bd8c6adf7c223acdc31c1d45d178a10e6fada771f8d89adc33b4b08321af5706

Analysis

max time kernel
350s
max time network
351s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 03:34

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-26T03:40:35Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_0-dirty.qcow2\"}"

Report Analysis Logs

General

Target

huh.jpg
Size

33KB
MD5

34ad6f121111013d7f91b7607866b8e4
SHA1

af32d617ccbfe230abaa98cc9c9dcc67921916c6
SHA256

bd8c6adf7c223acdc31c1d45d178a10e6fada771f8d89adc33b4b08321af5706
SHA512

fd7791ab40a5c09ff9bf07f3a6bfee63f8ad82a38f8da3616ff23ce82833d07f4705dced7a42196c4fca7de5b2de0d7ba6ceb5b30fccff78208d55472be2f499
SSDEEP

384:jPbSglvPzcUDCwI8e8EaVlmfyP5KR3QGcBemCi9nHqYatFXyMK/Lj/i5KGTfEB:3RxzcmCwI0lKRJIFHqYaPue/TU

Score

9^/10

discovery evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exe

pid process

2432 bcdedit.exe
Blocklisted process makes network request 6 IoCs

Processes:

powershell.exe

flow pid process

687 5920 powershell.exe
689 5920 powershell.exe
692 5920 powershell.exe
694 5920 powershell.exe
697 5920 powershell.exe
704 5920 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

choco.exechoco.exechoco.exeOOSU10.exe

pid process

1052 choco.exe
5196 choco.exe
2100 choco.exe
5052 OOSU10.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4900 icacls.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

688 raw.githubusercontent.com
689 raw.githubusercontent.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2432	bcdedit.exe

flow	pid	process
687	5920	powershell.exe
689	5920	powershell.exe
692	5920	powershell.exe
694	5920	powershell.exe
697	5920	powershell.exe
704	5920	powershell.exe

pid	process
1052	choco.exe
5196	choco.exe
2100	choco.exe
5052	OOSU10.exe

pid	process
4900	icacls.exe

flow	ioc
688	raw.githubusercontent.com
689	raw.githubusercontent.com

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exeTaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

LogonUI.exechrome.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585761063255170"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 14 IoCs

Processes:

OOSU10.exetaskmgr.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	OOSU10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\ShowSearchHistory\ = "0"	OOSU10.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FPEnabled = "0"	OOSU10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ShowSearchSuggestionsGlobal = "0"	OOSU10.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	OOSU10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify\UserEnabledStartupOnce = "0"	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	OOSU10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\EnableCortana = "0"	OOSU10.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\ShowSearchHistory	OOSU10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify\State = "0"	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{A32703F2-A7EB-4757-BCE0-8A6242479386}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	OOSU10.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DoNotTrack = "1"	OOSU10.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

chrome.exechrome.exepowershell.exepowershell.exeTaskmgr.exetaskmgr.exe

pid	process
2668	chrome.exe
2668	chrome.exe
2812	chrome.exe
2812	chrome.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
5920	powershell.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
5920	powershell.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

chrome.exe

pid	process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeCreatePagefilePrivilege	2668	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeTaskmgr.exepowershell.exetaskmgr.exe

pid	process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
5920	powershell.exe
1200	Taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exeTaskmgr.exetaskmgr.exe

pid	process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
1200	Taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

396 LogonUI.exe

pid	process
396	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2668 wrote to memory of 4360	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 4360	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3104	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3220	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 3220	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe
PID 2668 wrote to memory of 212	2668	chrome.exe	chrome.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

OOSU10.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	OOSU10.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\huh.jpg
1⤵
PID:2696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffe7e13ab58,0x7ffe7e13ab68,0x7ffe7e13ab78
2⤵
PID:4360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:2
2⤵
PID:3104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:3220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2268 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:3960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:4252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4328 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4472 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:5560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4608 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:5596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:5848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:5904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5040 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:5960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5032 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:6076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4636 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3936 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1692 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:3544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1736 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:2472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3132 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4392 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:6100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5332 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:1876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4376 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:1596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5240 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4312 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3304 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:1308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3988 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
- Modifies registry class
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5192 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5628 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:3920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=5880 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:1
2⤵
PID:5936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=2020,i,14772769416021559361,18272228568205912313,131072 /prefetch:8
2⤵
PID:3364

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5920

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lbkvku03\lbkvku03.cmdline"
2⤵
PID:4884

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB8EC.tmp" "c:\Users\Admin\AppData\Local\Temp\lbkvku03\CSCC2DC0DEDBF74DD583AAB219FC544C94.TMP"
3⤵
PID:5548

C:\Windows\System32\setx.exe
"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "133585763668693926"
2⤵
PID:5408

C:\Windows\System32\setx.exe
"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "133585763672756425"
2⤵
PID:720

C:\ProgramData\chocolatey\choco.exe
"C:\ProgramData\chocolatey\choco.exe" -v
2⤵
- Executes dropped EXE
PID:1052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" choco feature enable -n allowGlobalConfirmation
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5800

C:\ProgramData\chocolatey\bin\choco.exe
"C:\ProgramData\chocolatey\bin\choco.exe" feature enable -n allowGlobalConfirmation
3⤵
- Executes dropped EXE
PID:5196

C:\ProgramData\chocolatey\choco.exe
"C:\ProgramData\chocolatey\choco.exe" feature enable -n allowGlobalConfirmation
4⤵
- Executes dropped EXE
PID:2100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ya5tfyv4\ya5tfyv4.cmdline"
2⤵
PID:1072

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8DA.tmp" "c:\Users\Admin\AppData\Local\Temp\ya5tfyv4\CSC4584C5521EA84400AEA6A9AA8BE148A0.TMP"
3⤵
PID:4964

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" /hibernate off
2⤵
PID:5916

C:\Windows\system32\bcdedit.exe
"C:\Windows\system32\bcdedit.exe" /set {current} bootmenupolicy Legacy
2⤵
- Modifies boot configuration data using bcdedit
PID:2432

C:\Windows\system32\Taskmgr.exe
"C:\Windows\system32\Taskmgr.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:(OI)(CI)F
2⤵
- Modifies file permissions
PID:4900

C:\Users\Admin\AppData\Local\Temp\OOSU10.exe
"C:\Users\Admin\AppData\Local\Temp\OOSU10.exe" C:\Users\Admin\AppData\Local\Temp\ooshutup10_recommended.cfg /quiet
2⤵
- Executes dropped EXE
- Modifies registry class
- System policy modification
PID:5052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2428

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa385e055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\chocolatey\choco.exe

Filesize
10.5MB

MD5
e007586a7919ab631c6a0807c5980c29

SHA1
aa678e654b7a0577952f0495ce24ce13a88a87d7

SHA256
463637654593c3ae015f556ccd9427efc6feb6aa466a0d29993acc611adf19ad

SHA512
1b2709ba142a88044c3c9be983a8ae6d0b51bdaa6a8940ae1fcc7ceecef28a09ddf1c0853c6f003bb7739e1e5cd91907ef837b2a2a672cecc35cd231553525d9

Download Submit
C:\ProgramData\chocolatey\config\chocolatey.config.1052.update

Filesize
8KB

MD5
098b8cd4f64a71c394780021b468a26d

SHA1
b8b9bd04891b5a9dae0a89d31f615f6b28ad8fec

SHA256
4d1d5405b2460ece564c67d045cd05d9e2f6d23d2ab45cb0535a67273d99984a

SHA512
eb6c962867525ea71df51fec50801ae557f7f54fe335a8b8b40eef3468864fafe268e3fda5940443ef09eff12cc8426dbd9d52f3db13f720be3f64ca921426a8

Download Submit
C:\ProgramData\chocolatey\config\chocolatey.config.2100.update

Filesize
8KB

MD5
cbccded419ec9f3f25eba050724e209f

SHA1
b0c5b8f3b8e0d6ebd0b5ce2b9d48207d85c251e5

SHA256
84921656d654b9517a44c8763b3724b2397863098473f6acceebc8d5b685a76b

SHA512
8d2dec0fd1f57e393812047852cc61c0de96639bea420ad5cd16953a0113c42c731f88f197376285ad26f16be62e5c1b48d8a841dc77bbc8db6e98d99b7458ff

Download Submit
C:\ProgramData\chocolatey\config\chocolatey.config.backup

Filesize
809B

MD5
8b6737800745d3b99886d013b3392ac3

SHA1
bb94da3f294922d9e8d31879f2d145586a182e19

SHA256
86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

SHA512
654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

Download Submit
C:\ProgramData\chocolatey\helpers\chocolateyInstaller.psm1

Filesize
16KB

MD5
c23bf768ded97cfdca68266838da57ac

SHA1
42452a5fd424ee2a57e3f128677243027050e6b3

SHA256
f877b0301ee2553d7abdd4aa8484812b98f68a2ad35963fb7d667568f29ca5ab

SHA512
0a2f41b0ebe685a07b4486739701b1614cb2def284becfb7a957535be825da8e509d0c92817d624494406c936efe4593d97e7afa29395656107f2a56518141e8

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Format-FileSize.ps1

Filesize
14KB

MD5
cfed95528c3908c1c9e0af21d699534d

SHA1
6a77c5c095946300fb5076b0e6fda5dc024c26c2

SHA256
2234bf5ba5138404d9e56be44a7bd61c48b6d68b10ccd1d4384eba1cd758df18

SHA512
76547f51600aee8caa94634f65d034f06e7cba7da7520633e21653e8c83b55e414cab1ba96be6ed1e6bf6ac413859d9e889e00bee09c1138e6b6f7a52462af16

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-CheckSumValid.ps1

Filesize
24KB

MD5
fe79cb90855649a84b6763e974fbe3bf

SHA1
6b4b8e16e8196538d171c48a010969f4341b4ef1

SHA256
a5d4312c015385e87df4bf13f4a191da61e94fcdad896c0a5bc3b7d54f0e4327

SHA512
e2b039d5c6512448b358a8a7281f13737b210761ec54eedee463fcd6edc760c50e11a723685ee8cf493ce771fffaffc32f66cf803990bd199a429969fb3cd1d6

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyConfigValue.ps1

Filesize
14KB

MD5
467d283f50455e05c6a64c73b3507be6

SHA1
aad8a58ed077c48fcf15f76e1579501dd24c12f6

SHA256
58ab680942bef99b23ab662ed03f0369dbaf1f86e307f3cddd6698e1872b69e3

SHA512
9a1760ce9626c3911d30d011f2f4014ea8a74158a054c81d6deee79ddb08d3ae104fa39db51b673dec6a124b9320062065b8a165fa46a6749704939b0e165229

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyPath.ps1

Filesize
15KB

MD5
709d430efbfbfa682479998603080451

SHA1
cdc524f5544add18857ae44a1f35b5bb768d6f65

SHA256
6051d245726c48d67c7d9c679d384eccdfe3446c867013beb3df77c044d4727a

SHA512
f201a42de7d0f7e923209367e6e0b13a5afdf4bfa3cc61e859436357a7a83e706b12d0b3f01810747d88c6c40c621e4ebabc39f195bd81a41ffe533205f53885

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyUnzip.ps1

Filesize
23KB

MD5
cf3dd652d1eefc7c2e62e18bd9829f4c

SHA1
6bf82483f94bfd4d33a00b882b204cb3342924a7

SHA256
68334b1fb4d6c061c7290eb9dcae736b7b31427ffa364a9a55761c58d2942a1e

SHA512
85c08f8eab653377f4f249748f83c07b6a33f1c1a26700c5ff8d1542d5972715e4b4ddf0d0e7d60b93422dbfd8d1f1f0b77c8b34559b0738e99d2cdf54e466fb

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-ChocolateyWebFile.ps1

Filesize
29KB

MD5
0cc1fcd470b5286467b9e00eb9f56ee0

SHA1
dc303d4be2bdbc54578676362c50900724132dfb

SHA256
6530a016ae804f69b3d28b9c916634008c096680178f3c5f8bb0492a39997d71

SHA512
5f200abd29ad934da309f2242c1091a120919c1a6164dd4dae569242035ba19bfe9df3e7dce1b084344a2b61ced1a2d80cf567c6723696904655b77c21b458fa

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-EnvironmentVariable.ps1

Filesize
16KB

MD5
2d1b1af3bde19a127e387089a701f8c8

SHA1
fc1e1551c4ab005dc5f762ea07428231a5a3bcad

SHA256
b4eec4e7aa77481830f2a19d6f5d6e1f95bef28b645e6144949ed52edf92e812

SHA512
fd4817596c51a7936853433cc975353110f476d8356706dc45986ff4245077254584d17211947204cabe6762bcb5f2793c61e4aa330c0f1467663948f7847610

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-EnvironmentVariableNames.ps1

Filesize
14KB

MD5
34202f268d9a8cdf2581fe4090e4e199

SHA1
dcbce47fca8b8da9ea9ff81fc303a907257eaa75

SHA256
05dd8207338edfbcc11219bdeb5fa9dffd07818da45d0a553a3cebaf00b1b5ac

SHA512
9d3ffbc9b05268a5129e3708a27efeb69cc1fcec66ce6d0f2b4f22dc832101c0084033a20abba2d3aeed701af8acd575e12f04e991bcf0bfc46d94e85dd84136

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-FtpFile.ps1

Filesize
21KB

MD5
6cb643511ff3b637cf8182f17b6a58c9

SHA1
c2d00e2ca2a356e49bda17a9c48e2ceab1a59d32

SHA256
d91228c4ea016d3c6ad4ca47bf37967185d633802fa078f961e2879e59c4b991

SHA512
c96ce38dd0a39342b23ffc8270acff1df00258aaf8b3e06f9e2e51162a2510f3654fc8c98f578a0009ee41167293e67f5e8869ca628d99fa8789fa2e2a45b1c0

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-OSArchitectureWidth.ps1

Filesize
15KB

MD5
eb7691855e80e96bddc78c20c79a30d4

SHA1
8b23335f244a1be347ccbee823be79d453775d8b

SHA256
4fc0b54dead70628dfe4a435cc6c0028dd9f041084bb0cdf4dd8dd02c9f6f19b

SHA512
65441300729b8e9be84d68777070cc89853cbdcc5c7b3a359ba6c7c7187133c9ff086442438797fe455d70f143f6e07789ba95c717a2d57e497f60300a6adeaa

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-PackageParameters.ps1

Filesize
19KB

MD5
ce76900c3e42ba08219a0ca543bf9de7

SHA1
e903409f4d814254179b8cfbff0c702d615ff183

SHA256
6ab8f3514f4d8d8af265a62e3ebbf8f0cdb738d580d192e8df0adf5ff1c43b7c

SHA512
f6041933545f8a7ce82cc35057db353bfc28abbc4fbdaedeae3aac3963d91f33d52743d877f89a8596137ee770f5dd063e9b8f4659e4ca49ec14a8e173975676

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-ToolsLocation.ps1

Filesize
15KB

MD5
6cd569f341acfbb21c1206e28845550f

SHA1
ac27794a429bf573a2fbb5e3bdb85b40bf46aba3

SHA256
5f117c564ea363b0cbf8d8225193355a189c7e7f35c7d46ab8210ec67bdec480

SHA512
a8db4d3d36aae700305625bb86c0d86e41ff7d8ec5d76142c2ee74cb5b1877ab0e946b449ca5ab083df7da6573d145f39b40fca21f8e528d681d2e45cefea581

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-UACEnabled.ps1

Filesize
14KB

MD5
522f2cdbceccbba3f723619d5a616ee2

SHA1
303946dbd912076351f2051ab63c7d39f3c87a23

SHA256
c4c02d8145781d891e9ad9ca4bb36067cd5d0133e1dd25f55c0c175b60cd5797

SHA512
de7a368680230c24292858f687a291a95addb772409c4200a7ddd3c26de05adfd53f6a91aa11735dc603c7399d5dbb22bd1e6b13972c686f03f2cce8ec47e8b1

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-UninstallRegistryKey.ps1

Filesize
18KB

MD5
3e49f60a27a2d3ae746b4563ee525831

SHA1
6eaad2b3fe3a5f003cb2d606e84fa258f26296a9

SHA256
ded65f2df2d3a0064d11b97d18d42eca3bbf0b20590c6c6c5084ffaae56f3aa9

SHA512
45951b489875277c4d40b415c8daec61d3bd42ab670c277025ec2ef35d7247c963a8ff24aafa819860abff335ea42e0e18dc1b4615b2c5d06967a86bf18dda5e

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-VirusCheckValid.ps1

Filesize
14KB

MD5
362cf6f94c4191d63ee4aa20aea79f96

SHA1
586fe9c82fd2a2ba8574e4e6bf93ef8aaefe8ca2

SHA256
e387e0608c2ca1275de8a13ac074d8931f546c712a29f7215f60635fea5cc0c1

SHA512
676efbc4f9659fdadec814acfb41f2dabed5c4c85e035c9223f286cae2791a42703fac28eade534fd1b20d9a9ee1e6aa21f748705aafa8c2241569ade86e3040

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-WebFile.ps1

Filesize
26KB

MD5
0a17a529bd98cd11761f34b7714a2c8e

SHA1
f7bacc30819d6390f1d8c86e6f7aa65c3400c705

SHA256
950c6d6fe3242f55af189de52a12ada08cb1f3e2705f0985505eaf9cc01f4f59

SHA512
b71a8c5feefa96131fa7998d721aa23f9833a05a801269c2c435d8a66c82a07ce18def89ef2d38156e24b1c0ec42cd21e86bb178947df5e24ec48e48d435e537

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-WebFileName.ps1

Filesize
22KB

MD5
b8e964e1b59eeb8992513a1ac81264c3

SHA1
f378092e1c67809686f05c9cb7fa5de81b59de5d

SHA256
c3bd4e9b0ddf4f1cc43df0b019013cf186651576f5e37944d1082d831e5ffb81

SHA512
e7a260f7399f7b6073d3eb3fe5fe854c10038a62eb910b9ec6031810305e8d0c085789f0a1e228cbb4e91b2e761c3b41df131a59fbe81fc530bf6573f9d40f69

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Get-WebHeaders.ps1

Filesize
18KB

MD5
c593afae299be77bce5b752fe21767d9

SHA1
a33023ef8bab93f6712d5a8940a2fe89984c3a08

SHA256
96ecd0025b0b33401588345eb25ed9a58304d3e384696290ec2500573f2c56d4

SHA512
28155d0b6d0480fea873417b2fbe9a28379923eb939e2c98924c4d5f085f27e8cc40f8ec43a7d85ba9271d93842bf2d9df8e5a45b761cc53c7bedd1a00358663

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-BinFile.ps1

Filesize
19KB

MD5
e3a9bf29e0874795569bdd3c3a3a80fd

SHA1
d24d82321d25d587e5a1672f6140128ac8af44be

SHA256
c4ac48ff64f3f58ba03ffbe1481776c0290d4fe6cb0f5980e3015f774f306563

SHA512
4d58c47e12c575950dc0094b88da1967ea87fa85871077122358d1cf46ef603fc78ef6fe0e917f47ad65d5185a30c5b16f6cb0a0201309c7e7dc629ed20cc4a0

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1

Filesize
17KB

MD5
df7a1fc007a10e85a437512ef06a34fa

SHA1
0fa5d98829212d727bb378142372da761b728a7b

SHA256
da03724a6a5a261899dd6b25aceb9b2cf6aff2be4fe191b002b2cfa06c8ed0ea

SHA512
cb21eef3a8d969878457cadac35e8039aae5b7caee94f1919bb157209dc228f85f02059f99f568ef160be437ab2edf924ecffdb911e2cdee6adee66b6248c4f6

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1

Filesize
17KB

MD5
3542c045ce19c50a252344d1fb1f7f16

SHA1
01f6513904c131226f0473d7c45c44d8e2a98836

SHA256
dd30696adeb8c7b25de87055cbcbda8de9c7d8d0a31e09d5bc614b6c9352dc87

SHA512
b454432026f40100525fbd79377537521e8d0582ba350a5fbb4c2805b3a935d8a5112133c8695bba0cf0f9fd1a8ea4422c75d92b98200508e043725e0549b7fa

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyFileAssociation.ps1

Filesize
15KB

MD5
3a9c823dc275e58cdfcd475dae49b375

SHA1
adc32e07886b7493012255d91ff7642f2cb00351

SHA256
14f1eea364bb859cbb9c994b106ea70823f10a3b36829e653138d801d0838b8f

SHA512
7c90d86d0dadcb07e98fe3def740ab7814159309de80c35b54dcaed72c8b9a8adaaee12a11f1fab6619c967701d7a7f633e6bdf07437f70c382e485bd704aa1a

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyInstallPackage.ps1

Filesize
27KB

MD5
a67b77b7b35a2d287e1668da4f207a78

SHA1
aa6513eb51118a1a7b9cabe9610660d665da0232

SHA256
6ba23bf8adc2fd99e9f03120981c6f9f405ad3a63dd491bfe4818ab912049c38

SHA512
15f8a7f6215d60e0aa91fede18c3a9e7969bd8b006328786efd16ebb0039aa5c6aa35b42789daab68e61a605ecab16bc979051a4ed403c6e44d4989f28509483

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPackage.ps1

Filesize
29KB

MD5
e51ddd7c4fa1c6e46032310d6339ef17

SHA1
683fc2aa8f236e12d1ea165dd7d9e606b84bcc4f

SHA256
0c4aea175566d8f80e84ae296f57f53b7dcb37d0856c5878c28ca5001a21a961

SHA512
83d2ba7abb6b835738d4cfecd9b90d04b33347eaa550353688c7046ec86850484337da0d18cfae20c12592b866c16c2747752bf9d00489d916a681efa5f04086

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPath.ps1

Filesize
17KB

MD5
7b7ea15a6f20bb1d5b3a9f48102686b8

SHA1
a04e2ee23805fcde04aa86cf255c5deae21be06c

SHA256
5ec041f0262af5c9792f9e8be00a82dc77f6850159feaf903c5bcb93518b7850

SHA512
6b6dadb0bfcbc47189af989a86624a6409ff942fbcde9f098efb51747025826c4b4023e8d601b261d27f6f5411409399bb6767b46be92f21c9f84cd7a9fda6d7

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1

Filesize
15KB

MD5
072a47c1da6d363793535b963113044b

SHA1
7a545eade8bfcade33c60cddb61f1cad14cfe803

SHA256
4d84d234c803dd49cba47c0aae825997fdb6096695ec4c033079b025f106be74

SHA512
326bda8df0841c2d9e052dff0a3f0bf8af6b8eb57596d844e7ccd48c31cc842f1983ad64d7705e204ced14988eeff97df72ed78d042d08937ef07ee18c99153e

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyPowershellCommand.ps1

Filesize
21KB

MD5
3da0470e153fee3c90bf00d5ca634f35

SHA1
061093b5c39b4a2a24de6a2a58f073e132ca8a64

SHA256
67b4cb61c88c3bdeb91ab525dbf2f62c6e0c4a6ee32e75bb81e5e55a62292af7

SHA512
8dc64cce104f5652856a08a9253c1290cf9f67f70ba8e84a0c806806f50c98eecbefb66227379748186c5c49440ebe54e0cb3f622f02b89f760d9b0f852d2afa

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyShortcut.ps1

Filesize
20KB

MD5
fd89ca63a7e373b574b7713b3c35dfb9

SHA1
649bfe8e85c291e9768da3ad2bccdf726e3ccb59

SHA256
89d9ea528a53e4ce4807aab5b95fb841457b5b8de4a5297b57a96853c7947259

SHA512
4adccdb5ccb7296a586b1a7a9504e53111b9b7efe05dbf1e38431367584115c8d31d8b3d3c02531755a4290ac6b5e798580d09c61b22acc5dabdf624cc00be71

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyVsixPackage.ps1

Filesize
21KB

MD5
3004b9102c2afd8b7ab79fcc2cdc0448

SHA1
8a4e8969c441ebb23b16412d0d1bf38b8b7c1ee6

SHA256
b7691266bfed88461b4d52def459ba5a3f0b450b091c94c67e4c8904915d2ff4

SHA512
75b5e74d8762f1eeb0d350624d148d2346d2ec952efb5854b1f66c6d473776c54ad32a5232d460f62d3a5555ba6fb5d2aeab6b98e068b9872d204a65794c8b65

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-ChocolateyZipPackage.ps1

Filesize
22KB

MD5
e7e761356b067d147114466efef9f844

SHA1
983ff75821297a14c86cd1b6048811df68082974

SHA256
6105da40b3cdd0db2f05aaf1d14a743f49830ea02364cf796f0f3935c45614e0

SHA512
10749cef3401cd639c582ece2f54bcd6e4be3fa31200b297ff61768ba68e2d1cb644de56b7e18bae5a58d046c052a630340a3ca5de30d03585c079061d5084b8

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Install-Vsix.ps1

Filesize
14KB

MD5
6b27cd71b512a1c2b4c1aa44f0901286

SHA1
f87e19b4b6155d07f9cba9efc2a30b8e7772f507

SHA256
307e5ff2c6a5fb2f9caee6eb96cb3cb37f54c89a2e27db25225fe6fbed80a9b7

SHA512
b5a2ed79d4a75239b76eaaf85b6e65fa2d0ca3a1324e9bc903e43da7978a622c418a4a605fdeaa13d4aea6e094634fbc8d6916bbcd837fb69fccc0b2b9922643

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Set-EnvironmentVariable.ps1

Filesize
17KB

MD5
4bdb468bef10f29db2dcd47667bdd08e

SHA1
7244617c8e47446308cab8ebf4ae4b097c976ecb

SHA256
4d251903327c2741dbf7517fcd76f18d09f6f613d771322027e54e274165d03e

SHA512
28ce4391e62bcf2a2c835d030c30f34b255a5bc043eb37343aedce974046a3dad5a5debf11bad94d17c51a217ac0931e7bea99a3bbe04df31a0ed366b5e0bbea

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Set-PowerShellExitCode.ps1

Filesize
14KB

MD5
1df61e06f7bdb790069534c2eeb65a30

SHA1
4ccb201f6899699d9b3dd4788740d61a3208d39f

SHA256
de966de4117a30b3065355ae72921fd11ff2e64b37778a985f439527a378cf08

SHA512
e28b54d102e0449f0063f30f44ebdad01037a1778c5bd315175fe12a151402077ebdbef473dba85a3246597d92a4c11425903fbe662eebc4a335c3c2b3622c5d

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1

Filesize
29KB

MD5
66eb324ed1b728a059f97ceb5047b1c6

SHA1
645fa8b5dd6c822c5ecdda1d6fb6417c8f1c8f0c

SHA256
816777b307ddfb371be419920bdb04000b83bebd69dcf32a637ec5fbd86762e2

SHA512
a4558b8c6d2a6f8c111fd42162bbb858bedddd66eb36a5d76cd2e1ef3240ccd30adefd308a26c4bc8d83462839b64689d191c0c9b3bd073ec7a5c7aea4d1d8e9

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Test-ProcessAdminRights.ps1

Filesize
14KB

MD5
f07f19dd150a5693e6b311e92e56da43

SHA1
a82864e487bf8dceb5fb1c2092f9fd83f827d46e

SHA256
53a7064ae6094b2e42c010264b32ec68b7f357fc0a6ad608d8e7fba280f60be4

SHA512
c1ff84459cf0a3b80d9da77a5625c12f50bc50bff278786e12e97c18a2518bc44356dad2fe9ba33485f7aa263217dd9fce07114087bd8e71f077b814d15edfb0

Download Submit
C:\ProgramData\chocolatey\helpers\functions\UnInstall-ChocolateyZipPackage.ps1

Filesize
15KB

MD5
81a4764aeffa94301233b2bb64a2a0b4

SHA1
b82cc5deb47f401a068c7585d2be51f0539f09fe

SHA256
a4c2f94e1e97142a289dbc3ad12a95c690944cd91b62031549d24ec4f53a84ed

SHA512
a4742ff9cd66a2e251ce21320e1de01895f7bb8e735498081e735e4f5bc76aa06c91e4e1b019400315260f1ec257adc34c3e79175495cea8afebfa01d95f1bd3

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Uninstall-BinFile.ps1

Filesize
16KB

MD5
c98e589b79d4d7dfe2e0819e8c1e9561

SHA1
b07b2ff21b49b13eb4c9a5e6f1c30b0db7ee623d

SHA256
dd365d4461670b3f741feee8adbe56caf578d2360858de40660cc660e903b9b6

SHA512
1173f64932a771f573f134bea31b6c0b5d2879832cc591e37d7a579741151a820c7d758869c899e1f30ce58e72e1cc3b5d9cf2149baafb64c095bbb693eb15f9

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1

Filesize
15KB

MD5
745c9f7ad93b2d0288a62fc2b3dee278

SHA1
28541f124f1d0cc65d73f052e067ea2219121b7b

SHA256
caf065552293384cce7b165d1bd942de4a5c90cc4678a93e4e1398f1f7f19322

SHA512
0ae1a96d12552071e5aad9f42d5ca97f41255fe939fc3511e8a53da1bd83135de6afce7455a7ea695284004eadf3ef9877fabe1ce5a2e89d7fd62189129e398f

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Uninstall-ChocolateyPackage.ps1

Filesize
18KB

MD5
34d8a1d68cb713a9c9d3a4583bbe2b1a

SHA1
4fbc437f25fb2412f83b2a5ec9c5eb27616e95d6

SHA256
dd1d72b593bb4fa6e9b1787388f7db3411de1fe00948e1a9cf595ea04cf31e8a

SHA512
af7eb5db77839416884e3dd4ba1c4ba35e56d66399b38eff8deabbfd3f4b2f9802b0f710eaab960eec130f8d2c77012dafeda667b674e92f56ab56e01cd1bf79

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Update-SessionEnvironment.ps1

Filesize
16KB

MD5
8812efa1be20f24f2dfb320f7cf1fc80

SHA1
3d117098203e4dc14c2e1eeed101c92f5ab25ee8

SHA256
a0489aca98ca1f31481ee80504f7c277809d06f7513b2931ad15ef59657f6792

SHA512
1a3c47e943e449660f21b9b8553165682613a229c678a464b63315beb86a7e1d4835c3bc7b29ab3a79723937a4c1097db4c3c5ea278b038f25856e30ca265690

Download Submit
C:\ProgramData\chocolatey\helpers\functions\Write-FunctionCallLogMessage.ps1

Filesize
14KB

MD5
74e58419c577cc28b5c143cf44b3b411

SHA1
e499e9d0db8826db46967ebdd0e790c19065a480

SHA256
b35754fdae31826160c3e9883dd18ebf1c9efbeddda61ed731e1a4b7ed388c92

SHA512
73b2d993284c58171b20a469a1e47cff1329f9bd51507cea42122815b77aa94498a1127d804db7b43dab63f71cb5abe47efdad76df5b78afd8e33fb3eeaba038

Download Submit
C:\ProgramData\chocolatey\logs\choco.summary.log

Filesize
147B

MD5
4f3e04fd76cfa60423e3d374b18fee5f

SHA1
c833d70d72ab0c29b3d2a5bb623db7eb3bea28d3

SHA256
ac2a7384fc6d6fb4d92a86de2a672713993f52fab6f76d76625a4b4b7b769e01

SHA512
43617d79b2d116bcca0b655a8b6a48cf1c6daf00f69ff64722f07f1673babdc9a7e32a9147c0640a9e06f7d1eaf2560e142ccea586b7340455e5f84c9234676a

Download Submit
C:\ProgramData\chocolatey\logs\chocolatey.log

Filesize
2KB

MD5
ef32fc5366e1233b7e5e6b9c2ba11e81

SHA1
0f51136f05c70def9f9d68a3a5349e31d46be0a8

SHA256
45b6d0a00ca65603f7cb7950638c428406381e7709bb0d7cae7b949f7e0b1937

SHA512
e60020e60658e9f2ba19df214fa5510da2ea7f2a8f66973f1eb8a7691f923372cb8ae0888fa57f4705ac8bafebbf4124855022faa9ded2be5925701667c752bd

Download Submit
C:\ProgramData\chocolatey\logs\chocolatey.log

Filesize
4KB

MD5
98c0cdde44c8443f33e5f26bb13c6ef2

SHA1
9145d862e6326faed0e2444976a2c041f1cae696

SHA256
2209ce6c992d5069bc88eb22357009131c655671e2403414cc848790f58cf1f3

SHA512
75c484edb5a5ad59388ddc1083756ddc7cf593d776ab4fdc6cd7323213359c515ff01cecfd3611f01d7390f49ebe9547f8daaf9fc457c749718a3e6e8fc1e98b

Download Submit
C:\ProgramData\chocolatey\logs\chocolatey.log

Filesize
5KB

MD5
178bef0c69fe0df5a43dcaa872593408

SHA1
cb9f61c37052578608292a4eff81e2e07b5d32ee

SHA256
78d40e63b04de0bc7f4240dbf9b7b9304094abaee07c424b937b5a886185431a

SHA512
ce173b99e5619cd02785f5b96579e562e2af621872ce9446be8dfe418818cdb0cdcaa6321ffd372da145253df612a5008f87ac87de6baecce2efdf80b191c208

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
e3d1310dd0b4cc57f0d511bcd66902fa

SHA1
54e17a1d5f37e2834bc51a52551c2f1c1cb8abf2

SHA256
d5a7831d91ea82428291988fd3bd9f5432e20babb80ea373e0e647bb102b5a75

SHA512
4a3e607b9107dd00582cbf06899769c8320a99092f154f2368293c7a6a1eba1285e75a2593ec610b3813e67c0f28de6b66de548944a659b0aff54c383e07ba94

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
222e42df1c5212b0b876ca3abe3c5fdd

SHA1
e6a0427b8766a47d7a70fb4b4d12613affb2a0b9

SHA256
516a69d6c23f68467d158f21223b9fabc04eb1d71d4afebd20758c2fb57dd264

SHA512
fbc17c4065d9a50994783ceec7de8d6f8d555584d9254327546a420d0354c6e8b2eac6703430258531f5c9d196ca155fd2640a9f8aa55a7ec32f1ed12e50e900

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
69KB

MD5
86862d3b5609f6ca70783528d7962690

SHA1
886d4b35290775ceadf576b3bb5654f3a481baf3

SHA256
19e1a1ad6c54fc29a402c10c551fa6e70022cefca6162a10640ee7d9b85783ed

SHA512
f0746c23a06effd14e1e31b0ea7d12156ff92b1f80445aa46e1a4c65cf5df4bc94f6dabe7aead01f1bd6a6c7b851b577a11697a186426a2c8dca897c48515ef0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
324KB

MD5
6df2de2f45c9043c16e156312cff0361

SHA1
6dee95517274a1d6624775a60a772e8aa6856c80

SHA256
c7b76d25279722f2047c21f61144b0147295597982243bdedd98ab5d28e20755

SHA512
a67e65714be944b1d312a5cfd9baf68ecfb1815d60088bd19e63f7651b0d188816e0eacbf5b9ed215e98495f20764a08a9c797d643fb9d0defed78afb08de15a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
138KB

MD5
9a57d607700bd24e15a12a11721f4cae

SHA1
9cf575d85d749b7248578c435d801b9bbad1b2d7

SHA256
7cad07532c5a2089d65cd04b56a6732741f2f0b86614e41644a4705974160c10

SHA512
5ad552e80742b2d2480cd5e40f4cad630de1fa9738f60581a5584cc9d87968e294fdcfab23afa32b10f7884de30addf2486375cce59b825a8fa1188105b035d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
250KB

MD5
2cdca8be696b2273bc006b27fe155581

SHA1
6f9b844a531f32c20f8685c13b5d6111a2331110

SHA256
e8a5cc55d4c9af5996457af3606eba0c5f07955c622b4a4d33e695928e540250

SHA512
4e7f24a3e7144849c94a3dca79ef393fb5bdaa61a32890a57d32755a4ad46bc1c7baa1f81ba7bfd14b51f58447b6a531e089a52cd0e2d797779cfb5f2b7b0a89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
163KB

MD5
5e5ef561da4ffd65acab4b328d2fc3b8

SHA1
a70267c47eebcb0af07b6685b1091d4d8133a083

SHA256
4e559db264e637334e6bb7606c099ee0b48510ce1c1672ac6b403eeb3d9b3051

SHA512
69b42579ab937003e123e0ea0ef43206dd3c771c74844bd22d2c9f4e21c8f2263eab0f931dc715841de71a93f34a59db943ae67c100f7e3bf3427e020407a5ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
215KB

MD5
efdac0e72f3816a7aca52d8a9beedfd8

SHA1
d34695fe7c88be9c59d8b0785556d6a3f7118780

SHA256
0ce65da8b63ca556271f96dec33eed479160e25dae924d4e9937a715495d2a1f

SHA512
05086469650a964b2e582dd15cdc44f6a8c1a315444a93d4e7ad039188f8b457bde0d9d64ebe13ebc201146cab7a5fe31ebfb1ded976a6abc89e384dc86f28c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
41KB

MD5
9d5ae9c8e2da65cb3c21e6c65f4ad210

SHA1
7c939a2150f42ad1e42e402ffb089cfa4f22042a

SHA256
803dc7645adb4e2986475a370364aebfa1c9ded9d0e57735040a70a52544e31a

SHA512
f614ce2d1649fef25bd48ed2970d43a101131a0ff0cb8d7e33742ed9710a4b00256fb41885d993010f9179aa82c11592158ef34f339f5ebb1088d519df0d6edc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
200KB

MD5
a484f2f3418f65b8214cbcd3e4a31057

SHA1
5c002c51b67db40f88b6895a5d5caa67608a65ce

SHA256
79cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6

SHA512
0be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b

Filesize
189KB

MD5
1aba5b2f9bd632a8ff221b261dbc1e61

SHA1
1c0a079446ae1b8cb5910a21de4fdaf9fbc7262b

SHA256
b7669a4e421bce3d8bf20e9686282ee24f74f81a8e96116683ce73191afd64b6

SHA512
d309749ec6b88687ef5db7588e278a2f746f4b06c94ed7a1a28b1cb97e9201500cb5a10cf44ea97bd03e987f12f8affe9b0eb1add3ae140b07499a3e87215810

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067

Filesize
46KB

MD5
fc61620b49e35cb359b1f0cf208f6a87

SHA1
54d6ad78961f356ae02cf52144e2baed96f97485

SHA256
65cf192b867dddedcb10ee782d29d0989c00395fc6ff6a0923e23756ab8e0eba

SHA512
17ae00dcb2a9293e33007c623ebb462ba4961e345255733b03b1dcd4bbecf34db280e77b57813e5b5c42467ec0a7c7af1b40fb038650fe526be380f4624dea17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000068

Filesize
17KB

MD5
aaa46a808d6f22dcd1424b64d8a9d811

SHA1
8fc0a6876897a96a58aabdf413de84d163a79049

SHA256
4aceaabe03f61949a6840f7255cedba05572fc58b6d54d06b438ff1126ab7796

SHA512
f67e3638a68860923f47b1d83a5b978217ef942ab6f94ef04cc4fb891e2ad7cbd51c0292ce15a952b9378608a19e7072a67c1c8eb14e7de6f987850bfc425af3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006c

Filesize
32KB

MD5
fe8d1927850115e93c0fff338d26e33b

SHA1
fb05c4baabff24a080803100504fc6be93c17097

SHA256
a4626c2caff7fb896eda12142bbf07fd0d6ee79db365e994a9bec1935ea29d89

SHA512
a187213f00c7a15231d0b9899611c0cdd6688a6d49812005e2a166017bbb105ef4494bd4783d98c8de2f0495ba3eaaa3c39daad2231027b74a6460d296c16c8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000075

Filesize
64KB

MD5
9ab10d71ba9d5687f36807e669b870d1

SHA1
e156f2cfdda7b5dcca0db32860759e954626e6f1

SHA256
7cdc09376d5fad31e928ac542ed83ed3ddfc5507180e94417b0cf4116b1c15e4

SHA512
c70c189dd7e515c2317a276319668073b8f73151bf7a1e0b6623ce888f590cebc7b7a69fd0b39cf7fb5206166202b6cf9b1baeec9c59ed9b3f926c7d7e13935e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
f8c85b46373ee5022b15d23c916f9249

SHA1
0ccff2f9677ee4937061733eff24285bed85a660

SHA256
614be80355501659182e5c734f9967549f26b1283e14f34c59618ac1eb7729b4

SHA512
c4b4cf14de55136813016b7439e2b0b2b4d3a000d966d51694518fc3f09a44b5ef329204a2caae7e4568594596615070e89b16d9ea61eed9585aa658c691ed99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
410eb7ed6a7f92248e5a82fa59497f67

SHA1
c18253cb20b278612d9cfa74da416bc83287f72f

SHA256
754b4e7ae9375d44533f5a1dcbd0754f959a3c310eea12ce7eea944c27c672db

SHA512
62e3cd7a7665f3ebfd44b37e2b0ee8dced1c4241896398007cd0edbef3d25a34cc4c4bca106d0df23bd14709261ef28ec83666f2e995e39349747b8f9b2b6b77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
68e395ca1b688dd45e6afbf871143d8f

SHA1
dc81651995a991bee12c2d9c8e4052853589b3d6

SHA256
3595ee2b72c234cb0e76eb69a79602865cc45a5cd36fb056475f0b27ac05fb56

SHA512
7e4ce83e4d1c21403332c1b26fec58a3a4d5a9b87fc97c95320d5e733c45cea5bb3b55f4213f16990c27e9e50804241f04d8c7236cc6791eb44a9d73d9c40e48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3805684a24e92bb42c672f70bcf2c607

SHA1
a62d39f6e40f1a914d86df108eb705f027b1d561

SHA256
ec5defc73589983fbbacafc614509818b325ddad451e51054620325a159a03ad

SHA512
9f2b8d39800648a55e6cfb76e63a49017af50c5018194806fcd2bc2e446b0a441de0cc32dcb7dda1813e2bae8b1563cbb11ae76d71af3d135657882cdc72d201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
07ce488d1a2485883a8bb61db80f8d5c

SHA1
f01dd1d593544843f60e81c5a228060a61332136

SHA256
dfde962e0ccd726f6b1aa3185cdef6d4faf351d06167fa808f285b5f1c694b6e

SHA512
144fbb27513d48cb2cc81f08fafdb3ea2858c847d8909ca1ab722a8ca51387ced7a39b14ebef4f4f2cbfe6b7ea1a13dd196f93e8b3221b4680e53070bc411a6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
e9f258aefd230ba6ecb2184df3a5a47e

SHA1
b9db75536cb32b126dd3011a8c65acbb74ea4ea4

SHA256
fcc8aa36b356510409d2d3de6a645086aac556831d594a25785a73f38aa4a8a0

SHA512
2baca05abd3dfdaad4d426ef024fbe9ff2296e73c1f066442c8461849226f39f561ef428df89365a3a38b0f557d0cd61e8c77ae3da1b4315ae5343b7a3e2ec7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
48e0cfe12998949b12d8f0ff4f8825b3

SHA1
acea3fa9a992f433e45ff9bcd040a67e8f1f4ba5

SHA256
a7311638080b744ae2a142d0769f54dfd65dd14001412e4edbd9a4351aed55fd

SHA512
23861da5e19ef05792ce25781ee9a398abcc04b63947b1c622591e75b23f27992c4e5372324355fb69ef53f6ef3120e65535d89f4e539f956130dd2275948ae6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
cf740d776e811ff60f60bb1c52023c6a

SHA1
397eae4d95aa19a864fcf086ae7757c46af84c2d

SHA256
4c5c59a3af8cb98b86ad454bea5fae222d0777c2d70baea99a61cbc18864bf66

SHA512
611ec4f7f2608b86a4788e234184a742895786b45395faca4fbf57d0ca2a57555e7de27f088cfa473af49bb1723dd5aba8ce7b88a35535ccdf581b1076625fc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
a5b1c4632f6777021e610b309a7f1757

SHA1
ab7f56abb2888a7c8a775ff376ca87ae30d0103a

SHA256
2a130ce4a5c192dfc97d69c8cb7082651c20638022fa874a9231cc06404d6eb4

SHA512
09003e1e70ad12a037b24921abaea443c625d8aedfb7a83529466730f7367b393afc3a9fb54f14045191b2ba63fafe5538c74993aeab752a962b29b5931fb578

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
520B

MD5
d55d38df115b4bab3a5add2becf13863

SHA1
c1bb69b1909189c282906fb9810feb2d192a24ea

SHA256
ab83fe26630d20296d3238d45141eb4d7feaa0e89574a4a82a800d696a2cd11f

SHA512
c3a4c02f41f084b450ef03ea8ff1e16f8ddf866439593556288867ebaac4a24db9d039da5cb7b8bd204241909c223ff9b73830e14f20d50808b0d346a5b5ee76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
520B

MD5
4c5c5b8fb7be345b44f4dbbb92d21172

SHA1
884454c04f3749415a81545287208b394f84f50c

SHA256
a09c0313c0da9e2028ed89ad02102614b6ef5e6f854a66c832b5d32b6a0ee7cd

SHA512
5d4bbb5686fe567fc329342827cc10c7dd8d3987852fa88ee5536af3e5c2d83e7360700071e4cbfa57920458db0064f4ac056002c82d15b458ffddca90577ca0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
694d14255c37f4a4090fa83ab41e032d

SHA1
864eb9483d2e18a44dba9a7ec5454354fe0d6926

SHA256
d0385010ef2d1d82e86fb98a96d7da69dc7895426cba6d2bf141a415a73edabf

SHA512
d5d34fb4b3d13833df1744fe809b197b9afec1b6ae2ff4552095e9984c60ba9c9e309aafcca83b2d763ad82920d4f7f408646ec6630d6a93977e5570e4f0b6cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
f3fc2e0845729f4728cd1f5aad6b932b

SHA1
3e40a479ce28e7d3652e95c2333cfdfb59f0ea6b

SHA256
04e05f6f97f988f89118a7c24d4a98161ca2a0e55955a28ce5c887d7883775ac

SHA512
ace903d36ed03b625d5b9030486d70b8014a9c58764188ab87a0c86359233299b11fc9632054fecd77326bff228119804f7cbd97ee667c3b361a65e61f864787

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
f0acc7d8590cc17a026b443ab2f30818

SHA1
07b7ca76be553e4f05dbe8be5a1e1e97ed7ace38

SHA256
1c873a6156bb2021c9ea27bc0da21a6e8b2bd9a965a1818645feff031d24ff13

SHA512
dc8a66f07cfbf36c347f7a0369bf3dffac480f1fa4f1458206c9218bf62a876146dbe45215d0ce764cb1d69351e996f5e31d34299ea015017198bf2b50b426d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
accf362352abfa8f6619b5edc6a59ff1

SHA1
9d06d6f03c312a60ff072f75eb0e1ee652521fbf

SHA256
d6b79c95b2d16d8d600510f1b2cb0e30951aa202df9958747fd2fed5fe3bd978

SHA512
b1ccd784b6dd1c498566e581a25e3d236e4aac8b3f5f37137137df3bb2430ebd42c9de140a0c048d5e5dd63c40557fb550d0a38419867624008d4f21799dba18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
870bc2580c987c1defa4792589b4fbf6

SHA1
96eb0be6126fbb2d5a9a286960909d79399e3fc7

SHA256
ba0e53546a77c1d8dc6eac7ac060aeec904525bb9347a0676e8d3ac34a2ba1f7

SHA512
ec80b8302549f988ad41bfe9c680c32581369a916b5965f7c6a67ea1798a93b31daa96be023a6c71f4953d5aa7f4e965c044840b89e54110dfd6097fe38264ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
cfd72a8f27bfe83a7bc96dbf4ab39f9f

SHA1
d12e5ca4ac559052462e15460a6ce325f9a1d818

SHA256
d5a172e89478317b12187dd90fd2beca1da011fe432f67bbed865673ce248750

SHA512
0ed90b8ec2b74e9fabae1837f64d494383de347cd63d3a7e0e9c8f38cc64059c10fc3c9ff2bb29d4c16c0894d7aa8b42dbd1305e8fa562efbbc6e8dac1c02605

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
687B

MD5
4c880315ff6172ca667c101a22b11ea7

SHA1
f38224d1990513fc32c8f04aa072c4c4645b4664

SHA256
d59da8169aa2f56b1f60738ca5769d17016f805cf062e508b55427c33bb29b20

SHA512
f444d413436d0199ca51751bd61e371baca347736b548c41c4dae5b0273f42dcd0b279446bede1896000244d9b6a05e7993fa5cc7696c62f1d9c942693669504

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
72c783c5c1c77624544b299a3e9e5d93

SHA1
1ff5fb209c59447ff8da66b8cd05028abea28967

SHA256
a3ac8bb570ff499341c34cfb8a6c31ac21cb3456c4f356a22b81cb5a0b4d6a02

SHA512
a32b2294dbe81cda8ec4e76b37af156613a64555864536b3c3a61ca1c723fbc6cc8817dac5a348951af531f5c605191355c413ca1df9690e6e07e4ad03605afe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e71c42e4-b81c-4e6d-8dac-38ef7d1b6b6a.tmp

Filesize
520B

MD5
340af8b8cc351264416814821dbafc29

SHA1
be5e451121ee2377c76d3d0de97757c3e104af14

SHA256
a8d92f2dbe079b07aafaa34780d74f814a23f8841eeef5fea9e15f067323ed96

SHA512
65cdfb5d5982bb9449fb46b62c57071dc201a17c0c2a48b9c5f75a46be1e6b72956358fdd2e26ba1e96b975a04225531ee78d158dfe75f6c8c15db027c996c81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9fa92f907efa05edccf0fecbddc5ff2c

SHA1
06beb9fc700a96f9e7c214b3cd8b2d2ce9f4391a

SHA256
77a5a063701ac48b03648f57b814bd6f097236d735f7801b216a0c4f5a6c6675

SHA512
08e838b3c8cacee61b7d46a5bf732181668e9b40310fe0e3cebcca35f550b671d74d6a02694dc1dcd6e12bde6d77aa6856d21737f1b5c5cf455bf5631acc64a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2995c0ca9126153f1edd9c5c100b6fb8

SHA1
9a77214ee75f3118bf6e4e7c8ac5458f4019b93b

SHA256
ec13d749e7edf460a42e40666272962bc7ad6b15d76c1cae92a88d1811f0d998

SHA512
da87779aab51ad4b4859b21967f809ca0b567e5a0e94fac5e96bcc7136d9a38c6e7bbc8531358e6fe762c7878e4a2bb2a9b24621cb96771f01736cba2beda6aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2ab62b0312799803ea7e0161c2f78856

SHA1
fd714513df4f1ff1db7e0d3b81709a7f6992f34e

SHA256
906f3c4166ac413a22a064cea2ba7c556cf9f2b9827026dae557f6ebb9ac2e5a

SHA512
316b6261c83068485c992759dbe663f9f79e344105c5b98949875ed05ed919184c97c939860b6b0e86a17afbc10b520982f804c93ac258fb78f0a50e07e708a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
31c88ac69d225d823ee75bfbc961acc1

SHA1
ae7e349ed02f7bb6a1a000f2e6f8ffcb92b47c85

SHA256
0f5d28e886b772af45e23d29b73812fe4d74ae1da0f8952c16af6107065b5c68

SHA512
d11cd5333a46a8ef342580883bcc07c67709dced50a59eabb0b09aad82ffdd2149adfe057ff070609011ec3576420b0ebf207205161ff9a5976e490951be4b95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7f4c52cab1447fc1748053f8065f0368

SHA1
a3d17b44926959e0c18e9bd84d772b7b33affe03

SHA256
3362c647a6efea60a635305952abaf021acdcac6020e7a4f6b35a3239873af2b

SHA512
7588677c4226135df74ec4f2b412a5a374f2b4d70e87af914046e7e8042dc77393f4466653d05e8d97d1627341d0b464fdf4d172b66acb04cc79313e89da9fd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d5e87df276e988909e0ea0cb9346711e

SHA1
aeef3c64e4ca7e43f43fcbad9ba1ddbdd1233134

SHA256
b9eb9b5ee108b018cf896bf6d1db6f4e6b1b8c237d1bc8508b67b4084173c93a

SHA512
58068a85495b32b78c205a7711dc5a16b9f69103484f11edf979ee84e7a1a74566a29b858663864546f6333748578e50454d2abd5ce4c3301ae4bbc3c3e7b3ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b1ece7e50b64f3fb104c3ac77c4f4312

SHA1
3b7f118a1d0e006c64b277721bb48d4e10df12c0

SHA256
de880914fb28375d7df6b164d5bb01c3d4d7072e87428470f603d124f1d76c3e

SHA512
599e09a74238b90e1950bedf756fe383aeff405388992a34abad37ea1ec8cb43351c090eb5dd65b0acbf006ed737eac9138b71dc6fe2aecab2e6aa17feb3c5b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
034173bd9164817187614d1744205c20

SHA1
a4c8403b6845c55e9b4105799a87bf2879139044

SHA256
67a9fcff2708aa544356d5851694cf4c343b520cef5431fd1b727cc0313c9c4e

SHA512
76a2ef4e92a44b8b8b6cb3a28b12361dde18204a9725b2918ed4dacb72b89f7ce5583ca59c2b30c998861be4e866fc9ffd4ef38d841f4c2de0c47c300b0e6f89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
9668252291aa81a4e667897b58f655c3

SHA1
83af614cceb0e7cc23ad1d869f5777cd3fa2d869

SHA256
52c04e220b8e25224c052f81402146ff8100e82d2c7160af761d658288fd9bd2

SHA512
541346601de5a2796fd17436b3fe7d83bbe8915fa68ed969a58517ecb1912b3208e4e497e9aab45cb8c5547ac7ba6a9075a1b84515d7b145b0e226d2a6b89bf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
f1fb8854d6d27ec4817a567b94da4e60

SHA1
a971ad7dad1395a4016922141944d9ebd1513766

SHA256
446b62f08f1c95ae2eff3ddd3627f93fc8395fa6a627c9430f8de4397cf65f23

SHA512
35188f59c2d53a5eb9fe4d83c7f4f6e00e2235de5046f5599e69c31c628353c6f23ecd9d546bd75c1eab07f09667f4898288b37125c86ca7f9c1d01be86e0022

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59ea76.TMP

Filesize
120B

MD5
fdd0238e92e7b95382df59aaa2a33a8d

SHA1
1d342bd5d8636e59b9fbe8bb2c0592bba9dbe17e

SHA256
1a2d67efbc4478cc30223b3bc7b62f4a5cd8e1736582503355326519e8cbd359

SHA512
eb2b30a5a88324f31542a1e9156a7ca2160f9c3e44c60448f4397aff0af879065a74927c6a896e013e4093d12d5e65f58c8384e506abfbd52b7e04f6dde5d213

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
253KB

MD5
8e5d7c350fd78f7b200864d7491bc8c9

SHA1
2dd6a0767e9051e39ee5eb9791f45295e42b576b

SHA256
bfda876c43dbe87731253861f3d0c5be9e98424c88b783b53ef7f92a9f322d08

SHA512
0914ade47fbc9266f715bf84c4a45c1392e432fc25718bbdea385c84d929492f8811ed07b885f749da87b30ab20ad375eadb786e57d5adfe14e45dec42eb78c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
253KB

MD5
2dae9a50a10e6ec84ac6810630bc2fa9

SHA1
98cd937eb8e6862fcce5ca17de9e2c7f829f8953

SHA256
1a7842101abfe256ee22a20f3f7b7e916f8fe3c8a690411e18b78c4b3b95f812

SHA512
578014d367547f0fa0961868fdf4bc541fd992f07cce90dc3970dbbb2d9cefcff7ec1fce55b897f7f531af3c0b1d9c8edf25e92204ec2e35cfef80b68d8db28e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
93KB

MD5
971167c4e46d10957cd0c987c5de4cd7

SHA1
9280e63a18427b86bcdfc04196a1169a6b9fdceb

SHA256
1066c50e81eabd3d8756106393fc763c9c68c02973b551568af24a6ea581217a

SHA512
7743df72c8a527c25abd7f4b7731bc45868ec607610fb940c38c7ef641a1c613811191020b7560b0ddf610b03b684257167fe3c6d3b48e46ebb5492ebc51f310

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
91KB

MD5
1adfd3ab2250e9c1c5aae0123cea7804

SHA1
2905281cac8bba86e97ec8aa20f4e61ed88d230d

SHA256
de97c4e6dc0576000bc00b0850a18b3e30a421c7a49fec19fdbb0be6c97bfdc1

SHA512
c2ab33a2a88f53c7ddd29f02b30030d2dae5ad2bb8c871ef3c67094ae55f6d7920371e7ce53946ea7097e573ef26cfaeb2d9b8f3e7b1218aebf23892ac269f18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5979ba.TMP

Filesize
89KB

MD5
e4a5fbc576029c71773ba32973706256

SHA1
1c1fdd0de379151d3c11747d241df847ba3c9f83

SHA256
1a44b79ba07ec308d8246319c0d3805740afe37e5effea179a4ec6b0c35922e0

SHA512
8834fca6b7a78a04121373d089d66e028a38af19e79e905b025fd58cd3b4f489f0d000fcc53a12a61c4ac956189063da890bb91507881a33329ad4b13dc42646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\choco.exe.log

Filesize
2KB

MD5
57a8f0a23d4c1fd00f23141197dc7279

SHA1
e2e1da48f487721eb7d16384b9a12970c155ae00

SHA256
ff49c99d1003a4a1fe10810a0252dea199b17c3c5699020e0680e9af591b28a3

SHA512
218d06668a6b51064393cfa51c8c5a689543f532c2457bdc160e373610adfa1c850a55f98cb17a8c34aea5406c09d2d33eba14da113973eff36fc65fc9d62ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Temp\OOSU10.exe

Filesize
1.8MB

MD5
3fe356ff0e52f84abddf53238eec0fe6

SHA1
874864626861a178f02116228e176f2a41620583

SHA256
7335914d30d8ede5431c4ba32f56a79a397a6f38bfd44e90f62324f63afeda65

SHA512
7dd811acc085c9dce88a3465b91c00057c4fc9f750c37fb37fb88f9a17fdbb2e3984b03938c7e7c6ab6fa8e9e39746aa5a542c23274b6724d056ea5c55d742be

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB8EC.tmp

Filesize
1KB

MD5
9098e926fd975600852c3b71edde4bac

SHA1
01739b5580c2693a3953990c66c022d44adb32f3

SHA256
6c723c05031a71018b2416870af775daa2aa9387f9217873e81b8b7efd06352b

SHA512
871a0dae76ad86babb94965b10c5062e6de7584a3f3fb3183fb8c0153776df9ed7c1ef6332d57adbd69ab7a79ad0d06dc0ba17a50bb3cd404830153329f1fa12

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC8DA.tmp

Filesize
1KB

MD5
cf2156c816b6b6777256048d9c9637c0

SHA1
33977e7434b65a981d7146f680b0e098c0666fc7

SHA256
5cbef788d79f8d8846fa47fbba8d680a5c6c5e4ba4551f5dace337867345c3f0

SHA512
1127b697f80e88add0993726f5a53bdfe1e1a42ef86b447bb5500a97913ca291153f6a4a07b56ac1ff03a2ee495f83ed3fe2c5bb23334fa4bd76084aa4bb2b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ab4eujl1.1xa.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip

Filesize
5.0MB

MD5
5a50d7b35241de27298cb4cf8537b065

SHA1
759ca835f52972c971c68db0fd1c53d76993cff9

SHA256
4e1acbdac571719f90b2566566668c448a20074e7c2e3faa37251c62af4efd86

SHA512
9c47ebb55f900211b5c7a42df8700e0dde6d8e3c8a7dbf4f16afc112231f86cbea5b8f73c3aba1f9a0e2f95e38cf6f22fa5e123671d9ad7ba7ca96aa9d77f441

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt

Filesize
50KB

MD5
7677758586925baf4e9d7573bf12f273

SHA1
2f54bd889a52ccaca36df204a663b092ad8ab7b0

SHA256
4387f7836591fd9b384d5a11c22685d5441ed8f56a15dd962c28174f60d1b35b

SHA512
a425d55248b052810ee861fa75eb5c9c139f73aa70dfee406d59b7f1cf86fed5656d24b36db4f10a606be89a073305bc32bec822bf88ed53881323d6718fc001

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt

Filesize
670B

MD5
b4ecfc2ff4822ce40435ada0a02d4ec5

SHA1
8aaf3f290d08011ade263f8a3ab4fe08ecde2b64

SHA256
a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a

SHA512
eafac709be29d5730cb4ecd16e1c9c281f399492c183d05cc5093d3853cda7570e6b9385fbc80a40ff960b5a53dae6ae1f01fc218e60234f7adced6dccbd6a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest

Filesize
2KB

MD5
1b3ed984f60915f976b02be949e212cb

SHA1
30bccfed65aef852a8f8563387eb14b740fd0aa3

SHA256
d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc

SHA512
3ec5b3b09ef73992eabc118b07c457eb2ca43ce733147fd2e14cccde138f220aee8cb3d525c832a20611edb332710b32a2fc151f3075e2020d8fd1606007c000

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1

Filesize
27KB

MD5
c6a2d08fa0c9291b024917995ed9260c

SHA1
fc5c7f1dd3e969a58fa8f0f8bfcb9201cc08c111

SHA256
446c847134e051e02bacad5440f5ea4d5abd93fb77516bc6fbcf69f513bdc93f

SHA512
ebd4a037c326aff60f805ed87287a251a3b74b7dfce5c5b424807c276a677d1099b718f7ec2d17a231d67f03fa1e8dbfe8e5fe278d3bc0724733dc76f0ca0c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1

Filesize
13KB

MD5
0f2a17396042d22183d78e9e442729a2

SHA1
ffd86487d551c72e4c5b3005cb36a9deeaeee6c1

SHA256
c28ac729836dec5384322cbe19a32479126bac5195b6c2760a853340dff440ce

SHA512
4d506d0360b746edfa5ffecf97d47c1d0441e22387ad9336ec12f471aed6047fabb55ba6f2de3179bfad6ded5de308722993b1fd272d352de8fa6a1440dc14ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1

Filesize
16KB

MD5
da6109561e78e82df57f2c69ed40d1a8

SHA1
b481392947e52a028b5a28ee7f491e5c08e49f49

SHA256
e075e523a693669b7b88a5c955e2823a98a88508b3016c5baa01e4afcb6b54cc

SHA512
e5da2666edb1037b38ffac9334b456e590c97de1cb02d487ca218bbb1dd2a41cd5f068337a78b31ec5decc85d70cc046c25314f903fb07fa71cf375d8fa53c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd

Filesize
4KB

MD5
cc04b34e013e08cc6f4e0c66969c5295

SHA1
a33f1cb08b56828e3b742ee13cf789442dd5c12f

SHA256
8b6b1d8f6bfab3dc9fbee30d6b2f3093ea3eccd5c66e57161dbe1b8f703fa74c

SHA512
b485af21fcbb699d783e64e035595be7a117a1d6af62166c6d50ebd59ed8953141444f17f3bd07a865c9dd11aa7c75d5a4f2bdfb8b739a1668d055779f0d0c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe

Filesize
142KB

MD5
e2ec62e46450d5e09e813929d97c00c7

SHA1
e22ef68df395516a8e8e13a9739578d1a48ec843

SHA256
924e37885d4b3b365225c773a6c4266ed7076494e3693ec487bec066ab5bc5f7

SHA512
5cf8ba3bfcba84cddd0f58966707681ac9067952c85412b576b0ce85b53029fd902c17273cbaba1712c99f9036e495943896a7960d8c7a5028d6b48228632743

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll

Filesize
1.2MB

MD5
cd479d111eee1dbd85870e1c7477ad4c

SHA1
01ff945138480705d5934c766906b2c7c1a32b72

SHA256
367f8d1bfcf90ae86c0c33b0c8c9e6ec1c433c353d0663ebb44567607402c83d

SHA512
8b801bfbb933e0dc77090555fa258d416cbe9ed780fb1821aed532a979617082b29e0b6f8fb85f73a9e93c98981426c92c498a41c49f823707da3e6b7bb30128

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll.manifest

Filesize
513B

MD5
8f89387331c12b55eaa26e5188d9e2ff

SHA1
537fdd4f1018ce8d08a3d151ad07b55d96e94dd2

SHA256
6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033

SHA512
04c10ae52f85d3a27d4b05b3d1427ddc2afaccfe94ed228f8f6ae4447fd2465d102f2dd95caf1b617f8c76cb4243716469d1da3dac3292854acd4a63ce0fd239

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe

Filesize
335KB

MD5
76a0b06f3cc4a124682d24e129f5029b

SHA1
404e21ebbaa29cae6a259c0f7cb80b8d03c9e4c0

SHA256
3092f736f9f4fc0ecc00a4d27774f9e09b6f1d6eee8acc1b45667fe1808646a6

SHA512
536fdb61cbcd66323051becf02772f6f47b41a4959a73fa27bf88fe85d17f44694e1f2d51c432382132549d54bd70da6ffe33ad3d041b66771302cc26673aec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt

Filesize
3KB

MD5
f4995e1bc415b0d91044673cd10a0379

SHA1
f2eec05948e9cf7d1b00515a69c6f63bf69e9cca

SHA256
f037e7689f86a12a3f5f836dc73004547c089e4a2017687e5e0b803a19e3888b

SHA512
e7bb1bacab6925978416e3da2acb32543b16b4f0f2289cc896194598ee9ade5c62aa746c51cf6bf4568e77e96c0a1014e4ddb968f18f95178ee8dfb1e5a72b96

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe

Filesize
37KB

MD5
c950a5b4cdc8b23c3b3f5d0358c8664f

SHA1
a4b49539c021ddd4457b353fb92bba68c4c25cdd

SHA256
c960a0082f589a4c1fa7c9cf60faed58cb4dbead4a42ca093e6f0d403d75db79

SHA512
0757fd2e8a31ee70dd0fa4c49a9f47783c1beff359cefcdc523461002571a2df59903f5beda78572fe079ad4af00d1749c6886f50db2db6c8da2971fa0323ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config

Filesize
150B

MD5
e9ad5dd7b32c44f8a241de0e883d7733

SHA1
034c69b120c514ad9ed83c7bad32624560e4b464

SHA256
9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a

SHA512
bf5a6c477dc5dfeb85ca82d2aed72bd72ed990bedcaf477af0e8cad9cdf3cfbebddc19fa69a054a65bc1ae55aaf8819abcd9624a18a03310a20c80c116c99cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt

Filesize
95B

MD5
a10b78183254da1214dd51a5ace74bc0

SHA1
5c9206f667d319e54de8c9743a211d0e202f5311

SHA256
29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62

SHA512
cae9f800da290386de37bb779909561b4ea4cc5042809e85236d029d9125b3a30f6981bc6b3c80b998f727c48eb322a8ad7f3b5fb36ea3f8c8dd717d4e8be55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe

Filesize
554KB

MD5
97f02d9fbe04b14c5b24ec0da1944212

SHA1
a499a66fcc4c5a7ed15a28e5fa655b9ee2c0a453

SHA256
53551b1ffb15cdcf40a77470ad7ff81c0ab7ed5a24acd5ad1be3379612b9de8d

SHA512
06caa91b77d48d992e34c828af71f931445a05e90c18aa16c93be828a4811c2f0b60f6d835b26af9561b06bb9e514874b1c56fb3501b4128de7a1fa64de4db2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt

Filesize
3KB

MD5
89ac7c94d1013f7b3e32215a3db41731

SHA1
1511376e8a74a28d15bb62a75713754e650c8a8d

SHA256
d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4

SHA512
9ba2b0029e84de81ffef19b4b17a6d29ee652049bb3152372f504a06121a944ac1a2b1b57c6b0447979d5de9a931186fef9bd0667d5358d3c9cb29b817533792

Download Submit
C:\Users\Admin\AppData\Local\Temp\lbkvku03\lbkvku03.dll

Filesize
3KB

MD5
ca0ed08c21c71f2218e56fa59924ab9f

SHA1
1447b044c31f9ada60b6979acbc348961f02a70a

SHA256
d258391684e8dc857d72bd65a26a0911cf5d8be2b501e6a7ee55d47198aeb6ef

SHA512
eba4a58640f263329041b36707eb6151211eec0525b3ebfacf2033b5bd1bf6ebf5119b73758dde975d5f6b862f333c9abd6e074a8abfc1aa04529b3138afa177

Download Submit
C:\Users\Admin\AppData\Local\Temp\ooshutup10_recommended.cfg

Filesize
2KB

MD5
75476a70edf8dc03cc1a78b90159a0ce

SHA1
cfe37744678277bd1126cdb44d889eae6ff35634

SHA256
891182ae476b2838f5b0d7a72346fe8e61520f769125bcd19ea0b11b7f5b5c9b

SHA512
7ac530eec237644ad92520831d6ba1d5a33031f66aafda3989f1ef84694ef87b2e5c2e64c0d1d0e1537b889de355c760266f1d5a4a43dd02f3bdff6deffa0f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\ya5tfyv4\ya5tfyv4.dll

Filesize
3KB

MD5
23316e84a1b59bf1f2d9b57b6415eed9

SHA1
185acaa8b6415facbc81e269eaf45d9af060092c

SHA256
14d70d335aea21a9b116daed191f54c19053c3e2590dbfc25658f73b9c51787e

SHA512
6488353e240e78698c1304242904d2c96510144e1fd60b95e72a30dfc9f98e2bf0b119eddee6349eaf1fe738e22387399d6c56f1033457b2788bac58efa1caa2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\lbkvku03\CSCC2DC0DEDBF74DD583AAB219FC544C94.TMP

Filesize
652B

MD5
77f5b51329b92f7a605c2af6e25037f6

SHA1
50b21c9580f5c83ec61459cd1cd7c93dca042250

SHA256
7302f069001c833d0accef9dac644942fad6cfbac39775609e6d8c31fe0646d3

SHA512
ff33e5343317c88999bab25574aabafd39fa8ba521a0689fba589af0f3a5f850dda26cc713cb043104c2d1a1082a7a6b868dfe268aaec4e594d214d6654a37ea

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\lbkvku03\lbkvku03.0.cs

Filesize
363B

MD5
fe0a20ae8ae6560ff6da930c7a650c80

SHA1
b17a90207c3fd39abfcd37a79428961d401c0de6

SHA256
2887d6cced4527e90685dea484f31e882a7352ca66bdb5f5c7dd8924b6885dce

SHA512
d2505e75392877bc4bff0b9b145da35fb2c4fea86c6c6ee3ec7af06fb774abb27dd651242f6797e0e81127619a64662874cc1623262607de65fb332848de4531

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\lbkvku03\lbkvku03.cmdline

Filesize
369B

MD5
47174fd1ba8cf47ef896494397bb2b00

SHA1
932d4661f1a9a7b5cc2b4a34efee823e5da2c792

SHA256
8c3a501fb762bfc569efb0b91122515d8f5cda04a2d6a16a27c3d2871a31a1b1

SHA512
a4a479700a657520f9fa0401a7f8045c198246ade8515c0fe78e916fa2bc5c4acad1e2b2ae912f82c755dbd0c0eb776d851fd374f43d18102863dfb7a38c5a86

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ya5tfyv4\CSC4584C5521EA84400AEA6A9AA8BE148A0.TMP

Filesize
652B

MD5
187ab348406e55576e6a42be66a32b07

SHA1
e70bfcc57bcec937750ef40b7aa39d41504b55b9

SHA256
386a32413acf38de9d2d591e9c4547b450b04a1b66ec4ceef0a16fe148b99bd5

SHA512
65cb1d79b1923604e3caa94c2e6aaa32ee02d327b036cfe752dc2d44589357eb690f3f4b7c6ba2cdf62c01b84de7bed22caefaa5606e27c6355f918a96564216

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ya5tfyv4\ya5tfyv4.0.cs

Filesize
1KB

MD5
c76a2a400f457850fb46460d2fec0692

SHA1
f0c1015871d84d5fcbb0c114931b84c6caa23cc4

SHA256
8e4711cad6f8cd74eae73b06c8250b79b6c3fec51e2af8189f356c30bb08dd27

SHA512
01504f7c37bfa55c456c82ef3970cb3865eade2754efd93c895de230d1ca88f66ac3cb4446823f743a573664c5154d387c0ef55f70b472bcc3d12e8a87d7b106

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ya5tfyv4\ya5tfyv4.cmdline

Filesize
369B

MD5
a374b49726cb344dd95fa0a2491dec33

SHA1
419377e0dc0741a3f4e235046e31f57f9746ba5e

SHA256
097050249633a2e4a2a08cd4ed14c510ccab07d04fe0d22e0f73835cb9cfe6d9

SHA512
4655ac49de9550eb5e6631ac44e3e45c22e308748c20b089f27a7c6ee148de3fa05de140e62fa0a816051d6fb9feb3bba65d93cb28beb1097c57ff82090d5e2b

Download Submit
\??\pipe\crashpad_2668_ATYSIPFQJBJYPWKZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1052-1646-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/1052-1628-0x000002B315940000-0x000002B31595E000-memory.dmp

Filesize
120KB

Download
memory/1052-1577-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/1052-1592-0x000002B315970000-0x000002B3159C0000-memory.dmp

Filesize
320KB

Download
memory/1052-1578-0x000002B3132C0000-0x000002B313D38000-memory.dmp

Filesize
10.5MB

Download
memory/1200-1801-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1794-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1792-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1800-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1798-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1799-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1804-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1803-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1793-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/1200-1802-0x0000023C7CBF0000-0x0000023C7CBF1000-memory.dmp

Filesize
4KB

Download
memory/2100-1770-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/2100-1668-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/2100-1671-0x0000025BF45A0000-0x0000025BF45B0000-memory.dmp

Filesize
64KB

Download
memory/2428-1831-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1838-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1840-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1841-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1842-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1833-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1843-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1839-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/2428-1832-0x0000027C4FEE0000-0x0000027C4FEE1000-memory.dmp

Filesize
4KB

Download
memory/5052-1827-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5052-1820-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5052-1821-0x000001D0E7AC0000-0x000001D0E7AE8000-memory.dmp

Filesize
160KB

Download
memory/5052-1819-0x000001D0CD4D0000-0x000001D0CD6A8000-memory.dmp

Filesize
1.8MB

Download
memory/5052-1824-0x000001D0CF340000-0x000001D0CF358000-memory.dmp

Filesize
96KB

Download
memory/5052-1823-0x000001D0E7AF0000-0x000001D0E7B6E000-memory.dmp

Filesize
504KB

Download
memory/5052-1822-0x000001D0E7AB0000-0x000001D0E7AC0000-memory.dmp

Filesize
64KB

Download
memory/5196-1666-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5196-1665-0x0000000000030000-0x0000000000058000-memory.dmp

Filesize
160KB

Download
memory/5196-1771-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5196-1670-0x000000001ADE0000-0x000000001ADF0000-memory.dmp

Filesize
64KB

Download
memory/5800-1655-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5800-1660-0x000001ED710C0000-0x000001ED710D0000-memory.dmp

Filesize
64KB

Download
memory/5800-1774-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5800-1661-0x000001ED710C0000-0x000001ED710D0000-memory.dmp

Filesize
64KB

Download
memory/5920-1154-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5920-1124-0x000002626F000000-0x000002626F00E000-memory.dmp

Filesize
56KB

Download
memory/5920-1806-0x0000026273310000-0x0000026273334000-memory.dmp

Filesize
144KB

Download
memory/5920-1805-0x0000026273310000-0x000002627333A000-memory.dmp

Filesize
168KB

Download
memory/5920-1787-0x00000262731B0000-0x00000262731B8000-memory.dmp

Filesize
32KB

Download
memory/5920-1789-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-1579-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-1576-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-1328-0x000002626F020000-0x000002626F028000-memory.dmp

Filesize
32KB

Download
memory/5920-1790-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-1129-0x000002626F030000-0x000002626F03A000-memory.dmp

Filesize
40KB

Download
memory/5920-1128-0x000002626F700000-0x000002626F712000-memory.dmp

Filesize
72KB

Download
memory/5920-1125-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-1669-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-1830-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5920-1123-0x000002626F040000-0x000002626F078000-memory.dmp

Filesize
224KB

Download
memory/5920-1122-0x000002626EFF0000-0x000002626EFF8000-memory.dmp

Filesize
32KB

Download
memory/5920-1121-0x000002626FE40000-0x000002626FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/5920-1120-0x000002626F780000-0x000002626FCA8000-memory.dmp

Filesize
5.2MB

Download
memory/5920-1119-0x000002626F080000-0x000002626F242000-memory.dmp

Filesize
1.8MB

Download
memory/5920-1118-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-976-0x000002626EE30000-0x000002626EEA6000-memory.dmp

Filesize
472KB

Download
memory/5920-975-0x000002626ED60000-0x000002626EDA4000-memory.dmp

Filesize
272KB

Download
memory/5920-974-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-973-0x000002626E910000-0x000002626E920000-memory.dmp

Filesize
64KB

Download
memory/5920-972-0x00007FFE7B6C0000-0x00007FFE7C181000-memory.dmp

Filesize
10.8MB

Download
memory/5920-967-0x000002626E830000-0x000002626E852000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads