Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\GoToResolve_] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\GoToResolve_] 'ImagePath' = '"%ProgramFiles(x86)%\GoTo Resolve Unattended\GoToResolveProcessChecker.exe" -Service -WorkFolder "%ProgramFiles(x86)%\GoTo...
Creates the following services
- 'GoToResolve_' "%ProgramFiles(x86)%\GoTo Resolve Unattended\GoToResolveProcessChecker.exe" -Service -WorkFolder "%ProgramFiles(x86)%\GoTo Resolve Unattended" -ApplicationType "4"
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdater.log
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolvetools32.exe
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolvetools64.exe
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolvecrashhandler.exe
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveprocesschecker.exe
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveui.exe
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveloggerprocess.exe
- %ProgramFiles(x86)%\goto resolve unattended\libgotoresolve.dll
- %ProgramFiles(x86)%\goto resolve unattended\libcrypto-1_1.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmisupportm32.exe
- %ProgramFiles(x86)%\goto resolve unattended\libssl-1_1.dll
- %ProgramFiles(x86)%\goto resolve unattended\unattended.json
- %ProgramFiles(x86)%\goto resolve unattended\mandatory.json
- %ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveunattended.log
- %ProgramFiles(x86)%\goto resolve unattended\pc.json
- %ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveprocesschecker.log
- %ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveprocesschecker.srv.log
- %ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveunattended.srv.log
- %ProgramFiles(x86)%\goto resolve unattended\appdata\gotoresolveloggerprocess_20220818__11_55_58_981.log
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveunlock32.dll
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveunlock64.dll
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattendedremover.exe
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattendedui.exe
- %ProgramFiles(x86)%\goto resolve unattended\x64\g2rvdd.inf
- %ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe
- %ProgramFiles(x86)%\goto resolve unattended\lmifilterhook32.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmifilterhook64.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmiinputhook32.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmiinputhook64.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmiscrhook32.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmiscrhook64.dll
- %ProgramFiles(x86)%\goto resolve unattended\lmisupport7x32.dll
- %ProgramFiles(x86)%\goto resolve unattended\.sentry-native\98ba678c-786d-4005-b342-f1a54848c817.run\session.json
- <Full path to file>.cmd
- %ProgramFiles(x86)%\goto resolve unattended\lmisupport7x64.dll
- %ProgramFiles(x86)%\goto resolve unattended\mediaclientlib.dll
- %ProgramFiles(x86)%\goto resolve unattended\passwordprivacydll.dll
- %ProgramFiles(x86)%\goto resolve unattended\filemanager.dll
- %ProgramFiles(x86)%\goto resolve unattended\x86\g2rvdd.cat
- %ProgramFiles(x86)%\goto resolve unattended\x86\g2rvdd.dll
- %ProgramFiles(x86)%\goto resolve unattended\x86\g2rvdd.inf
- %ProgramFiles(x86)%\goto resolve unattended\x64\g2rvdd.cat
- %ProgramFiles(x86)%\goto resolve unattended\x64\g2rvdd.dll
- %ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdater.csv
- %ProgramFiles(x86)%\goto resolve unattended\lmisupportm64.exe
- <SYSTEM32>\gotoresolveunlock64.dll
Deletes the following files
- <Full path to file>.cmd
- %ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdatercopy.csv
Moves the following files
- from %ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdater.csv to %ProgramFiles(x86)%\goto resolve unattended\appdata\unattendedupdatercopy.csv
Deletes itself.
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe' -regsvc
- '%ProgramFiles(x86)%\goto resolve unattended\gotoresolveprocesschecker.exe' -regsvc -starterpid 2360 -WorkFolder "%ProgramFiles(x86)%\GoTo Resolve Unattended" -ApplicationType 4
- '%ProgramFiles(x86)%\goto resolve unattended\gotoresolveprocesschecker.exe' -Service -WorkFolder "%ProgramFiles(x86)%\GoTo Resolve Unattended" -ApplicationType "4"
- '%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "788" "-WtsStartingUsername" "fxfeocg\user" "-ServiceName" "GoToResolve_" "-Service"
- '%ProgramFiles(x86)%\goto resolve unattended\gotoresolveloggerprocess.exe' -HostId 29e3f22b44e52caa688e50f220225f3b -SessionType "" -InstallationId XnER6Zuy9Z -DeviceId "" -LogLevel 2
- '%WINDIR%\syswow64\cmd.exe' /S /C ""<Full path to file>.cmd" "<Full path to file>""' (with hidden window)
- '%ProgramFiles(x86)%\goto resolve unattended\gotoresolveunattended.exe' "-RegisteredProcess" "1" "-ParentProcessId" "788" "-WtsStartingUsername" "fxfeocg\user" "-ServiceName" "GoToResolve_" "-Service"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /S /C ""<Full path to file>.cmd" "<Full path to file>""
