Technical Information
Modifies file system:
Creates the following files:
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Test-ProcessAdminRights.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-BinFile.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-EnvironmentVariableNames.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Set-EnvironmentVariable.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\7za.exe.manifest
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\LICENSE.txt
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Uninstall-BinFile.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\chocolateyScriptRunner.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Update-SessionEnvironment.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Uninstall-ChocolateyPackage.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Write-FileUpdateLog.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-EnvironmentVariable.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Write-ChocolateyFailure.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Write-ChocolateySuccess.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\7zip.license.txt
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\cver.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\7za.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\cuninst.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\cup.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\RefreshEnv.cmd
- %APPDATA%\NuGet\NuGet.Config
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\checksum.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\shimgen.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\choco.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\chocolatey.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\checksum.license.txt
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\tools\shimgen.license.txt
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\cpack.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\cpush.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\cinst.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\redirects\clist.exe
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyZipPackage.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\config\chocolatey.config.update
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\chocolateyInstaller.psm1
- %TEMP%\RES2.tmp
- %TEMP%\cch4nki1.dll
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-ChocolateyUnzip.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-ChocolateyWebFile.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-BinRoot.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-CheckSumValid.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\logs\chocolatey.log
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\config\chocolatey.config
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\crystaldisk.bat
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\choco.exe
- %TEMP%\cch4nki1.out
- %TEMP%\CSC1.tmp
- %TEMP%\cch4nki1.0.cs
- %TEMP%\cch4nki1.cmdline
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-FtpFile.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyPackage.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyPath.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyFileAssociation.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyInstallPackage.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyShortcut.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyVsixPackage.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyPowershellCommand.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-VirusCheckValid.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-WebFile.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-ProcessorBits.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-UACEnabled.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Get-WebHeaders.ps1
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\helpers\functions\Install-ChocolateyDesktopLink.ps1
Deletes the following files:
- %TEMP%\cch4nki1.dll
- %TEMP%\cch4nki1.cmdline
- %HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\config\chocolatey.config.update
- %TEMP%\cch4nki1.0.cs
- %TEMP%\RES2.tmp
- %TEMP%\CSC1.tmp
- %TEMP%\cch4nki1.out
Network activity:
Connects to:
- 'ch###latey.org':443
- 'wp#d':80
TCP:
HTTP GET requests:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK ch###latey.org
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%HOMEPATH%\Desktop\EasyITGuys-deleteme\choco\choco.exe' install crystaldiskinfo.portable -y
Executes the following:
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2.tmp" "%TEMP%\CSC1.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\cch4nki1.cmdline"
- '<SYSTEM32>\cmd.exe' /c ""%HOMEPATH%\desktop\EasyITGuys-deleteme\choco\crystaldisk.bat" "
