70a22dd03bb42970c17824e50e6c9a26d337d0241242b98f9f61462a1707f878

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ziv_2023.exe
Size

16.3MB
MD5

9d5e30fb8aca2302ed39eb3361744904
SHA1

d96a2ceb8e800a403a5dff59e39e31c39979d887
SHA256

70a22dd03bb42970c17824e50e6c9a26d337d0241242b98f9f61462a1707f878
SHA512

4bb49325fbadddb1779b91d0aafc755195e202d7a4dbdd6ae1a5a17dfdf798ff91828eee2a24450036b508d9d50db80cfc4695c8db6a330342782445a813ade1
SSDEEP

393216:JinXoakgCRwnAWOmB1Iecpai7mKJiTzP7gQug07Mhm/XK:J+YuCRwn1OOxgmKJIXgF72m/K

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GoToAssistUnattended.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe
File opened for modification	C:\Windows\system32\GoToAssistUnlock64.dll	GoToAssistUnattended.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	GoToAssistUnattended.exe

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdaterCopy.csv	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUi.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\1wpJ8e51q4.lck	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools32.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess_20240824__23_43_54_481.log	GoToAssistLoggerProcess.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedRemover.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM64.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\lmiscrhook32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock32.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistTools64.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistLoggerProcess.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIInputHook32.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\metadata	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log	GoToAssistUnattendedUi.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1-x64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1-x64.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	GoToAssistUnattended.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupport7x32.dll	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat	GoToAssistProcessChecker.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\metadata	GoToAssistCrashHandler.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMIFilterHook64.dll	ziv_2023.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log	GoToAssistUnattended.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json	GoToAssistProcessChecker.exe
File created	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LMISupportM32.exe	ziv_2023.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistCrashHandler.exe
File opened for modification	C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat	GoToAssistUnattendedUi.exe

Executes dropped EXE 10 IoCs

pid	Process
5012	GoToAssistUnattended.exe
2988	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
864	GoToAssistCrashHandler.exe
2520	GoToAssistUnattended.exe
3464	GoToAssistCrashHandler.exe
1604	GoToAssistLoggerProcess.exe
4804	GoToAssistCrashHandler.exe
2044	GoToAssistUnattendedUi.exe
996	GoToAssistCrashHandler.exe

Loads dropped DLL 30 IoCs

pid	Process
5012	GoToAssistUnattended.exe
5012	GoToAssistUnattended.exe
5012	GoToAssistUnattended.exe
5012	GoToAssistUnattended.exe
5012	GoToAssistUnattended.exe
2988	GoToAssistProcessChecker.exe
2988	GoToAssistProcessChecker.exe
2988	GoToAssistProcessChecker.exe
2988	GoToAssistProcessChecker.exe
2988	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
1604	GoToAssistLoggerProcess.exe
1604	GoToAssistLoggerProcess.exe
1604	GoToAssistLoggerProcess.exe
1604	GoToAssistLoggerProcess.exe
1604	GoToAssistLoggerProcess.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattendedUi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziv_2023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoToAssistProcessChecker.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GoToAssistUnattended.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GoToAssistUnattended.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GoToAssistLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GoToAssistUnattended.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\ = "RescueAssistCredProv"	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ = "GoToAssistUnlock64.dll"	GoToAssistUnattended.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5de81d42-ce2b-4a7e-b1b7-1312fa11c82b}\InprocServer32\ThreadingModel = "Apartment"	GoToAssistUnattended.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\Certificates	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CRLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC\CTLs	GoToAssistUnattended.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SPC	GoToAssistUnattended.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2044	GoToAssistUnattendedUi.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
3992	GoToAssistProcessChecker.exe
2520	GoToAssistUnattended.exe
2520	GoToAssistUnattended.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe
2044	GoToAssistUnattendedUi.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 5012	4352	ziv_2023.exe	82
PID 4352 wrote to memory of 5012	4352	ziv_2023.exe	82
PID 4352 wrote to memory of 5012	4352	ziv_2023.exe	82
PID 4352 wrote to memory of 1668	4352	ziv_2023.exe	83
PID 4352 wrote to memory of 1668	4352	ziv_2023.exe	83
PID 4352 wrote to memory of 1668	4352	ziv_2023.exe	83
PID 5012 wrote to memory of 2988	5012	GoToAssistUnattended.exe	85
PID 5012 wrote to memory of 2988	5012	GoToAssistUnattended.exe	85
PID 5012 wrote to memory of 2988	5012	GoToAssistUnattended.exe	85
PID 3992 wrote to memory of 864	3992	GoToAssistProcessChecker.exe	89
PID 3992 wrote to memory of 864	3992	GoToAssistProcessChecker.exe	89
PID 3992 wrote to memory of 864	3992	GoToAssistProcessChecker.exe	89
PID 3992 wrote to memory of 2520	3992	GoToAssistProcessChecker.exe	90
PID 3992 wrote to memory of 2520	3992	GoToAssistProcessChecker.exe	90
PID 3992 wrote to memory of 2520	3992	GoToAssistProcessChecker.exe	90
PID 2520 wrote to memory of 3464	2520	GoToAssistUnattended.exe	92
PID 2520 wrote to memory of 3464	2520	GoToAssistUnattended.exe	92
PID 2520 wrote to memory of 3464	2520	GoToAssistUnattended.exe	92
PID 2520 wrote to memory of 1604	2520	GoToAssistUnattended.exe	91
PID 2520 wrote to memory of 1604	2520	GoToAssistUnattended.exe	91
PID 2520 wrote to memory of 1604	2520	GoToAssistUnattended.exe	91
PID 1604 wrote to memory of 4804	1604	GoToAssistLoggerProcess.exe	93
PID 1604 wrote to memory of 4804	1604	GoToAssistLoggerProcess.exe	93
PID 1604 wrote to memory of 4804	1604	GoToAssistLoggerProcess.exe	93
PID 3992 wrote to memory of 2044	3992	GoToAssistProcessChecker.exe	95
PID 3992 wrote to memory of 2044	3992	GoToAssistProcessChecker.exe	95
PID 3992 wrote to memory of 2044	3992	GoToAssistProcessChecker.exe	95
PID 2044 wrote to memory of 996	2044	GoToAssistUnattendedUi.exe	96
PID 2044 wrote to memory of 996	2044	GoToAssistUnattendedUi.exe	96
PID 2044 wrote to memory of 996	2044	GoToAssistUnattendedUi.exe	96

C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe
"C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe" -regsvc
  2⤵
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -regsvc -starterpid 5012 -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType 4
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1668

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe
"C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924" -ApplicationType "4"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
  "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Itmjlvnr --annotation=installationid=1wpJ8e51q4 --annotation=version=5.11.0.2250 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x744543f4,0x74454404,0x74454414
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:864
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "3992" "-WtsStartingUsername" "ITMJLVNR\Admin" "-ServiceName" "G2ARemoteSupport_3125152135071953924" "-Service"
  2⤵
  - Checks BIOS information in registry
  - Drops file in System32 directory
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe
    GoToAssistLoggerProcess.exe -HostId 7d9d61fc0114ce03814d63062b3bcc87 -SessionType "" -InstallationId 1wpJ8e51q4 -DeviceId "" -LogLevel 2
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
      "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistLoggerProcess_20240824__23_43_54_481.log=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/appdata/GoToAssistLoggerProcess_20240824__23_43_54_481.log" "--attachment=attachment_unattended.json=C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Itmjlvnr --annotation=installationid=1wpJ8e51q4 --annotation=version=5.11.0.2250 --initial-client-data=0x4c8,0x4d0,0x4d4,0x4cc,0x4d8,0x744543f4,0x74454404,0x74454414
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      PID:4804
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattended.srv.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Itmjlvnr --annotation=installationid=1wpJ8e51q4 --annotation=version=5.11.0.2250 --initial-client-data=0x5ac,0x5b4,0x5b8,0x5b0,0x5bc,0x744543f4,0x74454404,0x74454414
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:3464
- C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe
  "C:/Program Files (x86)/GoToAssist Remote Support Unattended/3125152135071953924/GoToAssistUnattendedUi.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe
    "C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe" "--attachment=attachment_GoToAssistUnattendedUi.log=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json" "--database=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoassist.com/api/dump?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2OTU4OTc4MDMsImlhdCI6MTY5NTgxMTQwM30.DA4-Xvz7KIJlrvg74ZjS6oKS-e6OKgZTQeTdnUmiyyQ --annotation=format=minidump --annotation=hostname=Itmjlvnr --annotation=installationid=1wpJ8e51q4 --annotation=version=5.11.0.2250 --initial-client-data=0x538,0x540,0x544,0x53c,0x548,0x744543f4,0x74454404,0x74454414
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistCrashHandler.exe

Filesize
616KB

MD5
80d72c76edf84b862dbffce6605eec1d

SHA1
cb9cbb525572a96eb93854eb568d0142239907bd

SHA256
1c6bbae4a492afe7265d916e8de9751677264881a033f989a47d956b8a4a0059

SHA512
2803da332b7e708ce1ca9005f913e2f8d87971e49c032a8611824275c586f06d587fda6c9b23eaec60a7c75c66dbc010fbb5df44469172e06c35b6a920323489

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistLoggerProcess.exe

Filesize
394KB

MD5
0ac380cf054b275a56e0880f7aa7fc4a

SHA1
64449cefa0346e7af14c36dd72aa7d5e30506f99

SHA256
2ee28354d059e89a9e3b5dc56dcc50d867f0fbed37e0ece677c93526156219e9

SHA512
1656f52919165cb7b57876f4db81871a2094bc5e840522947307e796eea7e6c3a805675a1990364a525b26233f902ab009c9a20f7629a7111788ab03a3412e59

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistProcessChecker.exe

Filesize
393KB

MD5
d95d1b3de2c3e5f483d529e0d483cb8b

SHA1
7c88ca6649d63e8daef2ff0de3076031bcdedccb

SHA256
da1ea4cb74efdf84736d717571c7304390e4b7904992b970e109103504e39582

SHA512
2a2a2c78425eb074582c778ce5e66cc9e79fd62c2e9fd1077d02e91cffca9d71c6cd966a9b317aaf91bb64d3811a7cf053a159f6aa4b43f3f46d7dd46319e2dd

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattended.exe

Filesize
395KB

MD5
96ccce6a55ab1548fc200be33163cefd

SHA1
2d35e1433c77a39c4f1d1221f49ecb054a4a7248

SHA256
3de806b4f614d028f1a161926f49b3c1eb8cf61bf7d4bf7a126e43b53628cc3b

SHA512
03ec92c2ff0a4aa5dd8473559a8347caa6faedaec7179c49c9efbb6b0b4dff68b1319299715e659055238afca0a5032770bf5cef6c346db175825f5f9dcf5ab7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnattendedUi.exe

Filesize
394KB

MD5
9eb7da68a997920cba58e893e3076b63

SHA1
8c43dc5706ccc7a629d5b7a6d3b3aecd167dd7dc

SHA256
4ea6d788a2f6de741e37e6f4f14926ef74683d395d9b8017285b1869791490bd

SHA512
a499339ec21a4a062dc66365d8483fa072c171eb1c83c9dceb518460f36faa242c0ec457f5dbc95422571104396f3cb92fde3ee83ce5245d9655d9ee3f706075

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\GoToAssistUnlock64.dll

Filesize
151KB

MD5
80e21bed8bad302f2291bc93a0a15b20

SHA1
91fa16244af53489c2ff8bc58dc8c6246fb7ac9d

SHA256
fbae09029da4ca01275fdd9ed672deb54acb2e94e290452a473fa5f851cf9068

SHA512
9cf75b4cd47a186b831629e510752e89a6a5fb45c26f03e72ee79ca337a6a00debcb109ae4ed0ba378321bde4d9f09b594f0ed041837cf384ebea841cd9b9867

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\LibGoToAssist.dll

Filesize
16.6MB

MD5
266c0854bd739b9563a1177b4c8bb220

SHA1
c8b1bdecd321af0bdea1d5a1b45fea090de5dc24

SHA256
2eac0a0bb6f1194c71089ef45d26c30c5be777961a14f9639b74afab66bd3d6e

SHA512
4ebf5af8b9c0b379922adecd28501fe45f2592a5af2007215cdb6f32959364be60eb2c58e865373a4428f950076d09cb1af72948f31e844c711cdf5c4ecc00c1

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\MediaClientLib.dll

Filesize
8.9MB

MD5
f0909f5ddd73e8f9a9fdcb15bf0a36b3

SHA1
a99a3b68cae2a87b24b77ad9725e0c4dd8e82e12

SHA256
2468fb1db1939368ff64f8bf413d459d0a84b45d261ab4d6aef2d1a76fd5899a

SHA512
f707a85df58a3d4ff6701dce71ed8b51152d0fa5f08148b58e01a17fba175d23e2fd4eafd488e1a7b6e6fc570c33925d73b50713ea4db5c321fe66069733570f

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\PasswordPrivacyDll.dll

Filesize
1.1MB

MD5
6e0fa5d80f21f912c4ae58df7773e90f

SHA1
ac26d3596f119512a41ae600579775bf327c8df0

SHA256
af6a9f0177e329bb53eb68c66a7b4d211c17089b9afe35b7226b45541d6fad28

SHA512
bd9af05095461a4e6e683bf6719d81c38b021c83135628de4ec6869b9316c6d9ca552aa97bbcd28df716c1f5dc98983b5c10673a64a7f97fa7a08d1bb4c27c5d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistLoggerProcess_20240824__23_43_54_481.log

Filesize
3KB

MD5
58d8ee3e445ce928c19e4e9e9e35ae77

SHA1
dc6d09b59de27bec522ee27f353ec3ed8b3b797f

SHA256
2d1410163e7a0b61d7a25e74861459cafcce588c7595b9f1c39b87c57244bf79

SHA512
ec28e7db004657aa3cb473341347c91b6dc048f383e8ad39b857791680bd96814825eb6688c9854195dba80b9cb5074523cca9e3f6e35de6f3961f821d6031e8

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.log

Filesize
4KB

MD5
10584beb3b3c31f738febb01e210ef2c

SHA1
1412005558b82ee2357080cbf776855dcf938927

SHA256
d77c7517ede73495521f36ecc18dff2aa1da72c0b5544df0de96cdd0231ba4f6

SHA512
050f44d9315cea54cb5dffffabb92e08a937033b891aee717565ec0d6f8a9c05c1ca07eae3b3a2caaa4c4f00f48a4f6c37ba65f29290f99d815a501cee524592

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log

Filesize
3KB

MD5
57047bfb63c078418804589108538e63

SHA1
9de527417d758468625061ec6cccb8d85e31b500

SHA256
e2e709988a919b97d025ef335154d2145b32d151949b8f32d432b2b65985b978

SHA512
0257b3f2887f393739fe7c667521089dcfcd66821d567b77eb6d3fdab5a060bf993578ee956733106bd7227dd8f8ad5880d98c0362f6104c7f3437b367bbd8a3

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistProcessChecker.srv.log

Filesize
5KB

MD5
dd62fc0c8694ba76ae15d25293f0270a

SHA1
14dd3202a5b6c76cfe571c343c4d8ec20f62e9f0

SHA256
52cf9764a76b32ad66b51b65a3ed4a672a579ad543df619b028dbd43f37f7670

SHA512
7827f12d61a4e20491a7b2f50ddc6fbd97d629b2a858337b584a0e6b2014e3eaa2cee710b4c0ecf6687a10cadfd7f9caa8c3e2a7fdb782e784078d3d8e8dccce

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.log

Filesize
1KB

MD5
459973295e36d5aaaab91d7e8c17f9da

SHA1
6f77df349c3039958731a09ce337114feb6a2fb4

SHA256
941b3cce2c1f3d610f3449a23343c12c5e467a7e813cfa08a6e66c7a27cee138

SHA512
6d351b2d1e7687fcc1a3b37eba577cc94b3cc92369819acc9702037bdc998106286e6337704d2e217d65f65a7ecec887d182ca64ad77031bc298abcacf394eb5

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log

Filesize
2KB

MD5
e4389fc25f4170ac5f79eea66d5ac87e

SHA1
764381c8e19f13177f1f85b767ef029e4a4f5286

SHA256
5640a3766e74aedd5cb27fb77dcbb7e20893ac96197e0264345e0f04a8718d22

SHA512
9a026abd0a75f0563bd4ede730ad809457ccda9a2a216d5ad336af2df2c5b9524b30a19045ffd3773d014b83979d26f0e85d91cb3b58512bbaac1dad40b969ce

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattended.srv.log

Filesize
6KB

MD5
80547b1a9b67e9576d083a99d5775ae0

SHA1
e10df147db18a90a88ef84687829d936592484aa

SHA256
58af3f11a81c7c40355f608e12a2d685d6a0f0be7b965bff810ab01ac42bdbb9

SHA512
41e926ce4c11a763eb73e02e30cca1ca3739b66789712ce4ff83ac58502029e50cab06f7780e6f37e905dda33f964bad66e24f85d3df7626ad30bdbc9f4539ad

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\GoToAssistUnattendedUi.log

Filesize
2KB

MD5
e58d0b3fae6e883962ca1d813a504f1c

SHA1
7ee6b43bdc38686323f23baacffde051883da4fe

SHA256
271916f8d56875e0a1daefc42322cfbb8fdfbc7b8adab20620bb02150d8c7ede

SHA512
d7255d9c4f12b8092e643f902a4b1c28286e8383851ec39b480ca3fc593e9e41054d29a369eaad8b6cc4c964fe372b1ecf362a15af31bdf5a9ea75167b4cdfa2

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\LoggerProcessCrashReportDB\settings.dat

Filesize
40B

MD5
9ea211d973e6bcd57047232d432e43be

SHA1
9895dc482c6aee3fe47ded37f6d0e32365a7b2b8

SHA256
1f1137131f1bd3b4e2c5cd36714fae518b929c0d8bc1adc9e2b619ecbe20b7d3

SHA512
92e03bccb5226542914b39ae7d8acf57a417090d335e7f265b1427bde9005407e4572569f1fb81f80bb1dbe65a76da3157424b405dc2ca05fd3f4b6a6af643d4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\ProcessCheckerCrashReportDB\settings.dat

Filesize
40B

MD5
e9c4a99c962037374a9dc96a2536aed8

SHA1
335de46a96244faf434c33eeb316cd82f8495bc5

SHA256
19badbc9c95dc49197d74dfba76cd41f877214751d00f63a3face253ec4d552b

SHA512
cc6f67d754fe10a154016f72effd5eeea15cbcaf15255299819bd742fe5b7cfd44525b5942a7dbf7ab2971a5f79d997efbd171e34522a056b08c57294e6d8f14

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedCrashReportDB\settings.dat

Filesize
40B

MD5
9d1a5db95fcee45f617336b1385d0bb6

SHA1
935fdedec5b7c984ba375a2b5d72f17f4d6acac5

SHA256
ac59a071a1574a70c2f7f31079bad7f0288a374c3bc10c80b062da0481c632af

SHA512
8dfc7419d06781959b592ec250c35b928e8b55b8e82ad0d903549e6013048a14e5498fe9f5f122542a48f6cbe4db539686ab5655cbd44ced2a0e217a19a2cbe7

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUiCrashReportDB\settings.dat

Filesize
40B

MD5
686540a369ee1d8e6d40757e1d418a57

SHA1
bfe3f61d396ca760a4ea9c2daeb0dad941afce96

SHA256
d667ea64f6358fd9e92159d6a770f3d28d63ac08228dfa89b55aed1174fbf5ab

SHA512
3be9f4dca33cc7a3c5796bf7b81dc53469b9fb5fb663d6777829e8e028c45888f741bdc3c6a85a1ebdd42c0005a35861f244114730092e0ca2c2640271613dc4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.csv

Filesize
1KB

MD5
54e596816ae138093aa802dc93374a1a

SHA1
587dd89a2bcb2451078b1c6b3cf8dbe08170f959

SHA256
37e18f68ae0d974ac943d2e89a1c7e6e29203928f5c9fd1f500a7cdb03c1f09f

SHA512
d5c8fbb2cfd15c275ea476ccfb490f7959d064baa754d15c1aee941bd588ce2fc4789357d0b66f119b18cac86cf11cb4b4eb68dc0355bff048d87a330465316d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\appdata\UnattendedUpdater.log

Filesize
2KB

MD5
a6577fdafb966b060c91dcc3a822e036

SHA1
39b26eb574d9c73cf2bbc4aeb4bd86344f1ad3f9

SHA256
2e4e28958713ba4b3d09b977ca72b097a47b100c0e274242bd52794996fdd44e

SHA512
0caa8e0dddafae6f63a7533676aa9d31e7ee171a44fe6b85fd29340a319e5de4cdfef55819b0dcccc36eb4b8e3c4f8961ef37e13fc129591d0daa3b4d30be01c

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libcrypto-1_1.dll

Filesize
2.9MB

MD5
c419b190b914832feaa0633783219e1b

SHA1
1895f14cdecc68061f9db848dc8ee8a348c88cc5

SHA256
72b9a34ca7e9445512dce47d65027775419dec6a54b659c413cd9963fd4654a4

SHA512
f617bf5155c119e932f00d2372ac0df753c42ceb090c04572a2694fde64c9ed01e3c10d7026c4e0d3372bea90d70cecc5f0c128364efa5fffa62a7038d288f9d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\libssl-1_1.dll

Filesize
921KB

MD5
5a1e3c5e88bd1d5c47e4aabe3935ddb8

SHA1
d069fce9162bdf47bf4c591957bda941b4f7aa00

SHA256
90ce0a28e7c4ad109497f6470817b938ec3413ca7c96efe1a85ee7c5741fe88d

SHA512
e3b1740679f8ec4a67821348fee126bac4d540de5fda3d440bd059eae7bc628b4b3f7fb6c55ee5feec0df3c6322d81ce2d83dacef7754940b72286109d256096

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json

Filesize
849B

MD5
7eb14a2bf3719f630471ca3bc8627eda

SHA1
b3e26125d5ea9747c4f4bfbd814f57edb543d570

SHA256
925f74f616501843a49ee3ff372e5c71d80ecab0fbf0b30af5b8e7e6d3d08179

SHA512
31e6731f5d02856cefdade86d338cb9c4ad6e35661344d7c48e6b010e3ebf439bd34119aa0abb1c35580070643c7b4a76c395f5f0c4c041423901d7772eabd0f

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\mandatory.json

Filesize
1KB

MD5
3e28a9d2d96efbc898ab6edb9a6bf87a

SHA1
4b6bc27f53cbce1ece932390ea80a6e98883f194

SHA256
342c0464148f0ee246347424a6bc41cfe87c5717a3d50a899317c757c84d6785

SHA512
d42268802b6cb91567a20281878388c1852c33fab2746d5dabb5bd0b08b021143ed77675843821f99bec5fc6642dd5b4a07f854486908a5ae260d3b8357c1d10

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\pc.json

Filesize
145B

MD5
6557d5620cbecb93627f4772205536a8

SHA1
544d0cc11fd7e099e98168a732efbb0c751c2b94

SHA256
cb80e0c30fa15c32336661ac98d95b48dbfc195a2f79424b6da8ecae6b7b092c

SHA512
65ec912003e1949a2b0d98bbac74ffaa0f0984cd1e0284d200e4207b2feb5f01b15f7dd3dd902aae13dc5dd592ec910774c3aa001034a2bec57d4abdc68bd95e

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
260a4ce913e193c6d16fa423164929bc

SHA1
7029fdfa65c74d4c550e5420f78061911695a3f5

SHA256
18b2da43936ff0315d703a14d43abcdf157d6153f3baf4c41cef324ad08b8b32

SHA512
8c37d6e8e7ea27571cc012c6af411de660645c588f9ee02867616c10b5ac5d972bc2333984882b0032541ac0caa746ddb707452874d0ab4fc7765772ccad42c4

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
0b1f8dcd7ecb49a28d5553c31fffad10

SHA1
a62853b78b3218e06849f9b1783675c4fc1b3200

SHA256
4256482ef26c484389f9f1a7e3dc52f34b249303dd49009e2b794fffb7ab972f

SHA512
1cdcc6609e2e2aae4e3aa2eade87f32102a501718ef5e07152c4d946b450d9a445f00c538dcf2d38ccaff7e17db13ccfc5e5664fd40f3c97729f196fbf07ed9d

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
e1c8a70e829bd62d4df2a01f0c9b8ecb

SHA1
c9a58a217a5d1b268ecc3b121851eff590818172

SHA256
cfcbb8af4de6d5ee7b1c0d0121d4e926613c9b5dd12764a10d34b82bc0243053

SHA512
b7d10373c4fbd5d86f9f701d2f139656f7d5b89b667879396a977ef9ae3f20e228a0a39b4ad7ff4197b882271e778dfc092eb4622a074980b577326f63fec7c9

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
abd7cb52c8967562da220dbea839e560

SHA1
04a98483bb29a4a87e9180a7e7610229ff76bfb6

SHA256
eeb1ae1589a4829444cccb0f11154cbf3fc723cda9942ee5e76e9f3ef6698405

SHA512
19d8c5568115ec79e1165436451f29ce9ad660e38f48e2b7c7dbd645bd5d094afb0de8baedea1231f289580aac3793f180055c12127d4482a1f2ec58362164c3

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
e039dd7fd74cafe826e4fc2b7c96a2ba

SHA1
4bfb5b85bc616d6a88fa913887df754c1035ff37

SHA256
cd9826ce00342a817f24ffd1165687c7152935cf0c66d48dada5e586e26b3410

SHA512
cfcf4f578c43ea2a74e20f7a0cc2c48d7baecf76e624a44dfa8ec169641fe7882505e31c7bcb4a6a03131e255e012d76ae8c55274e20029466772d57db61d836

Download Submit
C:\Program Files (x86)\GoToAssist Remote Support Unattended\3125152135071953924\unattended.json

Filesize
1KB

MD5
2b398f57049151a996d3ea0feba49c72

SHA1
35a651f3a191c7b87d1890095d52e10e47c3ec7b

SHA256
005c11a6406b4d3349d6135c4bf067b6d8e1c0d6adfcbcb19f1e96ce096b91e6

SHA512
ac465ee67068a010128cd16dbc45db0e5df7709fceb683f4a9631b971def4c889aed958c8ffea315e6d83553ef9024b8f9ae8764288ddc7790554d87da56679c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ziv_2023.exe.cmd

Filesize
537B

MD5
2d1ec5c3d0d2fd67e0aa148f4e523d93

SHA1
24a6528837fe7c825f44be9e0c2bd942203bb9b0

SHA256
5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b

SHA512
7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25

Download Submit