Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\G2ARemoteSupport_SWCcjiTcAs] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\G2ARemoteSupport_SWCcjiTcAs] 'ImagePath' = '"%ProgramFiles(x86)%\GoToAssist Remote Support Unattended\GoToAssistProcessChecker.exe" -Service -WorkFolde...
Creates the following services
- 'G2ARemoteSupport_SWCcjiTcAs' "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended\GoToAssistProcessChecker.exe" -Service -WorkFolder "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended" -ApplicationType "4"
Modifies file system
Creates the following files
- <Current directory>\unattendedupdater.log
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistui.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\libgotoassist.dll
- <Full path to file>.cmd
- %ProgramFiles(x86)%\gotoassist remote support unattended\unattended.json
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistunattended.log
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistcrashhandler.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistprocesschecker.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_processchecker
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistunattendedui.log
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattendeduijsonsink
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattendedui
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistunattended.srv.log
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistprocesschecker.log
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\gotoassistprocesschecker.srv.log
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassisttools64.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassisttools32.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunlock64.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmifilterhook32.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmifilterhook64.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmiinputhook32.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmiinputhook64.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmiscrhook32.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmiscrhook64.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmisupport7x32.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmisupportm32.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmisupportm64.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\mediaclientlib.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattendedui.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattendedremover.exe
- %ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunlock32.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\lmisupport7x64.dll
- <SYSTEM32>\gotoassistunlock64.dll
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended
Deletes the following files
- <Full path to file>.cmd
Moves the following files
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601e217c9eb8e55d60184070000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d6016063fb138f55d601400a0000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601fe51c9138f55d601400a0000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d6013218ac098f55d601a0040000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d6011c4275098f55d601a0040000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d6015220a6058f55d601280a0000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d60120fc60058f55d601280a0000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601dda6a0198f55d60134030000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601f29f9d018f55d60100030000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d6010af967fd8e55d6019c030000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601d8d422fd8e55d6019c030000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601928a6bf98e55d6014c040000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601060424f98e55d6014c040000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601583063f58e55d60170080000feffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601724719f58e55d60170080000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601661956018f55d60100030000ffffffff
- from %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended to %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\2362bb878c55d601e555d0198f55d60134030000feffffff
Substitutes the following files
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_jsonsink
- %ProgramFiles(x86)%\gotoassist remote support unattended\appdata\ipc\swccjitcas_unattended
Deletes itself.
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe' -regsvc
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistprocesschecker.exe' -regsvc -starterpid 2548 -WorkFolder "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended" -ApplicationType 4
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistprocesschecker.exe' -Service -WorkFolder "%ProgramFiles(x86)%\GoToAssist Remote Support Unattended" -ApplicationType "4"
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "324" "-ServiceName" "G2ARemoteSupport_SWCcjiTcAs"
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattendedui.exe'
- '%WINDIR%\syswow64\cmd.exe' /S /C ""<Full path to file>.cmd" "<Full path to file>""' (with hidden window)
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "324" "-ServiceName" "G2ARemoteSupport_SWCcjiTcAs"' (with hidden window)
- '%ProgramFiles(x86)%\gotoassist remote support unattended\gotoassistunattendedui.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /S /C ""<Full path to file>.cmd" "<Full path to file>""
