Files
atomic-red-team/atomics/T1219/Bin/GoToCleanup.ps1
tlor89 99335067a3 T1219_Update (#1566)
Co-authored-by: Toua Lor <tlor@nti.local>
Co-authored-by: Carrie Roberts <clr2of8@gmail.com>
2021-07-27 09:31:11 -06:00

15 lines
954 B
PowerShell

# GoTo Opener - delete registry install key because it can't be called by the system
$InstalledApp = "GoTo Opener"
$Keys = Get-ChildItem -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall -ErrorAction SilentlyContinue
$Items = $Keys | Get-ItemProperty | where-object {$_.DisplayName -eq $InstalledApp}
If ($Items) {
$KeyToDelete = $Items.PSPath
Remove-Item $KeyToDelete -Recurse -Force -ErrorAction SilentlyContinue
}
# GoTo Opener - delete user directories
Get-ChildItem "C:\Users\*\AppData" "GoTo Opener" -Recurse -Force -ErrorAction SilentlyContinue | ForEach-Object {
$Directory = $_.ToString()
Remove-Item $Directory -Recurse -Force -ErrorAction SilentlyContinue
}
Start-Process -FilePath "C:\Program Files (x86)\GoToAssist Remote Support Expert\1702\g2ax_uninstaller_expert.exe" -ArgumentList "/uninstall /silent" -Wait -PassThru | Out-Null