{
  "Name": "GoToAssist (GoTo Resolve)",
  "Category": "RMM",
  "Description": "GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform.\n",
  "Author": "Daniel Koifman (KoifSec)",
  "Created": "2025-11-12",
  "LastModified": "2025-11-12",
  "Details": {
    "Website": "https://www.logmein.com/products/resolve",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "User",
    "Free": false,
    "Verification": true,
    "SupportedOS": [
      "Android",
      "Windows",
      "Mac"
    ],
    "Capabilities": [
      "Command line Support",
      "File System Access",
      "File Transfer",
      "GUI Support",
      "Remote Control"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files (x86)\\GoTo Resolve Unattended\\*",
      "C:\\Program Files\\GoTo Resolve Unattended\\*",
      "GoToResolveExternalModuleHandler.exe",
      "GoToResolveFileManager.exe",
      "GoToResolveLoggerProcess.exe",
      "GoToResolveNetworkChecker.exe",
      "GoToResolveProcessChecker.exe",
      "GoToResolveQuickView.exe",
      "GoToResolveRegistryEditor.exe",
      "GoToResolveRemoteControl.exe",
      "GoToResolveService.exe",
      "GoToResolveServiceManager.exe",
      "GoToResolveTerminal.exe",
      "GoToResolveTools32.exe",
      "GoToResolveTools64.exe",
      "GoToResolveUi.exe",
      "GoToResolveUnattended.exe",
      "GoToResolveUnattendedRemover.exe",
      "GoToResolveUnattendedUi.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [
      {
        "EventID": 7045,
        "ProviderName": "Service Control Manager",
        "LogFile": "System.evtx",
        "ServiceName": "GoToResolve_*",
        "ImagePath": "\"C:\\Program Files (x86)\\GoTo Resolve Unattended\\*\\GoToResolveProcessChecker.exe\" -Service -WorkFolder \"C:\\Program Files (x86)\\GoTo Resolve Unattended\\*\" -ApplicationType \"4\"",
        "Description": "Service installation event as result of GoTo Resolve installation."
      },
      {
        "EventID": 4688,
        "ProviderName": "Microsoft Windows security auditing",
        "LogFile": "Security.evtx",
        "NewProcessName": "C:\\Windows\\System32\\sc.exe",
        "CreatorProcessName": "C:\\Windows\\System32\\svchost.exe",
        "CommandLine": "\"C:\\Windows\\system32\\sc.exe\" start GoToResolve_*",
        "Description": "Process creation event as result of GoTo Resolve installation."
      }
    ],
    "Registry": [
      {
        "Path": "HKLM\\SOFTWARE\\GoTo Resolve Unattended\\",
        "Description": "N/A"
      }
    ],
    "Network": []
  },
  "Detections": [],
  "References": [
    "https://asec.ahnlab.com/en/90968/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "GoTo Technologies USA, LLC",
        "certificate_thumbprint": "33023C0243016946C78CCB9B15AC6C203882E5D9",
        "certificate_der_base64": "MIIH2TCCBcGgAwIBAgIQDq06P/pwwKIK4jaBiZNRUzANBgkqhkiG9w0BAQwFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI1MDgyMTAwMDAwMFoXDTI4MDgyMjIzNTk1OVowgeExEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc1OTg0MTEyMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEPMA0GA1UEBxMGQm9zdG9uMSMwIQYDVQQKExpHb1RvIFRlY2hub2xvZ2llcyBVU0EsIExMQzEjMCEGA1UEAxMaR29UbyBUZWNobm9sb2dpZXMgVVNBLCBMTEMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXBnwWFr1Haugt1kOHarj31h9QgazDGc0Ijs8ownMkZ9WxjYhDNd1AfzNc6Rv1IWM52EYnFZfsP24vfDSXsMWQVPqNSAeP6HcNF3zZ3vVVNpydrbX43l2ZqIs3WIw1Y9QFJxRiDgJaPHC8S3XmXvrEGIWMGEUidteAm5c7lAEkklohrxWWnvYZQ6Bk6TrVAqkDKzlXovqL39ERdX1b3vprbudHhZHQAyax5sYb24nlA4y9NpzYKAY7KivhhOQNDJ46TjMCsGfQuyo0Ni21+KjNvMcRcVOh3G/VSSEpg2AIUV6GWa3/XQXBuXyTPj2h5wf6x84d2wzV6XJ9GyxpD8eZLf/9QxMoqAxS0/tlOKpPgEVGh9BhlFyLVaX4AolLE48qhZSL6tIs74965yyrp0OzRierAh2VXoF79Cp5wKdu9id9ztlP72sY5Qf0EUSMFFEe5aS9RY0Fu2PxT5CR2ZdKtSBtYK1nwagYYPjmNW8bO5FC89JiZlcLDVeIyQeAPo3ZSuMhZCz0S12t2QpktFZvEJ1VIayQTC63N9S4VrQRnusnlxJLImrrfu0bI8F9fUoaUwJo14/2lwSczOdmfZxo3bKqQSkrMSBeNixUWeiyrPUczLe5DfgUdzmtJ4fJOTkEQEkNaQ9ed+u4ItEZACUX7ujgYZsJ8a8ClUmrx62yPQIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFLYSDl2IK7QIyBrxGqwuqqHXUmXDMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEMBQADggIBALVnUZsOeb8GoGLjBT3VRdyLnQEuKwn41b8I6fWfIF5jnYtOzW/dJqOuIXvs0LSQ8FHHpvWYUPqjL94pp+SHWCreuCZ6iLrt/tXCmWYUkhU4DY2m4ddNEAvuJaqzcwg8xjrzlHvpyKInfeB8jUujc8Rf/oWVLsgPaI/mp9wkSmVwytA9vnS8mi/BH14/wICihbwuNN9N+uHbeJowiw8NZGxteanaHgoLTZ76adJEOGoHkbtyXDZL7YII8d1HUvwMjB1h1ZxEtFtpYZesvRfSa99pt+jbyeYOXXTxYwyHGtDqTmX3RAKTETtPEsqlY/IZ+MPqLZs/YQORlVrUEC3VCWdUvQvCZpItxAX9Y98bBQzjCAUSqFP7RznSbvtwJwmQaXR1ul2sn22rV2HUpF+C4JuWd1Aq/aD+UQcZcqtiQVag+vBVmXYevdPRFr7v+TauGPIqdSH/igbj2vl/mAV6aG49VSYgz9GMNM33CoLSzydASa2ifgybt4tDsmlqjP2FE1JKVSXN6YxrhEOC0YOi7eugU1JSJrHubaUvRCiUBD5qfN8HOzR6CzOy82FEAurAG4EB56H7W+L1rQhqG5J8/gkPK50kZobrCS/cQ2iK3S7735myNL8zkXfjrwjFuFqpy69crtvDqmlYWsBxlkYdg8EKb/yTlCAicCQyCG5Y4YD3",
        "src_file_sha256": "5e05eb31ab2b234bf34e66703761f6ff3663376eecf2ced7ec16852d037286cb",
        "src_file_path": "downloaded_files/gotoassist_(goto_resolve)/5e05eb31ab2b234bf34e66703761f6ff3663376eecf2ced7ec16852d037286cb",
        "src_file_company": "GoTo, Inc."
      },
      {
        "signer_name": "GoTo Technologies USA, LLC",
        "certificate_thumbprint": "8D3FA6EEEBFC68A0FA76CDC4C6AD5982FE07DE91",
        "certificate_der_base64": "MIIHWTCCBUGgAwIBAgIQDgyHZ7stT+/C1hffEc4biTANBgkqhkiG9w0BAQwFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDUxMzAwMDAwMFoXDTI3MDUxMjIzNTk1OVowgeExEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc1OTg0MTEyMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEPMA0GA1UEBxMGQm9zdG9uMSMwIQYDVQQKExpHb1RvIFRlY2hub2xvZ2llcyBVU0EsIExMQzEjMCEGA1UEAxMaR29UbyBUZWNobm9sb2dpZXMgVVNBLCBMTEMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDc511p+U4/ceMa+9gCeidFo8xSj0RQ1VyClI4OP3etR4zxyPnjb4hyLm72YUTyqkJ0Y3b2LOde6UkUuxEG1gT9H0VNZhcKrxmWZ21Ir0vmqXUkfooGRis19bQq1GXnxUyMnhco8auWC4lZJVHsz+dfV88cHLeLvlLT3YXxawpl/uLvH9Vu+tI5CS9asbfzYGBZic6lQaZ+U2nz1QUlN0WWOuWFqL0GiEIlJ+a+avoouNeJpyUThxThX0IKwRUD4LNAzTfyaMiAJXcwARnNgMgcW6YrWEkb0x8BQ3hNVuVizzDEMrMUF1UiGXk+rYefPGdA51wt6wENKXucYHcny6zET0IHVit9zhyXscmtYgz6hwEWV1ale6Zjm2hI1uLNlALB00SDzi4qXMlhWA3bggboQwCrBpO584EXR4955wSuo05Ug7CP+bdCBpDIgG2rB+BeXcnCRFDzilQXt7nRjO050o4tg3K0zdzpXnrSM1mrd/UYw7cfnKy1A6WHK/IMGAECAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBSnyrp99WDe7wuDoNKOpFjILc5AfDA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBDAUAA4ICAQAB5/85dwc018g+cEZViyy1TAraBLqm/YWb/ZVqc1L8C2a/XRReSW5h4w8QtXHOu9kqxVhk20WILztg22kzwH8vJcTHmnGZ2g3OWHufQV/r8pPHM+XedATAZ/v5hSs8BeySPQkessVmmGR8jdk1UzQtXbwbhfhGJc2luPhz9SWW/PG7lZaX6NmD3VtFkf5fjwj0JXO7O/UbKwJVX1jBhc9t0AfuPrpSZjZ/XYIPKA4HXJQjecxIbHxjDBQqyiGs2A8OgibT6dOHT0wh8gJ/lzqNMMae44ToDXj4V736e2L9lllQVMCo3KPjGk0nDE+sYTqoU0kODwUyrW9DbNUUqjolvJxFTQVFcINkLDxOq0KxlXqmZ7V9Rjd939skXYvK2qe29HxHIkH1iEoZIP/WmrZdwa5B8HiWEl7G2Qsz6vT78D4llJOaNVXHFHONE4OLOoC5vcMEO5s4Xxbay7IBkXBm5f49fKuPY3j7+PMpeXqAYkKhcJURPFklu4AyoRq+YCN7S4/WtRpke3nLK6t1yLdqaQ6vxQAWmIdXIpIqEqGnnED4IdH6ROi4h2J8FMunZcBpQfyiIYMfZgKn4Y5VeeNlqdPpbxPT0Zc4AIQ8b9guG1R2hnfntqt6uOVSCPPMMSTLzEKvYtButJ29lG3M2M+7eJ2NuCPcoCMMKwTxRSa/Qw==",
        "src_file_sha256": "961e704a4d364ee384552af3551bac1de02541d8bcce40d5255fbc8cdea3adb1",
        "src_file_path": "downloaded_files/gotoassist_(goto_resolve)/961e704a4d364ee384552af3551bac1de02541d8bcce40d5255fbc8cdea3adb1",
        "src_file_company": "GoTo, Inc."
      }
    ]
  }
}