrashHandler.exe
3560	GoToAssistLoggerProcess.exe
432	GoToAssistCrashHandler.exe
2128	GoToAssistUnattendedUi.exe
5048	GoToAssistCrashHandler.exe

Loads dropped DLL 30 IoCs

pid	Process
1120	GoToAssistUnattended.exe
1120	GoToAssistUnattended.exe
1120	GoToAssistUnattended.exe
1120	GoToAssistUnattended.exe
1120	GoToAssistUnattended.exe
4716	GoToAssistProcessChecker.exe
4716	GoToAssistProcessChecker.exe
4716	GoToAssistProcessChecker.exe
4716	GoToAssistProcessChecker.exe
4716	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
3560	GoToAssistLoggerProcess.exe
3560	GoToAssistLoggerProcess.exe
3560	GoToAssistLoggerProcess.exe
3560	GoToAssistLoggerProcess.exe
3560	GoToAssistLoggerProcess.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1936	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unattended-updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattendedUi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b38cc7aac7e825c30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b38cc7aa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b38cc7aa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db38cc7aa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b38cc7aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe

Delays execution with timeout.exe 17 IoCs

evasion

pid	Process
1604	timeout.exe
2524	timeout.exe
2888	timeout.exe
3052	timeout.exe
1208	timeout.exe
4868	timeout.exe
408	timeout.exe
2536	timeout.exe
440	timeout.exe
4680	timeout.exe
4944	timeout.exe
1584	timeout.exe
8	timeout.exe
4528	timeout.exe
2556	timeout.exe
3324	timeout.exe
2368	timeout.exe

Modifies data under HKEY_USERS 34 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	GoToAssistUnattended.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	GoToAssistProcessChecker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	GoToAssistProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	GoToAssistProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList\PackageName = "RadView.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment"	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv"	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CD806029087B45D72DF1C503DB171E1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CD806029087B45D72DF1C503DB171E1\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\PackageCode = "1C4C7BF8FCFFEC043B11404507ED1414"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\Version = "84606976"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\ProductIcon = "C:\\Windows\\Installer\\{20608DC2-7809-D54B-27FD-C105D31B171E}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToAssistUnlock64.dll"	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\53CF9314A141172F5660FE1FD8FF4C4B\2CD806029087B45D72DF1C503DB171E1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\ProductName = "GoToAssist Remote Support Unattended"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\53CF9314A141172F5660FE1FD8FF4C4B	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CD806029087B45D72DF1C503DB171E1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32	GoToAssistUnattended.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	GoToAssistUnattended.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2128	GoToAssistUnattendedUi.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
844	msiexec.exe
844	msiexec.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1848	GoToAssistProcessChecker.exe
1212	GoToAssistUnattended.exe
1212	GoToAssistUnattended.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1936	msiexec.exe
Token: SeSecurityPrivilege	844	msiexec.exe
Token: SeCreateTokenPrivilege	1936	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1936	msiexec.exe
Token: SeLockMemoryPrivilege	1936	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1936	msiexec.exe
Token: SeMachineAccountPrivilege	1936	msiexec.exe
Token: SeTcbPrivilege	1936	msiexec.exe
Token: SeSecurityPrivilege	1936	msiexec.exe
Token: SeTakeOwnershipPrivilege	1936	msiexec.exe
Token: SeLoadDriverPrivilege	1936	msiexec.exe
Token: SeSystemProfilePrivilege	1936	msiexec.exe
Token: SeSystemtimePrivilege	1936	msiexec.exe
Token: SeProfSingleProcessPrivilege	1936	msiexec.exe
Token: SeIncBasePriorityPrivilege	1936	msiexec.exe
Token: SeCreatePagefilePrivilege	1936	msiexec.exe
Token: SeCreatePermanentPrivilege	1936	msiexec.exe
Token: SeBackupPrivilege	1936	msiexec.exe
Token: SeRestorePrivilege	1936	msiexec.exe
Token: SeShutdownPrivilege	1936	msiexec.exe
Token: SeDebugPrivilege	1936	msiexec.exe
Token: SeAuditPrivilege	1936	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1936	msiexec.exe
Token: SeChangeNotifyPrivilege	1936	msiexec.exe
Token: SeRemoteShutdownPrivilege	1936	msiexec.exe
Token: SeUndockPrivilege	1936	msiexec.exe
Token: SeSyncAgentPrivilege	1936	msiexec.exe
Token: SeEnableDelegationPrivilege	1936	msiexec.exe
Token: SeManageVolumePrivilege	1936	msiexec.exe
Token: SeImpersonatePrivilege	1936	msiexec.exe
Token: SeCreateGlobalPrivilege	1936	msiexec.exe
Token: SeBackupPrivilege	4724	vssvc.exe
Token: SeRestorePrivilege	4724	vssvc.exe
Token: SeAuditPrivilege	4724	vssvc.exe
Token: SeBackupPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe
Token: SeTakeOwnershipPrivilege	844	msiexec.exe
Token: SeRestorePrivilege	844	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1936	msiexec.exe
1936	msiexec.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe
2128	GoToAssistUnattendedUi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2360	844	msiexec.exe	87
PID 844 wrote to memory of 2360	844	msiexec.exe	87
PID 844 wrote to memory of 1352	844	msiexec.exe	89
PID 844 wrote to memory of 1352	844	msiexec.exe	89
PID 844 wrote to memory of 1352	844	msiexec.exe	89
PID 1352 wrote to memory of 1120	1352	unattended-updater.exe	90
PID 1352 wrote to memory of 1120	1352	unattended-updater.exe	90
PID 1352 wrote to memory of 1120	1352	unattended-updater.exe	90
PID 1352 wrote to memory of 4668	1352	unattended-updater.exe	91
PID 1352 wrote to memory of 4668	1352	unattended-updater.exe	91
PID 1352 wrote to memory of 4668	1352	unattended-updater.exe	91
PID 4668 wrote to memory of 1584	4668	cmd.exe	93
PID 4668 wrote to memory of 1584	4668	cmd.exe	93
PID 4668 wrote to memory of 1584	4668	cmd.exe	93
PID 1120 wrote to memory of 4716	1120	GoToAssistUnattended.exe	94
PID 1120 wrote to memory of 4716	1120	GoToAssistUnattended.exe	94
PID 1120 wrote to memory of 4716	1120	GoToAssistUnattended.exe	94
PID 1848 wrote to memory of 4584	1848	GoToAssistProcessChecker.exe	96
PID 1848 wrote to memory of 4584	1848	GoToAssistProcessChecker.exe	96
PID 1848 wrote to memory of 4584	1848	GoToAssistProcessChecker.exe	96
PID 1848 wrote to memory of 1212	1848	GoToAssistProcessChecker.exe	97
PID 1848 wrote to memory of 1212	1848	GoToAssistProcessChecker.exe	97
PID 1848 wrote to memory of 1212	1848	GoToAssistProcessChecker.exe	97
PID 1212 wrote to memory of 840	1212	GoToAssistUnattended.exe	98
PID 1212 wrote to memory of 840	1212	GoToAssistUnattended.exe	98
PID 1212 wrote to memory of 840	1212	GoToAssistUnattended.exe	98
PID 1212 wrote to memory of 3560	1212	GoToAssistUnattended.exe	99
PID 1212 wrote to memory of 3560	1212	GoToAssistUnattended.exe	99
PID 1212 wrote to memory of 3560	1212	GoToAssistUnattended.exe	99
PID 3560 wrote to memory of 432	3560	GoToAssistLoggerProcess.exe	101
PID 3560 wrote to memory of 432	3560	GoToAssistLoggerProcess.exe	101
PID 3560 wrote to memory of 432	3560	GoToAssistLoggerProcess.exe	101
PID 1848 wrote to memory of 2128	1848	GoToAssistProcessChecker.exe	102
PID 1848 wrote to memory of 2128	1848	GoToAssistProcessChecker.exe	102
PID 1848 wrote to memory of 2128	1848	GoToAssistProcessChecker.exe	102
PID 2128 wrote to memory of 5048	2128	GoToAssistUnattendedUi.exe	103
PID 2128 wrote to memory of 5048	2128	GoToAssistUnattendedUi.exe	103
PID 2128 wrote to memory of 5048	2128	GoToAssistUnattendedUi.exe	103
PID 4668 wrote to memory of 3324	4668	cmd.exe	104
PID 4668 wrote to memory of 3324	4668	cmd.exe	104
PID 4668 wrote to memory of 3324	4668	cmd.exe	104
PID 4668 wrote to memory of 2536	4668	cmd.exe	105
PID 4668 wrote to memory of 2536	4668	cmd.exe	105
PID 4668 wrote to memory of 2536	4668	cmd.exe	105
PID 4668 wrote to memory of 2368	4668	cmd.exe	106
PID 4668 wrote to memory of 2368	4668	cmd.exe	106
PID 4668 wrote to memory of 2368	4668	cmd.exe	106
PID 4668 wrote to memory of 2888	4668	cmd.exe	107
PID 4668 wrote to memory of 2888	4668	cmd.exe	107
PID 4668 wrote to memory of 2888	4668	cmd.exe	107
PID 4668 wrote to memory of 3052	4668	cmd.exe	108
PID 4668 wrote to memory of 3052	4668	cmd.exe	108
PID 4668 wrote to memory of 3052	4668	cmd.exe	108
PID 4668 wrote to memory of 8	4668	cmd.exe	109
PID 4668 wrote to memory of 8	4668	cmd.exe	109
PID 4668 wrote to memory of 8	4668	cmd.exe	109
PID 4668 wrote to memory of 440	4668	cmd.exe	110
PID 4668 wrote to memory of 440	4668	cmd.exe	110
PID 4668 wrote to memory of 440	4668	cmd.exe	110
PID 4668 wrote to memory of 4528	4668	cmd.exe	111
PID 4668 wrote to memory of 4528	4668	cmd.exe	111
PID 4668 wrote to memory of 4528	4668	cmd.exe	111
PID 4668 wrote to memory of 1604	4668	cmd.exe	112
PID 4668 wrote to memory of 1604	4668	cmd.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\RadView.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2360
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\RadView.msi" "-MsiInstanceGuid" "{20608DC2-7809-D54B-27FD-C105D31B171E}"
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\RadView.msi" "-MsiInstanceGuid" "{20608DC2-7809-D54B-27FD-C105D31B171E}"
    3⤵
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -regsvc -starterpid 1120 -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType 4
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /S /C ""C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1584
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3324
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2536
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2368
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2888
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3052
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:8
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:440
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4528
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1604
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4680
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1208
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4944
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2556
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2524
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4868
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTI4NzAzNjQsImlhdCI6MTY5Mjc4Mzk2NH0.DTPUHoXDz3OqLlwiK2Saxf1kw36tgs8JEzcPhDx1aus --annotation=format=minidump --annotation=hostname=Asaaprdb --annotation=installationid=U5yWDYC2fs --annotation=version=5.11.0.2250 --initial-client-data=0x4cc,0x4d4,0x4d8,0x4d0,0x4dc,0x74e843f4,0x74e84404,0x74e84414
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:4584
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "1848" "-WtsStartingUsername" "ASAAPRDB\Admin" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Drops file in System32 directory
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.srv.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTI4NzAzNjQsImlhdCI6MTY5Mjc4Mzk2NH0.DTPUHoXDz3OqLlwiK2Saxf1kw36tgs8JEzcPhDx1aus --annotation=format=minidump --annotation=hostname=Asaaprdb --annotation=installationid=U5yWDYC2fs --annotation=version=5.11.0.2250 --initial-client-data=0x5a0,0x5a4,0x5a8,0x59c,0x5ac,0x74e843f4,0x74e84404,0x74e84414
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:840
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -HostId 77254758dde387a9b456d9bf7d5cea81 -SessionType "" -InstallationId U5yWDYC2fs -DeviceId "" -LogLevel 2
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess_20240824__23_41_53_366.log=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/appdata/GoToAssistLoggerProcess_20240824__23_41_53_366.log" "--attachment=attachment_unattended.json=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTI4NzAzNjQsImlhdCI6MTY5Mjc4Mzk2NH0.DTPUHoXDz3OqLlwiK2Saxf1kw36tgs8JEzcPhDx1aus --annotation=format=minidump --annotation=hostname=Asaaprdb --annotation=installationid=U5yWDYC2fs --annotation=version=5.11.0.2250 --initial-client-data=0x4bc,0x4c4,0x4c8,0x4c0,0x4cc,0x74e843f4,0x74e84404,0x74e84414
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:432
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattendedUi.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattendedUi.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTI4NzAzNjQsImlhdCI6MTY5Mjc4Mzk2NH0.DTPUHoXDz3OqLlwiK2Saxf1kw36tgs8JEzcPhDx1aus --annotation=format=minidump --annotation=hostname=Asaaprdb --annotation=installationid=U5yWDYC2fs --annotation=version=5.11.0.2250 --initial-client-data=0x538,0x540,0x544,0x53c,0x548,0x74e843f4,0x74e84404,0x74e84414
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ae23.rbs

Filesize
7KB

MD5
c24e409dcb43b74f5b957ae3d5d4a8f3

SHA1
bb99ca1717bdb64e6413bfee53095bc074a0a2f0

SHA256
f62da0e2252ea9012be99364927ab4d21b738889d6a0bca58241e51a6749a2a6

SHA512
9c1271d3aa56777b194835a2a14b454c5811273be8865c1592e8f598ad179c0cb93f2f790a8bf1e7d769cfd82902f4edf644df39862202326c76421f22930885

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe

Filesize
616KB

MD5
80d72c76edf84b862dbffce6605eec1d

SHA1
cb9cbb525572a96eb93854eb568d0142239907bd

SHA256
1c6bbae4a492afe7265d916e8de9751677264881a033f989a47d956b8a4a0059

SHA512
2803da332b7e708ce1ca9005f913e2f8d87971e49c032a8611824275c586f06d587fda6c9b23eaec60a7c75c66dbc010fbb5df44469172e06c35b6a920323489

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
394KB

MD5
0ac380cf054b275a56e0880f7aa7fc4a

SHA1
64449cefa0346e7af14c36dd72aa7d5e30506f99

SHA256
2ee28354d059e89a9e3b5dc56dcc50d867f0fbed37e0ece677c93526156219e9

SHA512
1656f52919165cb7b57876f4db81871a2094bc5e840522947307e796eea7e6c3a805675a1990364a525b26233f902ab009c9a20f7629a7111788ab03a3412e59

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
393KB

MD5
d95d1b3de2c3e5f483d529e0d483cb8b

SHA1
7c88ca6649d63e8daef2ff0de3076031bcdedccb

SHA256
da1ea4cb74efdf84736d717571c7304390e4b7904992b970e109103504e39582

SHA512
2a2a2c78425eb074582c778ce5e66cc9e79fd62c2e9fd1077d02e91cffca9d71c6cd966a9b317aaf91bb64d3811a7cf053a159f6aa4b43f3f46d7dd46319e2dd

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe

Filesize
395KB

MD5
96ccce6a55ab1548fc200be33163cefd

SHA1
2d35e1433c77a39c4f1d1221f49ecb054a4a7248

SHA256
3de806b4f614d028f1a161926f49b3c1eb8cf61bf7d4bf7a126e43b53628cc3b

SHA512
03ec92c2ff0a4aa5dd8473559a8347caa6faedaec7179c49c9efbb6b0b4dff68b1319299715e659055238afca0a5032770bf5cef6c346db175825f5f9dcf5ab7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
394KB

MD5
9eb7da68a997920cba58e893e3076b63

SHA1
8c43dc5706ccc7a629d5b7a6d3b3aecd167dd7dc

SHA256
4ea6d788a2f6de741e37e6f4f14926ef74683d395d9b8017285b1869791490bd

SHA512
a499339ec21a4a062dc66365d8483fa072c171eb1c83c9dceb518460f36faa242c0ec457f5dbc95422571104396f3cb92fde3ee83ce5245d9655d9ee3f706075

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll

Filesize
151KB

MD5
80e21bed8bad302f2291bc93a0a15b20

SHA1
91fa16244af53489c2ff8bc58dc8c6246fb7ac9d

SHA256
fbae09029da4ca01275fdd9ed672deb54acb2e94e290452a473fa5f851cf9068

SHA512
9cf75b4cd47a186b831629e510752e89a6a5fb45c26f03e72ee79ca337a6a00debcb109ae4ed0ba378321bde4d9f09b594f0ed041837cf384ebea841cd9b9867

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll

Filesize
16.6MB

MD5
266c0854bd739b9563a1177b4c8bb220

SHA1
c8b1bdecd321af0bdea1d5a1b45fea090de5dc24

SHA256
2eac0a0bb6f1194c71089ef45d26c30c5be777961a14f9639b74afab66bd3d6e

SHA512
4ebf5af8b9c0b379922adecd28501fe45f2592a5af2007215cdb6f32959364be60eb2c58e865373a4428f950076d09cb1af72948f31e844c711cdf5c4ecc00c1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll

Filesize
8.9MB

MD5
f0909f5ddd73e8f9a9fdcb15bf0a36b3

SHA1
a99a3b68cae2a87b24b77ad9725e0c4dd8e82e12

SHA256
2468fb1db1939368ff64f8bf413d459d0a84b45d261ab4d6aef2d1a76fd5899a

SHA512
f707a85df58a3d4ff6701dce71ed8b51152d0fa5f08148b58e01a17fba175d23e2fd4eafd488e1a7b6e6fc570c33925d73b50713ea4db5c321fe66069733570f

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll

Filesize
1.1MB

MD5
6e0fa5d80f21f912c4ae58df7773e90f

SHA1
ac26d3596f119512a41ae600579775bf327c8df0

SHA256
af6a9f0177e329bb53eb68c66a7b4d211c17089b9afe35b7226b45541d6fad28

SHA512
bd9af05095461a4e6e683bf6719d81c38b021c83135628de4ec6869b9316c6d9ca552aa97bbcd28df716c1f5dc98983b5c10673a64a7f97fa7a08d1bb4c27c5d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess_20240824__23_41_53_366.log

Filesize
4KB

MD5
c498d67188c6f0aa9c34bc9e4f3ad9ff

SHA1
742711efba3d20e124b8e90775da0eacbdb7cb4a

SHA256
8bb7e0699fca017d8e1f8f4cc5c9fa7730b0a992d7a459d8fd8f2888a1d4bc09

SHA512
34940dea2da055ce955065f14a16bba675d91eaad3820cafe90c8cb7778d17680051d099e2ed7c797469aa4ac9949dd4db6b063a3f3427d8cbd17f6e4a47f524

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log

Filesize
4KB

MD5
1595a84dce62c4aa3dccccedd2870539

SHA1
1435303b4c7a799cb77768d64f4e2d0a574d0a83

SHA256
2f9ab401772bd782d2d963a80da960b0aa1ef4106a8a2f5f6dcdb9fc72eb329c

SHA512
86867e2a18ee5dc47ea50a3ae693748358899ef07d2442a486af2f038684b18735b7b0c7271d106a5ea4a80c2bcbfc5a3ae6432cf73e2ca2bf8e5a0e389fd649

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log

Filesize
3KB

MD5
8d069fd007e7a558f3ff3651886feaac

SHA1
0ad2031b8e4ea2faea421282fdccc6c664e9fff5

SHA256
62a25c3fd239929b5c9cfe97d04effa1d7cf35d8b4f2552f2b0a230ffeba4e43

SHA512
d90724cf31d3e1fd510f703bbd14010d809aa82c58c0cb1f91043f798fb308e33c87d9a34f4f047edbb1af5ec7cb1809356c8a3bbbe2a094c14bedfa919b44a0

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log

Filesize
5KB

MD5
84b45d591d393fb057b1ee043568b5b7

SHA1
e12a331e3cda6507f67cae270b6b6fa40340647b

SHA256
d014c46b4a7ce81c631f1a3807477e65c98634ce0509de4ecea47803d5f40bf8

SHA512
ec123242a0a18c916e5d16faa3799fe71c989e7b5be7e86fbccc5abad4e79d1d3ad3b4c5f57c02524c6c4542c43e667c895347aed7cc22466a89f1d96d952d93

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log

Filesize
2KB

MD5
3c2890c59d590619a2b6f7605efbca38

SHA1
d0fabd41e06b25dc8e7feefb97a6a1f58801bc94

SHA256
0b0aae69be30a9cceb2c4721666232a682ea72a401f18f4ff47eb616894636ae

SHA512
6fc927ac9940912a2e3d532bc8a129d59e394c63265fc6ad58c8deaf35ea97c9ab976a1ab181e77483ca26025d0dd9c2542b17d332d49b6701b0697c4038585a

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log

Filesize
2KB

MD5
0bf296a3788e64d4b63d831ef20293b4

SHA1
73d4ae09897beb7a53e4f5c74e195bea6b4d18ab

SHA256
f49bfdf4d8aa804cdd126e05a84b3950e2cb08cb8afaf4a1b87ed5d05f10cbf4

SHA512
b8e9b5b77c788d4e8196e97f8e75b2be9aa80d20a4157eec6ffa1d265ee788b206d46817e79bfe8401b5241ef3bb8f0bb678e6440cb60db08b461a3c10f0b5a1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log

Filesize
6KB

MD5
df2c7d6fb340025c3cd0cbe59389edac

SHA1
2a10a367a23afb07b362247041eac7f45e4c306c

SHA256
ff6f94c250d1604b867e04b6db3aba9e1b4c4c282afbe541a537f7c49903a8d4

SHA512
a6b1d2670f7792442b01e37b991324dad6cc00ec8d2255fb9d1ff114413011f75d30203effeb4be6783cd67c93369f4a0d9933e0c7b0383ee0b9ad2f593ae749

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log

Filesize
4B

MD5
cb492b7df9b5c170d7c87527940eff3b

SHA1
66928e6cbb59c3a3bce606959ef4a865fe04e642

SHA256
dba5166ad9db9ba648c1032ebbd34dcd0d085b50023b839ef5c68ca1db93a563

SHA512
ce677db6ae33c5496874a2902d30d361f6cf12576e96bd8a9f6626a0ca29f0b4f97e403e54711d24ebf34d4e183235a8f9951345d32a20f2dad476d911ee7e06

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log

Filesize
2KB

MD5
07d247c5c82824695905809ab9bda01b

SHA1
dec81ebaa53bdb3bbdb014668dae1f0b6ef9e159

SHA256
8635908b963688f0d3ee62e214e6eb5ed2628d5bfc4fd79809cc5cbc51504f36

SHA512
ce228579ad857ec4a9964c4cdc40c7638201c0d6c742983e46b1e5a410afd3c876a598b4e34d257d42283e17fbfe4368e63a600aa4d0a124210cb7e4a129f7c2

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat

Filesize
40B

MD5
8d7cf884eb57d0950ba77cf5a078a61a

SHA1
fa6dee4a642d16f7969908f69561b000a50278f2

SHA256
4c79f023659bfc0e0582a995089db0a57fc4491295ee035a0490ec620d8ff87a

SHA512
05fd255aa39743fcbadd3201435d44e8b7189cfaf58013089e210141bf0b92cb91133998198f098252f2c883fdf04f494ccedaf0485373a8991dfa77abaaf216

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat

Filesize
40B

MD5
ca441c3bb4292d59ba174bcae26fd042

SHA1
840626ef389699850e8d4862c1c6c8453e9cfc5e

SHA256
59f7e0996a9a3ec2a8a8dc01de67b5e78829279d59cab21a159e3e19f377ebc4

SHA512
d48136d117dcdf3bec95cfb029d41bc9c803151ebbcbdf68016adc436b12f5d1737f1480a9344436e1d7c8ebb9ccb64c5470d0c35d7c09569e3a068c902b5070

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat

Filesize
40B

MD5
cd944b7bf89b9aad61587bf38a21f45b

SHA1
68abb174ff4e527bbbe6bfec6bb51e6aa5fe0d73

SHA256
54f920ea61d96ae8859149754db53af5ca86a279bb6c1dd53bf782e88516bff1

SHA512
f150060617652267fbac2a025df3fe32567d610144d907f2c7e0535d257822956c75adb0db6b37ba8997de91c75c9e777110850caac71639d6ccfa91ae578b56

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv

Filesize
1KB

MD5
d3147aa5e8c4d54b890d1116abc54f2e

SHA1
bd27e52a6df8869bd3dc11cf4034c356d15a301e

SHA256
c736c36b9b3fba7efe4f252b05a48132d9dd4e7e2d491b75dc95b9eba72ab0ab

SHA512
22153db9cc8580f0aa3ef2327a07c60872bb1c7b31fad90b150c23e0b05fc62941f3bfc9c687cd4390057c7636cae1f5bed869798fe53814e1566dad23769d33

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1.dll

Filesize
2.9MB

MD5
c419b190b914832feaa0633783219e1b

SHA1
1895f14cdecc68061f9db848dc8ee8a348c88cc5

SHA256
72b9a34ca7e9445512dce47d65027775419dec6a54b659c413cd9963fd4654a4

SHA512
f617bf5155c119e932f00d2372ac0df753c42ceb090c04572a2694fde64c9ed01e3c10d7026c4e0d3372bea90d70cecc5f0c128364efa5fffa62a7038d288f9d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1.dll

Filesize
921KB

MD5
5a1e3c5e88bd1d5c47e4aabe3935ddb8

SHA1
d069fce9162bdf47bf4c591957bda941b4f7aa00

SHA256
90ce0a28e7c4ad109497f6470817b938ec3413ca7c96efe1a85ee7c5741fe88d

SHA512
e3b1740679f8ec4a67821348fee126bac4d540de5fda3d440bd059eae7bc628b4b3f7fb6c55ee5feec0df3c6322d81ce2d83dacef7754940b72286109d256096

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json

Filesize
1KB

MD5
c14ca84f24195c7709018a0f570ab04e

SHA1
7a30d941a2a59c12b52f705bbc4dc205f365e9f3

SHA256
a1b53025c3eb2d1b659ad67d9afa87cf8441aafe8541c66ed2f62e8c9b5102da

SHA512
4011394d5b06a0c644d6c2a9ee3341e4a014248f17dbabb164d81b67527ae7377eb42cabc532a506fca9be5c4f47b2df58d2a5b150089d62da536e1ba35ea7c5

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json

Filesize
126B

MD5
47f7edb654e1e3f66a9d58a6a2339a98

SHA1
684069d01a3d6bc5c894ce493826bbf236284135

SHA256
2f6e9b5e90528f844d4322830898e93e84622cb153ba3cbdf6ed78caa5d32c90

SHA512
29c67edb8f2fb55b34e8e81c9bf7be502b52189eda780ee8ab19a6b9dae7f2cb95664a5c4a7bdc30c039be13f67dddb33584d497d22eaf5b1c835851fdde1209

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
827B

MD5
20fac07975a34e4cd42a70a9ff9b0490

SHA1
b25487e4ce538609ce6345f75acce8ca46b07fd9

SHA256
04e06711d6c561ec7fac4d5d30daae5f15459af69ac14ed43c18a05a8f1df5fb

SHA512
a97a25d46352313b30b858b5879c09b14f93021bcdd436689890f1918a3807be1db21ba59d1e3b8f6ed8fa884cb74284cae0c89999b1415c4055e052fe885a92

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
7afc1640e3cb2d9d3aa8f118f90cad28

SHA1
3e473e38eb19ba821708c022584529fa381ac5c5

SHA256
8a13d5aef64b3ab348a1a2f18078a4549b354f24dec492266c812e5dc01be21e

SHA512
13367d623dc8cd896e8b778c93afc40dac9a7cd15bc2ffd087ed6ad4b68082a2329ff6c3a235846d946901083ba8011bd0087285213172a1b2fa64e68b550c1d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
41b587704a8c5ae1028dd8835284eb01

SHA1
ed8d4a1cffbf2d723e9baa70b7d3936201b6343a

SHA256
65cb005a51542f2ffe01a72ceebe9b2c0f21c06454252a4256c8e19957dadbc6

SHA512
945fa3de95b8ca239d9322e7b8e06c5b496cc09dc4aa47df896a2be09011c2f88173ddc4f35e175809c32c692241aa0122acf9e0507794ec1b41d1790d85779a

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
f60626222b5a94863d301f0c80fa7fbd

SHA1
75034561308b605c2e28ebdf32be46aba4784655

SHA256
b9a230ed477adae4f058efa214d4cd99e01809410147b02041bcd17e3eab845d

SHA512
3e5132f08790cfc54b0199ac0ebe0e6d28bf29bb3d26140986be9d5e0fea6f7ad37760bdc5821336516ea8004032df7bb3eec69287ac9e7ae194829544612751

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe

Filesize
16.3MB

MD5
40157b553bed0f7778f62e0281a7a4f2

SHA1
2da1b2bb2f858b3bea2aafbeeb0507cdedeeeb70

SHA256
32cf91c8d27a50d2dbbcfc4b54ab254fee6f09ced93eb2a611172cf66ec72e11

SHA512
96d1ba62fba7a2746fa04dda83efe8c1b4f4ebca46d0b181a32e0f6f67c7e31545d48935d4480525553275ed6a897dc321d603f62a87327a2f1aead64a8bc526

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\unattended-updater.exe.cmd

Filesize
537B

MD5
2d1ec5c3d0d2fd67e0aa148f4e523d93

SHA1
24a6528837fe7c825f44be9e0c2bd942203bb9b0

SHA256
5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b

SHA512
7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
b15e66e3a4fedbd76d9e879df51c6bde

SHA1
818c08d8c6b26ad78cc6928e12720b61007750e6

SHA256
894633ca5538dba8b866a5d012af5e08c5a5e19e4f4107d83b116190e0411485

SHA512
b99acba5261740a9f84a5a4ff3781085371149f3315ff856b8aa4f9b538fce84fbcea0891be324d0305a496784a73bf2b62cc77c42ad24aeca118d60a1b82e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
727B

MD5
cbf621cd8f9ca5775488a333b4a04d69

SHA1
274996df0c32f413b0ee95d792df5a69e2d47304

SHA256
b2639afe788011c46cb8464385a5457c3b6727f5240f8149e193657f2cef2875

SHA512
75c66e3f3a0f07b03945de3d8acc5a7643b6688729f455bf4c94fadb39301cbace66d81f1bcfac69e251e1ec2c87e62e704bba47696481233d238c2c7e742074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
797a8eb37512e7ede4c75ce7c4377ec5

SHA1
b53b230c59bdfe9f0c87792d6549c74201d43edc

SHA256
d16c9ea5dd145be23ff803ca228a9225960d6169435227a2b502e7dbb0a68018

SHA512
3fe05ee9169449d006ce4d3e0c6d726dff90d982cde51d7714659c857a6f82d19103b87e0b814aaaf5067b47077e2a0c58bf9948bd7dc7b80bf37f5830222e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
29c6ea227e0f36c2d176a43659e7180c

SHA1
1b7370b0db52e840c568af3e3678dad9418d52ef

SHA256
22a06c7b216a1b6f0c6d302ea779a705a33f5f638d2848e40691720c2002ccb3

SHA512
270fb9c22d81613770733193078f7d1acd3fdc25840cdcb630525c85da3794d62bb5e236607a517b464d3abe83ab8fb5eeefc5fe50a5015fc3a33a0721cdb7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_325DC716E4289E0AE281439314ED4BFA

Filesize
408B

MD5
0e2c16f11a01b82237204c88ab2a6b89

SHA1
9116bc4de2025d82e27d469de736d80d1f89f5cf

SHA256
2e312216e716858509d85841c20af44647ed2893f598f9a869899034a3ef03f5

SHA512
6206122156534cc8d18651fc320695311eba08eece56636b37b13041816b58a46953135ff785b650722fe5a3b9c279f2efb83c5ce263e287a05187ddebb8ee5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
3a9106d63c38ebcbcfe3be0262171f52

SHA1
af1b393153a8b71d8f7a0d71d35aa6603d15cbe4

SHA256
3582725cff58dde94565833da667b4cd2596f375ec9ac561edcae7d9d3bfd86f

SHA512
32f5e10a88f59883ab5bdab7e2813391bdc5969e3cc6dbacad491411c43d1030c62b662dfbfa919bb9892739e0c902753efed38f4fa7ec007a67f6a6291d29b9

Download Submit
C:\Windows\Installer\e57ae22.msi

Filesize
15.0MB

MD5
9d8ef6b002e928618f2a4bd15a185f2b

SHA1
f5de1d4bdb25774610d7c07948d9656788c112b9

SHA256
ed65a9e54a1848b75bbcc1bf629b7b9e99324189dba4bc35117307be17306611

SHA512
710f0de2ec530c8c38f5c587aadee656d7ff8458a1406b206bda79233958bf91f71736a543da28f23d69bfbc544f91c8a12b499548d546999fca7706dd33e708

Download Submit