70a22dd03bb42970c17824e50e6c9a26d337d0241242b98f9f61462a1707f878

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ziv_2023.exe
Size

16.3MB
MD5

9d5e30fb8aca2302ed39eb3361744904
SHA1

d96a2ceb8e800a403a5dff59e39e31c39979d887
SHA256

70a22dd03bb42970c17824e50e6c9a26d337d0241242b98f9f61462a1707f878
SHA512

4bb49325fbadddb1779b91d0aafc755195e202d7a4dbdd6ae1a5a17dfdf798ff91828eee2a24450036b508d9d50db80cfc4695c8db6a330342782445a813ade1
SSDEEP

393216:JinXoakgCRwnAWOmB1Iecpai7mKJiTzP7gQug07Mhm/XK:J+YuCRwn1OOxgmKJIXgF72m/K

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	GoToAssistUnattended.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess_20240824__23_43_55_278.log	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1-x64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook32.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdaterCopy.csv	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM64.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\cmScb6eIsl.lck	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log	GoToAssistUnattendedUi.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM32.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1-x64.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\metadata	GoToAssistCrashHandler.exe

Executes dropped EXE 10 IoCs

pid	Process
3156	GoToAssistUnattended.exe
3080	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
4056	GoToAssistCrashHandler.exe
2844	GoToAssistUnattended.exe
2228	GoToAssistCrashHandler.exe
4856	GoToAssistLoggerProcess.exe
1304	GoToAssistCrashHandler.exe
2220	GoToAssistUnattendedUi.exe
3716	GoToAssistCrashHandler.exe

Loads dropped DLL 30 IoCs

pid	Process
3156	GoToAssistUnattended.exe
3156	GoToAssistUnattended.exe
3156	GoToAssistUnattended.exe
3156	GoToAssistUnattended.exe
3156	GoToAssistUnattended.exe
3080	GoToAssistProcessChecker.exe
3080	GoToAssistProcessChecker.exe
3080	GoToAssistProcessChecker.exe
3080	GoToAssistProcessChecker.exe
3080	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
4856	GoToAssistLoggerProcess.exe
4856	GoToAssistLoggerProcess.exe
4856	GoToAssistLoggerProcess.exe
4856	GoToAssistLoggerProcess.exe
4856	GoToAssistLoggerProcess.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattendedUi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziv_2023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistUnattended.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv"	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToAssistUnlock64.dll"	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment"	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}	GoToAssistUnattended.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	GoToAssistUnattended.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2220	GoToAssistUnattendedUi.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
3064	GoToAssistProcessChecker.exe
2844	GoToAssistUnattended.exe
2844	GoToAssistUnattended.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe
2220	GoToAssistUnattendedUi.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3156	4144	ziv_2023.exe	87
PID 4144 wrote to memory of 3156	4144	ziv_2023.exe	87
PID 4144 wrote to memory of 3156	4144	ziv_2023.exe	87
PID 4144 wrote to memory of 4228	4144	ziv_2023.exe	88
PID 4144 wrote to memory of 4228	4144	ziv_2023.exe	88
PID 4144 wrote to memory of 4228	4144	ziv_2023.exe	88
PID 3156 wrote to memory of 3080	3156	GoToAssistUnattended.exe	90
PID 3156 wrote to memory of 3080	3156	GoToAssistUnattended.exe	90
PID 3156 wrote to memory of 3080	3156	GoToAssistUnattended.exe	90
PID 3064 wrote to memory of 4056	3064	GoToAssistProcessChecker.exe	93
PID 3064 wrote to memory of 4056	3064	GoToAssistProcessChecker.exe	93
PID 3064 wrote to memory of 4056	3064	GoToAssistProcessChecker.exe	93
PID 3064 wrote to memory of 2844	3064	GoToAssistProcessChecker.exe	96
PID 3064 wrote to memory of 2844	3064	GoToAssistProcessChecker.exe	96
PID 3064 wrote to memory of 2844	3064	GoToAssistProcessChecker.exe	96
PID 2844 wrote to memory of 2228	2844	GoToAssistUnattended.exe	98
PID 2844 wrote to memory of 2228	2844	GoToAssistUnattended.exe	98
PID 2844 wrote to memory of 2228	2844	GoToAssistUnattended.exe	98
PID 2844 wrote to memory of 4856	2844	GoToAssistUnattended.exe	97
PID 2844 wrote to memory of 4856	2844	GoToAssistUnattended.exe	97
PID 2844 wrote to memory of 4856	2844	GoToAssistUnattended.exe	97
PID 4856 wrote to memory of 1304	4856	GoToAssistLoggerProcess.exe	99
PID 4856 wrote to memory of 1304	4856	GoToAssistLoggerProcess.exe	99
PID 4856 wrote to memory of 1304	4856	GoToAssistLoggerProcess.exe	99
PID 3064 wrote to memory of 2220	3064	GoToAssistProcessChecker.exe	101
PID 3064 wrote to memory of 2220	3064	GoToAssistProcessChecker.exe	101
PID 3064 wrote to memory of 2220	3064	GoToAssistProcessChecker.exe	101
PID 2220 wrote to memory of 3716	2220	GoToAssistUnattendedUi.exe	103
PID 2220 wrote to memory of 3716	2220	GoToAssistUnattendedUi.exe	103
PID 2220 wrote to memory of 3716	2220	GoToAssistUnattendedUi.exe	103

C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe
"C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe" -regsvc
  2⤵
  - Checks computer location settings
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -regsvc -starterpid 3156 -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType 4
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4228

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Odzkdrgv --annotation=installationid=cmScb6eIsl --annotation=version=5.11.0.2250 --initial-client-data=0x4ac,0x4b0,0x4b4,0x4a4,0x4b8,0x747243f4,0x74724404,0x74724414
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:4056
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "3064" "-WtsStartingUsername" "ODZKDRGV\Admin" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Drops file in System32 directory
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -HostId 229aba9b7e8600a8e507db0a21a7202a -SessionType "" -InstallationId cmScb6eIsl -DeviceId "" -LogLevel 2
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess_20240824__23_43_55_278.log=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/appdata/GoToAssistLoggerProcess_20240824__23_43_55_278.log" "--attachment=attachment_unattended.json=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Odzkdrgv --annotation=installationid=cmScb6eIsl --annotation=version=5.11.0.2250 --initial-client-data=0x494,0x4a0,0x4a4,0x49c,0x4a8,0x747243f4,0x74724404,0x74724414
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:1304
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.srv.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Odzkdrgv --annotation=installationid=cmScb6eIsl --annotation=version=5.11.0.2250 --initial-client-data=0x55c,0x568,0x56c,0x564,0x570,0x747243f4,0x74724404,0x74724414
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:2228
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattendedUi.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattendedUi.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Odzkdrgv --annotation=installationid=cmScb6eIsl --annotation=version=5.11.0.2250 --initial-client-data=0x518,0x524,0x528,0x520,0x52c,0x747243f4,0x74724404,0x74724414
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe

Filesize
616KB

MD5
80d72c76edf84b862dbffce6605eec1d

SHA1
cb9cbb525572a96eb93854eb568d0142239907bd

SHA256
1c6bbae4a492afe7265d916e8de9751677264881a033f989a47d956b8a4a0059

SHA512
2803da332b7e708ce1ca9005f913e2f8d87971e49c032a8611824275c586f06d587fda6c9b23eaec60a7c75c66dbc010fbb5df44469172e06c35b6a920323489

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
394KB

MD5
0ac380cf054b275a56e0880f7aa7fc4a

SHA1
64449cefa0346e7af14c36dd72aa7d5e30506f99

SHA256
2ee28354d059e89a9e3b5dc56dcc50d867f0fbed37e0ece677c93526156219e9

SHA512
1656f52919165cb7b57876f4db81871a2094bc5e840522947307e796eea7e6c3a805675a1990364a525b26233f902ab009c9a20f7629a7111788ab03a3412e59

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
393KB

MD5
d95d1b3de2c3e5f483d529e0d483cb8b

SHA1
7c88ca6649d63e8daef2ff0de3076031bcdedccb

SHA256
da1ea4cb74efdf84736d717571c7304390e4b7904992b970e109103504e39582

SHA512
2a2a2c78425eb074582c778ce5e66cc9e79fd62c2e9fd1077d02e91cffca9d71c6cd966a9b317aaf91bb64d3811a7cf053a159f6aa4b43f3f46d7dd46319e2dd

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe

Filesize
395KB

MD5
96ccce6a55ab1548fc200be33163cefd

SHA1
2d35e1433c77a39c4f1d1221f49ecb054a4a7248

SHA256
3de806b4f614d028f1a161926f49b3c1eb8cf61bf7d4bf7a126e43b53628cc3b

SHA512
03ec92c2ff0a4aa5dd8473559a8347caa6faedaec7179c49c9efbb6b0b4dff68b1319299715e659055238afca0a5032770bf5cef6c346db175825f5f9dcf5ab7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
394KB

MD5
9eb7da68a997920cba58e893e3076b63

SHA1
8c43dc5706ccc7a629d5b7a6d3b3aecd167dd7dc

SHA256
4ea6d788a2f6de741e37e6f4f14926ef74683d395d9b8017285b1869791490bd

SHA512
a499339ec21a4a062dc66365d8483fa072c171eb1c83c9dceb518460f36faa242c0ec457f5dbc95422571104396f3cb92fde3ee83ce5245d9655d9ee3f706075

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll

Filesize
151KB

MD5
80e21bed8bad302f2291bc93a0a15b20

SHA1
91fa16244af53489c2ff8bc58dc8c6246fb7ac9d

SHA256
fbae09029da4ca01275fdd9ed672deb54acb2e94e290452a473fa5f851cf9068

SHA512
9cf75b4cd47a186b831629e510752e89a6a5fb45c26f03e72ee79ca337a6a00debcb109ae4ed0ba378321bde4d9f09b594f0ed041837cf384ebea841cd9b9867

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll

Filesize
16.6MB

MD5
266c0854bd739b9563a1177b4c8bb220

SHA1
c8b1bdecd321af0bdea1d5a1b45fea090de5dc24

SHA256
2eac0a0bb6f1194c71089ef45d26c30c5be777961a14f9639b74afab66bd3d6e

SHA512
4ebf5af8b9c0b379922adecd28501fe45f2592a5af2007215cdb6f32959364be60eb2c58e865373a4428f950076d09cb1af72948f31e844c711cdf5c4ecc00c1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll

Filesize
8.9MB

MD5
f0909f5ddd73e8f9a9fdcb15bf0a36b3

SHA1
a99a3b68cae2a87b24b77ad9725e0c4dd8e82e12

SHA256
2468fb1db1939368ff64f8bf413d459d0a84b45d261ab4d6aef2d1a76fd5899a

SHA512
f707a85df58a3d4ff6701dce71ed8b51152d0fa5f08148b58e01a17fba175d23e2fd4eafd488e1a7b6e6fc570c33925d73b50713ea4db5c321fe66069733570f

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll

Filesize
1.1MB

MD5
6e0fa5d80f21f912c4ae58df7773e90f

SHA1
ac26d3596f119512a41ae600579775bf327c8df0

SHA256
af6a9f0177e329bb53eb68c66a7b4d211c17089b9afe35b7226b45541d6fad28

SHA512
bd9af05095461a4e6e683bf6719d81c38b021c83135628de4ec6869b9316c6d9ca552aa97bbcd28df716c1f5dc98983b5c10673a64a7f97fa7a08d1bb4c27c5d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log

Filesize
4KB

MD5
3520987c65928006cc8fd02901049aa7

SHA1
cc79502d2d0cadbe6a18fd764516043bf24d0c5a

SHA256
ccca8a55c6cf9eb5dde12615af32a027d9b6d77460d1fe1ec24ee1f300ef4c6f

SHA512
0130df95cfc74f3434cfb4c9221e0417df6f86be96928227cbc978ff89063c3acf65648d201beb504b74f78d5aca15dc5eaad22b7ad18f7b030ac8bc1fcd64ab

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log

Filesize
3KB

MD5
db983be355703dda4bf44b84d0f2d6da

SHA1
a2eed8054ef39f6c3f2bff94205042b3bbbfc509

SHA256
17888dfec146f6cf405b09d7fd6b3160f08935e7f209d62eea2d493182e78e35

SHA512
73fa97959114e3218c94237e72a0a37db337ac53fcc15fb2019fdc07c2ace6932fc32007aa255846de867498371bf2e761d67031b31b6f4a2ab3711fd23cd16e

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log

Filesize
5KB

MD5
72b1a791c37231b7e7423d16e65499ae

SHA1
52d5e2fdbe945534d1e1ea2ac5762ba25cad23e4

SHA256
d26cbcbf9d33519add788e3759e74eed7dcd8c8f86641d95e56df570fab67b04

SHA512
6840641faa1504ec7dd8108f69ee2b6a59ca30c397ae8f5996133ad505adf7a2b276203e52bce79f061f8c11c3f1cae3f6e54dc7a36288682839cb2c591b805f

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log

Filesize
1KB

MD5
be2bfe37882e1aa3fa82de74eb625d68

SHA1
82a1386886a31919fb77d68347c1bea8730d4127

SHA256
2dd922638e57fb92fe68791c23b1e111acc7108d4a8620b42d00faa7f4483ba5

SHA512
702462e69d18741fe14101207f3827ee0994b0307d266ff56d30311b6a58820f3487c8fbc0326101d00ba9e809ca5df908c938954020db6139132251423cf6ac

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log

Filesize
1KB

MD5
ea87bcb919dbdfa5cfdbc33c937b2064

SHA1
9a0cff9dd3f2a1c831dc1abde25133ce4d563b68

SHA256
052ba3bc5b19fd10953d439bbf824b99384161b400215d5ddaac4864a36767a8

SHA512
9e9aba9492fff3aef0f0b8d80a50a0d9e9e73181709ae164b36f750369b10e84d7e2152755f1ab3d365b7b72695492229b91e24355774ceb6f18bd7a4bda4bbe

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log

Filesize
6KB

MD5
9405ac3bd6091f64c0c203b282e195cd

SHA1
54d2c5054160d7ba1fcd58d7b068f7072db4bfb1

SHA256
3a77b1512b1cfabb90d11e2cca832dfe360d0967666655cb205c92d4fe263230

SHA512
d139b746702a5a1e96e29a477571d6304515c23888c03f6760da91fea6e384973e498e721aaf220f3f0f9400c972634879e1d7bed5152e2b4793a2399517b17d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log

Filesize
2KB

MD5
989b1e7e53501223f85780d4936033c2

SHA1
3ce870c32c1b5248144b4d4cccaf63f21943a662

SHA256
f0ddfcd4094b9a834526fdb1cac1a1698206a6b9e96d406f33412f4c8fc1c867

SHA512
7711ed5d7621ad64fb5aec41d11edad6afca9243a06bc03154f4d1dc550bd64106b02a8cc7969528c733407325a49e677f604cbe5a7831778f80538ed23f17aa

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat

Filesize
40B

MD5
b526f52fec32207016686dd4d78a25f0

SHA1
c10dba9faa569a62c1818c7247ae09ae24bf8d17

SHA256
1c0d103d4bd558f4b35751e6224e2db0923ab2fe822ce95511cef7793acd1787

SHA512
28111978aa20ea254f6d8fb8b5320abb5c35eb06fb4ad70bbb7024c13b161ca42be3d1dbf6ec73aa98ceb8ef253b2c2c18b8bab69c09f2ff7e00ab49793873e5

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat

Filesize
40B

MD5
eaa8090b3d0d2d56a8d9463ab5c55507

SHA1
a163b287bea3ecd613392f00e9b4cf614e670b01

SHA256
626479fca011543afb53150375bd216e47fc7d9ccc6c0e2bd64c3852da244cf2

SHA512
59851ee7f7dcf2bb0de0f75de68722d683b70b781fd2c36edd7690becb10f6a335ddbe337d46b672a983cdd4b8612c3660ddb4ab2a7034417d404996446ab8ba

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat

Filesize
40B

MD5
714e6180787dd3bf69066382e02cedb6

SHA1
e55081ae6956c9a2db76e02927d343e50aec01e1

SHA256
271d73e04c6b91e0881d1c9e4ae98ceebbcffe8f4e5cb4fa435d6b7eb7361acd

SHA512
a5e81417d850d9fdd57c6c1faba04b5853c7d195d38ed00576a02da1599ab48d539fd0b2fc483efe6405536a8ab05ec6b05351a11d414716d4d1fb537a324121

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat

Filesize
40B

MD5
caa0457c0b4a6540498c903738930f54

SHA1
b654df3feb4f5bfa65c18a84ed1344903d026bf8

SHA256
031d75614fed3db08f2cf9088a115695c653150483f0802ff0df7c083d554ce0

SHA512
7ea4e061a822ec354c199d5c8440a0aa2b75a02515f9c85402f12e32795d285f5e25116e91e5e32a2b76053891d3c05f3e0140d093bd6f2b7282f4be467066f8

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv

Filesize
1KB

MD5
f306f286cb72bf3804660ad8dc6941a3

SHA1
dd0724dbfd58e7600baf928302ff3d73b5665a7d

SHA256
bd9881d2598c1fcde97929d47df41f60f14d5d2ff347664268b2140802866083

SHA512
444c59dad9efbcf419a694d4b9cd43e1a13c32b5356a8bba36f9705cf108b0cd4ff146512669873f13b722c2c24a14ae419a0b67244b3955c87c4c33f557c82c

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1.dll

Filesize
2.9MB

MD5
c419b190b914832feaa0633783219e1b

SHA1
1895f14cdecc68061f9db848dc8ee8a348c88cc5

SHA256
72b9a34ca7e9445512dce47d65027775419dec6a54b659c413cd9963fd4654a4

SHA512
f617bf5155c119e932f00d2372ac0df753c42ceb090c04572a2694fde64c9ed01e3c10d7026c4e0d3372bea90d70cecc5f0c128364efa5fffa62a7038d288f9d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1.dll

Filesize
921KB

MD5
5a1e3c5e88bd1d5c47e4aabe3935ddb8

SHA1
d069fce9162bdf47bf4c591957bda941b4f7aa00

SHA256
90ce0a28e7c4ad109497f6470817b938ec3413ca7c96efe1a85ee7c5741fe88d

SHA512
e3b1740679f8ec4a67821348fee126bac4d540de5fda3d440bd059eae7bc628b4b3f7fb6c55ee5feec0df3c6322d81ce2d83dacef7754940b72286109d256096

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json

Filesize
1KB

MD5
03f4e81d207800bf3c27373aaea0b2a7

SHA1
86a6adf18b9e24db7b74724309345831cf6aaca7

SHA256
da1c3ec8fa4442c737f410730999cf2abc3870b0bba49a323f096bf0ae794a53

SHA512
dd15e25782a5d33c05c70042d467cfe25dd0e1e7290826975b309656c85d538dcb5dfe0e11c4da23651e56b02739fde1adbf944a2fff00074300ed3f374ddacc

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json

Filesize
126B

MD5
3ef5c81f84ec7315e46fe5a4701a9224

SHA1
70bd020b63c9aed6551c41170d415026753228ea

SHA256
1114daf4130282ae83d99ac64dfef6dd5a9ec9fac1a83716222d62d854a5ab33

SHA512
afe28fcca318d3f3ec075a7d7bb5998d00513d9e24866f153ef6b228d7de24a8554f8be8780037708220df04981228c8c07fafde03db42b3a74b2b1087c59922

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json

Filesize
145B

MD5
c960eb4dbbe5beca9251ac900fbfbae6

SHA1
7f1d5ad6f83d647d944f7565fe65d0cfd3a06570

SHA256
e1f2356c38a99adf0ba4e4c6d1a81e5eb33f82d099c144b416f124efb3332a3c

SHA512
37747913a534c88c58beda4ccb79a4a41d1fca3730143b77401220748c273a104c0798114370a45e8a83705ab9e989e3359f48691faeeebddb77900a83dcabbe

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
965c57d125c6678cfab2e11f7a3e2f2d

SHA1
94f8a27b4252ef302fc37e2a7b34d6d63c910ef4

SHA256
d2c795d8f18b18d2f1e7182351c92e8416aef493df4191c4cae29f70f501c135

SHA512
b1f39bdb2effe87081afb143176369e69ea2690919dc666587b78eb0c10eb46242bfdcbcd35d3698116470659942a3c1ecc767dde783d9c5a0914c6374c6e053

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
5cce4067b85a5e31717ec33f9fd44122

SHA1
1b12a1a8911f2248753eb8ca622e0b66d6130d29

SHA256
86fc96bd58bc85734d5a2df58f041f0141737fad5a7cc7b9c6d71b1d1f77a3d8

SHA512
c13bbe30afb458a127e4b28e82a8171c44f61c8e753690c02b4f8c75004b11274e07eba4b4a0330e95a9d3b873686ffb4b30f07cafc5beca63948d8ea42da964

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
55570f15a8f5c20f86e8deb4ffe46645

SHA1
cd4223a3ddc6b4ff77ec2f1d344d675f9affa2e1

SHA256
08d258a66a2a04da0454228fc2ba65e8297ae35a8a757c8986d571d4c37d4d7e

SHA512
0f66a6128b2c6aafc1f877f388520797fa3a81b717642152783e104e2ef86159de2c00f13116ddb088cea3b982eeb953f1035ce67e19fc8c6ebfe860ab023eb7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
4407452a7469e18a91d6b765cf38ee6a

SHA1
b71a0af20253ec8a2dc79502cddc475ac42756ee

SHA256
ff231cedd8957d937cb33af00ebf186b644e72f38741c5e130384f81bae15cae

SHA512
e3a49f92a84f2ad70b76f31207cc1cec8ae5db506149d45a136d3c9bd1815f66905189c55462cd93690a47d024271e9722ccb491594e4e1b7dee536764c8a5a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe.cmd

Filesize
537B

MD5
2d1ec5c3d0d2fd67e0aa148f4e523d93

SHA1
24a6528837fe7c825f44be9e0c2bd942203bb9b0

SHA256
5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b

SHA512
7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25

Download Submit