Analysis

  • geolocation tags

    brbrazilsouth-america
  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    903s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-es
  • resource tags

    arch:x64arch:x86image:win11-20260911-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    22/10/2026, 15:24

General

  • Target
    node-v26.12.1-x64.msi
  • Size 35.2MB
  • Sample261022-stan9sdt6y
  • SHA256 f32a2844504ed8d73449ddb480385f69cb436bc9409a89e2049ae83447078457
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Language
  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://chocolatey.org/install.ps1

Signatures

  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Start PowerShell.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 10 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v26.12.1-x64.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3952
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 9E2352CAACC324DF93E8328B9CB2ED80 C
      2⤵
      • Loads dropped DLL
      PID:1380
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3512
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding E94193C1022051D6A06A0AF3CDDA9AA5
        2⤵
        • Loads dropped DLL
        PID:3400
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 0532128D3E4539D5D1F94AAC410A73E2 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:5112
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding EBCB88AB972B8FE1C5CFF90425429438
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:6036
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 82F56501E8B73B4E2C1001E849D95535 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Program Files\nodejs\install_tools.bat" "
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command Start-Process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -ArgumentList '-NoProfile -InputFormat None -ExecutionPolicy Bypass -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString(''https://chocolatey.org/install.ps1'')); choco upgrade -y python visualstudio2026-workload-vctools; Read-Host ''Type ENTER to exit'' ' -Verb RunAs
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5232
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')); choco upgrade -y python visualstudio2026-workload-vctools; Read-Host 'Type ENTER to exit'
              5⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5524
              • C:\Windows\SysWOW64\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134371564122118585
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5676
              • C:\Windows\SysWOW64\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134371564123368864
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5684
              • C:\Windows\SysWOW64\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134371564124618596
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3216
              • C:\Windows\SysWOW64\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134371564128056029
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2568
              • C:\ProgramData\chocolatey\choco.exe
                "C:\ProgramData\chocolatey\choco.exe" -v
                6⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                PID:5852
              • C:\ProgramData\chocolatey\bin\choco.exe
                "C:\ProgramData\chocolatey\bin\choco.exe" upgrade -y python visualstudio2026-workload-vctools
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1656
                • C:\ProgramData\chocolatey\choco.exe
                  "C:\ProgramData\chocolatey\choco.exe" upgrade -y python visualstudio2026-workload-vctools
                  7⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5904
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2240
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:924
      • C:\Windows\System32\DataExchangeHost.exe
        C:\Windows\System32\DataExchangeHost.exe -Embedding
        1⤵
          PID:3284
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3188
            • C:\Program Files\nodejs\node.exe
              "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
              3⤵
              • Executes dropped EXE
              PID:5948
          • C:\Program Files\nodejs\node.exe
            "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install axios
            2⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:1064
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1636
            • C:\Program Files\nodejs\node.exe
              "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
              3⤵
              • Executes dropped EXE
              PID:2716
          • C:\Program Files\nodejs\node.exe
            "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install request
            2⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:4820
          • C:\Program Files\nodejs\node.exe
            node env.npl
            2⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:1812

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59a3b9.rbs

              • Path C:\Config.Msi\e59a3b9.rbs
              • Size 801KB
              • SHA256 5ca97e550cdbc44bebecab7980572931a4ff432818ff0503a30bed38919a65c8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              install_tools.bat

              • Path C:\Program Files\nodejs\install_tools.bat
              • Size 3KB
              • SHA256 56b0737b893d96c09bbf64acd701e73d01438f0acec81e63c9588d303cf083b4
              • MD5 SHA1 SHA512 TLSH

              npm-prefix.js

              • Path C:\Program Files\nodejs\node_modules\npm\bin\npm-prefix.js
              • Size 864B
              • SHA256 673f620e40137c295f2cf057364468bf3a71653dfc0973be895ebf7a8c368c2e
              • MD5 SHA1 SHA512 TLSH

              index.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\index.js
              • Size 32KB
              • SHA256 6c62d0afd091ad34f1236c468924b7cc9d789ffd925e52408f5ea28875df418f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              type-defs.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js
              • Size 1KB
              • SHA256 5f8cab3a4133b226c653784d569a9bf3e5a2ee76ac73b9156cd58a2c72839648
              • MD5 SHA1 SHA512 TLSH

              umask.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\umask.js
              • Size 949B
              • SHA256 9aec687f45f435f9f198e583f35b5f5a4cd0d66e21c2e6e9c772fd8ccbe65b68
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json
              • Size 1KB
              • SHA256 3151ca4c564e843ad4f389779d97ec916d438f50d0b5470718b7062be4280ec9
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\query\LICENSE
              • Size 818B
              • SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\run-script\LICENSE
              • Size 754B
              • SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\LICENSE
              • Size 11KB
              • SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              witness.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\witness.js
              • Size 79B
              • SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
              • MD5 SHA1 SHA512 TLSH

              index.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\lib\index.js
              • Size 1KB
              • SHA256 d12c4a8f9905d3518963e66d6568b0c8dd1f0c61f5b8bb5fa517fb015b3626b4
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\abbrev\package.json
              • Size 1KB
              • SHA256 e7671569440b427332662fceb1f4145dbf935e8e37e1da8333710af6b6e564e8
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\chownr\dist\commonjs\package.json
              • Size 28B
              • SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
              • MD5 SHA1 SHA512

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\chownr\dist\esm\package.json
              • Size 26B
              • SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
              • MD5 SHA1 SHA512

              LICENSE

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\LICENSE
              • Size 780B
              • SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
              • MD5 SHA1 SHA512 TLSH

              ini.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\lib\ini.js
              • Size 7KB
              • SHA256 481b00a4ebbfc83b28b97d32dccd32d7585b29b209930d4db457d91967f172ad
              • MD5 SHA1 SHA512 SSDEEP TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\ini\package.json
              • Size 1KB
              • SHA256 eb9b0b3af32079c90fa9bedeb5539c8415b817eafea0daf113384dc93276c587
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\LICENSE
              • Size 730B
              • SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
              • MD5 SHA1 SHA512 TLSH

              LICENSE.md

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\minipass\LICENSE.md
              • Size 1KB
              • SHA256 865576de51d520f97c8869b9b9f96caf8efd69b82bb6e575fc00b0964dc7a3ca
              • MD5 SHA1 SHA512 TLSH

              debug.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\debug.js
              • Size 186B
              • SHA256 0eda498431dfcb77febe2e79b4a63139559d3f42b21e8b81fc3879a3f6dc3c46
              • MD5 SHA1 SHA512 TLSH

              nopt-lib.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt-lib.js
              • Size 14KB
              • SHA256 fb1225f5af7ce00c5eca903e3ed53a450cc1891d66bc6c06fbbd29973c30cc92
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nopt.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\nopt.js
              • Size 1KB
              • SHA256 d65dabbe6a6f823df2548a9e791e8a768d92368e92fdb7e9ae32fee80aac08fb
              • MD5 SHA1 SHA512 TLSH

              type-defs.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\lib\type-defs.js
              • Size 2KB
              • SHA256 6537bb9b4df3a1af3e14d5a99d58e75180878a3e96a4bb3bc9760b052b53c5a5
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json
              • Size 1KB
              • SHA256 4e2cda6365536a7e958a6a91dffbb890e3e2f9e03cefa43f32ac5b0da9511ec1
              • MD5 SHA1 SHA512 TLSH

              index.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\lib\index.js
              • Size 3KB
              • SHA256 10e6b00110d43b24f6b9fc7de93cf530a8f931e18be3900f478f21dad2fe2579
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\proc-log\package.json
              • Size 1KB
              • SHA256 132b6ca5aec09465a17ecf2e95ecffc01fce34e3a7911c784ad624e4e065c6f1
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
              • Size 763B
              • SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
              • MD5 SHA1 SHA512 TLSH

              parse.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\parse.js
              • Size 349B
              • SHA256 4b2540c8f89bed8f3f158a96100b7ee5a905cff8b39f63317179ab5cc71e5f6c
              • MD5 SHA1 SHA512 TLSH

              valid.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\valid.js
              • Size 184B
              • SHA256 f29c937a2e4d31a159761632dfe3a789f8e02c6ef1afe2d89f2918556c8d5c3b
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\semver\package.json
              • Size 1KB
              • SHA256 84c9df3ebd1153d5177e92d7079118c0a5890c25008e31cb43d1426835d0c24c
              • MD5 SHA1 SHA512 TLSH

              index.js

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\dist\commonjs\index.js
              • Size 474B
              • SHA256 4e86e409d7506477caee910cb50f5bff1dda477878da923bd3888501e1a04036
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\node_modules\walk-up-path\package.json
              • Size 1KB
              • SHA256 3a3641a678348a7becbfe5840320fd51afb843d5728efba222fa133571e17395
              • MD5 SHA1 SHA512 TLSH

              package.json

              • Path C:\Program Files\nodejs\node_modules\npm\package.json
              • Size 6KB
              • SHA256 ec88bdc70390efd52580fc150bbc4c8a66d460e770e89a61ea4540d420f23e6a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              npm.cmd

              • Path C:\Program Files\nodejs\npm.cmd
              • Size 538B
              • SHA256 21b46c69ad6e2f231f02a9e120f4ba6c8e75fef5a45637103002eab99f888ab8
              • MD5 SHA1 SHA512 TLSH

              $metadata.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\$metadata.dat
              • Size 6KB
              • SHA256 22f1855bc5f36b0fcf50b9a07246f6ef3875359897bc865ca4dacf2c7076edf9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='chocolatey-compatibility.extension'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='chocolatey-compatibility.extension'&semVerLevel=2.0.0_page1.dat
              • Size 6KB
              • SHA256 c1913f34b10c456beb1d6982e95becd66d440a26d3e1fb748af6f41c156a854d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='chocolatey-compatibility.extension'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='chocolatey-compatibility.extension'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 387bb55985a97d57bcbb2e0b28007f1bec3710c11b52cef6b3e6e09f7c0a9a39
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='chocolatey-core.extension'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='chocolatey-core.extension'&semVerLevel=2.0.0_page1.dat
              • Size 117KB
              • SHA256 6fd7182b7dc66157481f2037b0f07fc1c173668057e1ac7c6ea6fabb194a4bb0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='chocolatey-core.extension'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='chocolatey-core.extension'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 af9bc8ca39f5fca907da5c4091266a9a307110beb8a52a0795cca8e00dd05744
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='chocolatey-windowsupdate.extension'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='chocolatey-windowsupdate.extension'&semVerLevel=2.0.0_page1.dat
              • Size 31KB
              • SHA256 4d962d0cae83a25c95b80a0d5a67898223d637d192e39440fbccd5aaf8149031
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='chocolatey-windowsupdate.extension'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='chocolatey-windowsupdate.extension'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 50c20d8437f96f919d8e9c8d8a38696b69273ff6a6008166379562c73c57b88f
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='kb2919355'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb2919355'&semVerLevel=2.0.0_page1.dat
              • Size 11KB
              • SHA256 a996219cc498e6fe480a9ae90101fa4ac90c0c34ae0c48bc19f5cb3ad30ba221
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='kb2919355'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb2919355'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 a3f6ff0b5d9d88bea1d1d8969f2d203b5013030ac0a04f8b33d216e6caa073d8
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='kb2919442'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb2919442'&semVerLevel=2.0.0_page1.dat
              • Size 11KB
              • SHA256 cc2a93596f06ef909cc52857165fae00062b8534c406fec212f5b34a40dbc28e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='kb2919442'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb2919442'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 e6af63ea163f50aac6e0bcb3d86ece7c4fa2042f49fe9ccbc697bcc193060e2b
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='kb2999226'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb2999226'&semVerLevel=2.0.0_page1.dat
              • Size 35KB
              • SHA256 10fbe447e9dcd7a725b4b6133596d5d9afe61dc48d3f7dffa46b925342e0eb32
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='kb2999226'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb2999226'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 7f71c9c3e7d1d8f19b42a23145b1d74ad18bec916372c1651df08565ece0f250
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='kb3033929'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb3033929'&semVerLevel=2.0.0_page1.dat
              • Size 33KB
              • SHA256 d236d8a69cd635a373bf299c3bf501083bc582e5b12555d89798bf18cbaefecb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='kb3035131'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb3035131'&semVerLevel=2.0.0_page1.dat
              • Size 23KB
              • SHA256 525a654041c3a87319e01a4afd399fd34b3f4bf6239da8a4e94d3896e8ecb662
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='kb3035131'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='kb3035131'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 3822522b575fea732edd4def684c7db56af81619195e0b28a4f4517f67ad9250
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='vcredist140'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='vcredist140'&semVerLevel=2.0.0_page1.dat
              • Size 260KB
              • SHA256 20baa0dafe55e5e558c47a7121785791a3b34f984de22290ad37452a4708a114
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='vcredist140'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='vcredist140'&semVerLevel=2.0.0_page2.dat
              • Size 158KB
              • SHA256 e60496aa5b4af8a57cebd09771e31114b8d94738f9b68e81ea535f0a14ccbfbc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='vcredist140'&semVerLevel=2.0.0_page3.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='vcredist140'&semVerLevel=2.0.0_page3.dat
              • Size 567B
              • SHA256 5384ce5592d6a1e8cd47a2ab9b10ae8e416282ebe1b41426ab9130aa51f5ab7a
              • MD5 SHA1 SHA512 TLSH

              list_FindPackagesById()_id='vcredist2015'&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='vcredist2015'&semVerLevel=2.0.0_page1.dat
              • Size 41KB
              • SHA256 32cba3c12148d92355e74c1224ed2eee9e125b35a41b06474cba45c28fb42c0d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_FindPackagesById()_id='vcredist2015'&semVerLevel=2.0.0_page2.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_FindPackagesById()_id='vcredist2015'&semVerLevel=2.0.0_page2.dat
              • Size 567B
              • SHA256 1d0413d63d495ab5f862506e977d9b54d5bf8091aeb8104c75b098c577492bc2
              • MD5 SHA1 SHA512 TLSH

              list_Packages()_$filter=(tolower(Id)%20eq%20'python')%20and%20IsLatestVersion&semVerLevel=2.0.0_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_Packages()_$filter=(tolower(Id)%20eq%20'python')%20and%20IsLatestVersion&semVerLevel=2.0.0_page1.dat
              • Size 6KB
              • SHA256 046ae47e21a632915705b4dde03102c30057a754b4b46aa16acf7e54fdf75b5d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_Packages(Id='chocolatey-compatibility.extension',Version='1.0.0')_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_Packages(Id='chocolatey-compatibility.extension',Version='1.0.0')_page1.dat
              • Size 5KB
              • SHA256 7aaaed0e57da4fd7a40169e5fc7d2fe34c085acc9cb8d45fed73012acecdd620
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_Packages(Id='python',Version='3.15.1')_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_Packages(Id='python',Version='3.15.1')_page1.dat
              • Size 6KB
              • SHA256 3ebea945bc9c5add705b55ca61ce56e41833dd50f23f8985ff8a8ed0ed184872
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_Packages(Id='python3',Version='3.15.1')_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_Packages(Id='python3',Version='3.15.1')_page1.dat
              • Size 6KB
              • SHA256 9bed5b6e7e13549f37dfe0aa76fb494093eec7fe51ad736d85106bf1e80d080c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              list_Packages(Id='python315',Version='3.15.1')_page1.dat

              • Path C:\ProgramData\ChocolateyHttpCache\9310b7b8ea69100d3cda3ea6c4468d664f9337fa$community.chocolatey.org_api_v2_\list_Packages(Id='python315',Version='3.15.1')_page1.dat
              • Size 6KB
              • SHA256 65687ddf108a777798317c1e646ffe9c316f0f26c9f18ac988a9136af87f499d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Node.js documentation.url

              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
              • Size 168B
              • SHA256 5f1c7c4d4082d2066e35deb7e42e54a4cf16c214e2490e4ddc5c723d43c825e3
              • MD5 SHA1 SHA512 TLSH

              Node.js website.url

              • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
              • Size 133B
              • SHA256 afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319
              • MD5 SHA1 SHA512 TLSH

              CREDITS.json

              • Path C:\ProgramData\chocolatey\CREDITS.json
              • Size 3KB
              • SHA256 2be866cd3b120d78f25a3957be204f97facea21f7eee42546643e0f76c52ec90
              • MD5 SHA1 SHA512 TLSH

              CREDITS.pdf

              • Path C:\ProgramData\chocolatey\CREDITS.pdf
              • Size 168KB
              • SHA256 52b45cedbbca278ecdef3260c33177ccd3d27e540a0c5124b177fb682b467503
              • MD5 SHA1 SHA512 SSDEEP TLSH

              CREDITS.txt

              • Path C:\ProgramData\chocolatey\CREDITS.txt
              • Size 26KB
              • SHA256 8dff5e041e5463df6fbb0877733a25d271509631cc5a64d554908cfef007c274
              • MD5 SHA1 SHA512 SSDEEP TLSH

              LICENSE.txt

              • Path C:\ProgramData\chocolatey\LICENSE.txt
              • Size 670B
              • SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
              • MD5 SHA1 SHA512 TLSH

              choco.exe.manifest

              • Path C:\ProgramData\chocolatey\choco.exe.manifest
              • Size 2KB
              • SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
              • MD5 SHA1 SHA512 TLSH

              chocolatey.config

              • Path C:\ProgramData\chocolatey\config\chocolatey.config
              • Size 809B
              • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
              • MD5 SHA1 SHA512 TLSH

              chocolatey.config

              • Path C:\ProgramData\chocolatey\config\chocolatey.config
              • Size 9KB
              • SHA256 e965ae07d0a7a1a3a8fe642f732b3177e80c83c3396c96a68a520f2900c53d0d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Chocolatey.PowerShell.dll-help.xml

              • Path C:\ProgramData\chocolatey\helpers\Chocolatey.PowerShell.dll-help.xml
              • Size 58KB
              • SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ChocolateyTabExpansion.ps1

              • Path C:\ProgramData\chocolatey\helpers\ChocolateyTabExpansion.ps1
              • Size 37KB
              • SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chocolateyProfile.psm1

              • Path C:\ProgramData\chocolatey\helpers\chocolateyProfile.psm1
              • Size 15KB
              • SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chocolateyScriptRunner.ps1

              • Path C:\ProgramData\chocolatey\helpers\chocolateyScriptRunner.ps1
              • Size 17KB
              • SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chocolatey-compatibility.psm1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\chocolatey-compatibility.psm1
              • Size 974B
              • SHA256 23c5e9bf1d4f5329fc324cd707658a11db9cb4a4eb4c4e8170ad8973d28fe47a
              • MD5 SHA1 SHA512 TLSH

              Get-PackageParameters.ps1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-PackageParameters.ps1
              • Size 1KB
              • SHA256 2d18fbba6ac5fa6229064d447c20d9926624318b8b128511b6825799c9cc56bb
              • MD5 SHA1 SHA512 TLSH

              Get-UninstallRegistryKey.ps1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Get-UninstallRegistryKey.ps1
              • Size 4KB
              • SHA256 445c1bcb9a77662da86169cd4ecaba80bfeeee58b509b50b97a81d8c8bcaa2ea
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyDesktopLink.ps1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Install-ChocolateyDesktopLink.ps1
              • Size 3KB
              • SHA256 44526b5d7587edd75e682fff9fae8bc31fc9eb38f4e94375914384428d3b2c3d
              • MD5 SHA1 SHA512 TLSH

              Write-ChocolateyFailure.ps1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateyFailure.ps1
              • Size 2KB
              • SHA256 361c6e9b74fc24bf9acc411190c45e548110459775fc9a0e3ded56e5e4104aa2
              • MD5 SHA1 SHA512 TLSH

              Write-ChocolateySuccess.ps1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-ChocolateySuccess.ps1
              • Size 2KB
              • SHA256 e2cd6caadf312cf274f602d7f94143a16c14a029eafc16141f65071ea24903b7
              • MD5 SHA1 SHA512 TLSH

              Write-FileUpdateLog.ps1

              • Path C:\ProgramData\chocolatey\lib\chocolatey-compatibility.extension\extensions\helpers\Write-FileUpdateLog.ps1
              • Size 1KB
              • SHA256 9fb5575b8b63d062272f598157fb15898b322d75d9d87a403bcab34120849cea
              • MD5 SHA1 SHA512 TLSH

              chocolatey.nupkg

              • Path C:\ProgramData\chocolatey\lib\chocolatey\chocolatey.nupkg
              • Size 5.4MB
              • SHA256 aec2dbd6ce91b7378eb4a0c21524e748d30332ea856e898404999f77328bd504
              • MD5 SHA1 SHA512 SSDEEP TLSH

              choco.summary.log

              • Path C:\ProgramData\chocolatey\logs\choco.summary.log
              • Size 147B
              • SHA256 e0f3b832d2b547765e36538ba29e022513e96ae947570cc14bf725bc5884a9ef
              • MD5 SHA1 SHA512 TLSH

              chocolatey.log

              • Path C:\ProgramData\chocolatey\logs\chocolatey.log
              • Size 1KB
              • SHA256 fec3986637e6ead57f860fcac54eaac5df0f5efad107f4ceff90537400a339eb
              • MD5 SHA1 SHA512 TLSH

              chocolatey.log

              • Path C:\ProgramData\chocolatey\logs\chocolatey.log
              • Size 2KB
              • SHA256 c3053ad41e0496945f394bab93e224210d3f04d02df98c0d68b65a4baf21d751
              • MD5 SHA1 SHA512 TLSH

              chocolatey.log

              • Path C:\ProgramData\chocolatey\logs\chocolatey.log
              • Size 4KB
              • SHA256 9508c06a7eefe363069f8fe20200fd0d8975ebeed2ae8d3389e86b114b47e724
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chocolatey.log

              • Path C:\ProgramData\chocolatey\logs\chocolatey.log
              • Size 7KB
              • SHA256 5a8daf90c994cd26308785950a1aa06df0ae5c35442bb5e88b74b5297ce3625b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              RefreshEnv.cmd

              • Path C:\ProgramData\chocolatey\redirects\RefreshEnv.cmd
              • Size 5KB
              • SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              choco.exe

              • Path C:\ProgramData\chocolatey\redirects\choco.exe
              • Size 143KB
              • SHA256 a158ca956434a4c4cfa696a7dc3711b60b63bab60b5e1a3401ccbd6e28c875ba
              • MD5 SHA1 SHA512 SSDEEP TLSH

              choco.exe.ignore

              • Path C:\ProgramData\chocolatey\redirects\choco.exe.ignore
              • Size 2B
              • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
              • MD5 SHA1 SHA512

              7z.dll

              • Path C:\ProgramData\chocolatey\tools\7z.dll
              • Size 1.3MB
              • SHA256 c6989259a78960805b8b646843d2ef3a8a19e5533359e8a252aad2f3cc78c844
              • MD5 SHA1 SHA512 SSDEEP TLSH

              7z.exe

              • Path C:\ProgramData\chocolatey\tools\7z.exe
              • Size 349KB
              • SHA256 285e5220d6d4240b6a4bdb6357d427e457313376e3464d3cb973637a384ed02a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              7zip.license.txt

              • Path C:\ProgramData\chocolatey\tools\7zip.license.txt
              • Size 5KB
              • SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              checksum.exe

              • Path C:\ProgramData\chocolatey\tools\checksum.exe
              • Size 38KB
              • SHA256 3e45051aef3a7ffb711240719c0f3cc744dfc706e1e5e7fba608d65feb7922e1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              checksum.exe.config

              • Path C:\ProgramData\chocolatey\tools\checksum.exe.config
              • Size 150B
              • SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
              • MD5 SHA1 SHA512 TLSH

              checksum.license.txt

              • Path C:\ProgramData\chocolatey\tools\checksum.license.txt
              • Size 95B
              • SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
              • MD5 SHA1 SHA512 TLSH

              shimgen.exe

              • Path C:\ProgramData\chocolatey\tools\shimgen.exe
              • Size 555KB
              • SHA256 50a349f3c15353bb9033c4e9d4660ebd9677667d6d3cd2951cf7429c4fb6084f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              shimgen.license.txt

              • Path C:\ProgramData\chocolatey\tools\shimgen.license.txt
              • Size 3KB
              • SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
              • MD5 SHA1 SHA512 TLSH

              5A6896595A9B5FF7A8254147F2B2367B

              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A6896595A9B5FF7A8254147F2B2367B
              • Size 22KB
              • SHA256 76660ae87468f1672516bb2fb1ea4b506ceef5c759c6180f634c151114bf5347
              • MD5 SHA1 SHA512 SSDEEP TLSH

              77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
              • Size 1KB
              • SHA256 c1657ce4cc8a4df2cf5f9b4b55462f054eda037760e056fe1552a0cbd09dba7f
              • MD5 SHA1 SHA512 TLSH

              EF7234CDBB1649702229F955C785C39F

              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
              • Size 785B
              • SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
              • MD5 SHA1 SHA512 TLSH

              5A6896595A9B5FF7A8254147F2B2367B

              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A6896595A9B5FF7A8254147F2B2367B
              • Size 290B
              • SHA256 8b92a09f94f7642ec531b1fc40db0d2a6dc15b9fdd2604d3d2c6805db8395bf2
              • MD5 SHA1 SHA512 TLSH

              77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
              • Size 422B
              • SHA256 6d83ab572b316b5a1584cb1bea5c16b404808a6b78b6941cd12a8c17325d4f2a
              • MD5 SHA1 SHA512 TLSH

              EF7234CDBB1649702229F955C785C39F

              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
              • Size 308B
              • SHA256 58be821a9c13417b57d5180b1497e2ac3bab07c134c815711082949d2514e4ee
              • MD5 SHA1 SHA512 TLSH

              choco.exe.log

              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\choco.exe.log
              • Size 2KB
              • SHA256 dbe8c21ecdd2498eba95dff8c55ae2ccaa60507ebc3075bda531bf3f8adf363d
              • MD5 SHA1 SHA512 TLSH

              powershell.exe.log

              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              • Size 1KB
              • SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
              • MD5 SHA1 SHA512 TLSH

              StartupProfileData-NonInteractive

              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 15KB
              • SHA256 d10b090f3d72dcf2df05742396f991694f445978e13862c2af5c9b8492262c95
              • MD5 SHA1 SHA512 SSDEEP TLSH

              MSIE385.tmp

              • Path C:\Users\Admin\AppData\Local\Temp\MSIE385.tmp
              • Size 142KB
              • SHA256 c0980e3c2a9f93a422b2c33ebb13b9f9c2e1426410535eb177bf271e7ae7bc96
              • MD5 SHA1 SHA512 SSDEEP TLSH

              MSIE422.tmp

              • Path C:\Users\Admin\AppData\Local\Temp\MSIE422.tmp
              • Size 390KB
              • SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              __PSScriptPolicyTest_4srsxklu.qcx.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4srsxklu.qcx.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH

              chocolatey-compatibility.extension.1.0.0.nupkg

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\ChocolateyScratch\chocolatey-compatibility.extension\1.0.0\chocolatey-compatibility.extension.1.0.0.nupkg
              • Size 12KB
              • SHA256 7e81bee5d6b0527b312a30b11db6c3b2bca3cea630c7124454b1552399dae012
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chocolatey-compatibility.extension.nuspec

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\ChocolateyScratch\chocolatey-compatibility.extension\1.0.0\chocolatey-compatibility.extension.nuspec
              • Size 2KB
              • SHA256 e16c82bd44a8abc7777f3c3003d3d58869d5111c020ba283b764f0a2f9de5dd8
              • MD5 SHA1 SHA512 TLSH

              choco.exe

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe
              • Size 11.5MB
              • SHA256 9c858d0b687607ff5c06601469a69e642e7b126fcc9ad3f94e58fd85694c44f5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Chocolatey.PowerShell.dll

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
              • Size 38KB
              • SHA256 cee0d7b7841d758ddb04ac1fa783616fe81793ffba3717b3922d7561a52f046a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chocolateyInstaller.psm1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1
              • Size 21KB
              • SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Format-FileSize.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Format-FileSize.ps1
              • Size 15KB
              • SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-CheckSumValid.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-CheckSumValid.ps1
              • Size 25KB
              • SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-ChocolateyConfigValue.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyConfigValue.ps1
              • Size 15KB
              • SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-ChocolateyPath.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyPath.ps1
              • Size 16KB
              • SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-ChocolateyUnzip.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyUnzip.ps1
              • Size 25KB
              • SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-ChocolateyWebFile.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyWebFile.ps1
              • Size 31KB
              • SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-FtpFile.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-FtpFile.ps1
              • Size 22KB
              • SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-OSArchitectureWidth.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-OSArchitectureWidth.ps1
              • Size 16KB
              • SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-PackageParameters.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-PackageParameters.ps1
              • Size 21KB
              • SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-ToolsLocation.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ToolsLocation.ps1
              • Size 17KB
              • SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-UACEnabled.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UACEnabled.ps1
              • Size 15KB
              • SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-UninstallRegistryKey.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UninstallRegistryKey.ps1
              • Size 19KB
              • SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-VirusCheckValid.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-VirusCheckValid.ps1
              • Size 15KB
              • SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-WebFile.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFile.ps1
              • Size 28KB
              • SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-WebFileName.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFileName.ps1
              • Size 23KB
              • SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Get-WebHeaders.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebHeaders.ps1
              • Size 20KB
              • SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-BinFile.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-BinFile.ps1
              • Size 20KB
              • SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyEnvironmentVariable.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
              • Size 18KB
              • SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyExplorerMenuItem.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
              • Size 18KB
              • SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyFileAssociation.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyFileAssociation.ps1
              • Size 17KB
              • SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyInstallPackage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyInstallPackage.ps1
              • Size 28KB
              • SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyPackage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPackage.ps1
              • Size 30KB
              • SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyPinnedTaskBarItem.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
              • Size 16KB
              • SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyPowershellCommand.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPowershellCommand.ps1
              • Size 23KB
              • SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyShortcut.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyShortcut.ps1
              • Size 22KB
              • SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyVsixPackage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyVsixPackage.ps1
              • Size 22KB
              • SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-ChocolateyZipPackage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyZipPackage.ps1
              • Size 24KB
              • SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Install-Vsix.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-Vsix.ps1
              • Size 16KB
              • SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Set-PowerShellExitCode.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Set-PowerShellExitCode.ps1
              • Size 15KB
              • SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Start-ChocolateyProcessAsAdmin.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
              • Size 31KB
              • SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
              • MD5 SHA1 SHA512 SSDEEP TLSH

              UnInstall-ChocolateyZipPackage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
              • Size 16KB
              • SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Uninstall-BinFile.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-BinFile.ps1
              • Size 17KB
              • SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Uninstall-ChocolateyEnvironmentVariable.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
              • Size 16KB
              • SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Uninstall-ChocolateyPackage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyPackage.ps1
              • Size 20KB
              • SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Write-FunctionCallLogMessage.ps1

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Write-FunctionCallLogMessage.ps1
              • Size 15KB
              • SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              7z.exe.manifest

              • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe.manifest
              • Size 513B
              • SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
              • MD5 SHA1 SHA512 TLSH

              08ded6aa4399e21b553a2ab89520de128f3dd75815f1a6538aab5b00f3ac8394fc64c86e4b281bf095b9ddc51c5d55c482bb9a3083b4dd3c8e7d20203c6f

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\24\82\08ded6aa4399e21b553a2ab89520de128f3dd75815f1a6538aab5b00f3ac8394fc64c86e4b281bf095b9ddc51c5d55c482bb9a3083b4dd3c8e7d20203c6f
              • Size 18KB
              • SHA256 1748de8ecde91aaa3203f0f3bf1eb176662611415f6a3ef993e896c6efa27103
              • MD5 SHA1 SHA512 SSDEEP TLSH

              a9157ce8a8910789996fc58debdb020e23840acb30281f02c5d0789930cdaf6363c769a0b91dfa7a5b1bf0562a17556b8993f2d16aa72f07aa64138b77b4

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\55\86\a9157ce8a8910789996fc58debdb020e23840acb30281f02c5d0789930cdaf6363c769a0b91dfa7a5b1bf0562a17556b8993f2d16aa72f07aa64138b77b4
              • Size 17KB
              • SHA256 0dc20fd7bd04c1f7af43916b5231358d5da798686c83dd6ec54229fc7c324989
              • MD5 SHA1 SHA512 SSDEEP TLSH

              dfc1213397ddbab41dbbb71fe7b15b756379b54e84cb5ca2b7cd7e51740c8380fdeda17d755c3d221fcdacd0413ef7cfaaa46aceea65b138331add433b2c

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\60\d4\dfc1213397ddbab41dbbb71fe7b15b756379b54e84cb5ca2b7cd7e51740c8380fdeda17d755c3d221fcdacd0413ef7cfaaa46aceea65b138331add433b2c
              • Size 59KB
              • SHA256 f939136719058b7519d90da4bada687056329c114f9028751709a394d5ab0af0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              84ff18a003077a9cb20cb3a542f8cda23c689e247fd26ec7ef5645c0c19f44c6be59d718f54077cf176c33f363b716098c57a827780409e4695d2a131816

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\c9\a6\84ff18a003077a9cb20cb3a542f8cda23c689e247fd26ec7ef5645c0c19f44c6be59d718f54077cf176c33f363b716098c57a827780409e4695d2a131816
              • Size 21KB
              • SHA256 bd75ac4dd511c81135edffe9f257f6f5109d1587f3f9f356bddd31ce552217b0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              300ea3c17617267449b7f1f698f9d6dbb5748b8bc856311865eaa839e8c05f3eb40d15ac091558cbc499d31ac6bcd4e337a73a458a7b21e718efe576ec48

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\content-v2\sha512\e3\1f\300ea3c17617267449b7f1f698f9d6dbb5748b8bc856311865eaa839e8c05f3eb40d15ac091558cbc499d31ac6bcd4e337a73a458a7b21e718efe576ec48
              • Size 77KB
              • SHA256 2cd84cb53c483b7ca9ace320b3fbbe7addefbd0cb6b6a7ef44d6ed4ec01426d1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bc1d086124331680bbaa5c4c1b8d244d40fc2dad68e9fe8dcd4f002638ec

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\27\b6\bc1d086124331680bbaa5c4c1b8d244d40fc2dad68e9fe8dcd4f002638ec
              • Size 701B
              • SHA256 d9dd9a69cec083011cde1151b503c524e1635614a3a5387f5b0d5e89b70882a7
              • MD5 SHA1 SHA512 TLSH

              f5b12412d0e8766b46ec3a813882f8caa828b5c3948efc5468c88b123a11

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\2a\73\f5b12412d0e8766b46ec3a813882f8caa828b5c3948efc5468c88b123a11
              • Size 693B
              • SHA256 503a345de06acc622fb7a8d194c01a081e49e6074f61d33879bf39c971646439
              • MD5 SHA1 SHA512 TLSH

              68da17f4dd09e12875ca6413db4655a89b5a5eb8613faca86038e97a5c72

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\3b\c9\68da17f4dd09e12875ca6413db4655a89b5a5eb8613faca86038e97a5c72
              • Size 695B
              • SHA256 2a98faf68ba0a49cb050d212399ad8828105db60a48cd86efdbf8ddf41566f89
              • MD5 SHA1 SHA512 TLSH

              00374dd6a1a617292208c4a73101736334607a8f76a81180650d259f67db

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\56\55\00374dd6a1a617292208c4a73101736334607a8f76a81180650d259f67db
              • Size 686B
              • SHA256 9eb399b2ddcf9523357f434435626dee927c270c382bf401f24280b2ee5255ce
              • MD5 SHA1 SHA512 TLSH

              d8075e0f65536acf7e0f5ec13ddad3156936c45ad00b5abe3929099d34e8

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\c1\02\d8075e0f65536acf7e0f5ec13ddad3156936c45ad00b5abe3929099d34e8
              • Size 689B
              • SHA256 fc347673e3e2f2721df14bfeac75f9620cdba493a44191654192622fa5ea0799
              • MD5 SHA1 SHA512 TLSH

              d6d16b3e7aa7edfdb1c5fe8ef0f9933ff289b5ae0026745e58f8b9d16511

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\c1\d3\d6d16b3e7aa7edfdb1c5fe8ef0f9933ff289b5ae0026745e58f8b9d16511
              • Size 696B
              • SHA256 08f0c447439a35575bdefd4b581d72bb628c72a4be5c24ffb14bf2969fe7dc76
              • MD5 SHA1 SHA512 TLSH

              55e56e6f53ffe7a3aa682cb279b0f1f907be037ece0730687bb49a730313

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\e0\3b\55e56e6f53ffe7a3aa682cb279b0f1f907be037ece0730687bb49a730313
              • Size 702B
              • SHA256 2d2e7dc422a90e821154e9c65ff025518290c17aae002c6d49b69911b26448e5
              • MD5 SHA1 SHA512 TLSH

              64c2fd3b183d1739f4be1b1d528a23f9b30ce37ca9974b48ca0b983598bf

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\e0\c9\64c2fd3b183d1739f4be1b1d528a23f9b30ce37ca9974b48ca0b983598bf
              • Size 699B
              • SHA256 9f1711990a1eef15660debb0195daf61bbb02264b02ff14785371eade2228100
              • MD5 SHA1 SHA512 TLSH

              138d06536fa4ad47a86841653c3ff37ac8a889bfd425926c5c32d3489804

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\ef\7e\138d06536fa4ad47a86841653c3ff37ac8a889bfd425926c5c32d3489804
              • Size 692B
              • SHA256 bdb0f3b408ac3d112823f553596bb6aa781d2e1746f5056cc2aba951893a820e
              • MD5 SHA1 SHA512 TLSH

              0fb3ce45fb690a1851537ed333cfcfd6be1e8b868b655055069aab25adf3

              • Path C:\Users\Admin\AppData\Local\npm-cache\_cacache\index-v5\fb\4b\0fb3ce45fb690a1851537ed333cfcfd6be1e8b868b655055069aab25adf3
              • Size 682B
              • SHA256 95b7dea27bb2c4d42f83666d9a4aa3cc7c186e80bc5d9257e889ca201078da04
              • MD5 SHA1 SHA512 TLSH

              MSID0D8.tmp

              • Path C:\Windows\Installer\MSID0D8.tmp
              • Size 342KB
              • SHA256 69cdc445cd2b1ade4074853f11c8a229c7501e176b5b113b47ac18c5564148b6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              e59a3ba.msi

              • Path C:\Windows\Installer\e59a3ba.msi
              • Size 35.2MB
              • SHA256 f32a2844504ed8d73449ddb480385f69cb436bc9409a89e2049ae83447078457
              • MD5 SHA1 SHA512 SSDEEP TLSH

              metadata-2

              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 24.6MB
              • SHA256 62cd74f3c9744c209cf8b24d16f1caa25dae9463963c6243ae19b5027673bc72
              • MD5 SHA1 SHA512 SSDEEP TLSH

              {d3138565-fb80-4253-8cb2-b7b932fea80a}_OnDiskSnapshotProp

              • Path \??\Volume{5acbaf70-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d3138565-fb80-4253-8cb2-b7b932fea80a}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 66f1a5af8640e9dea56a195029173e1cbec673e462f1f5169cb8f45add302ed1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              memory/1656-2589-0x0000000000640000-0x0000000000668000-memory.dmp

              memory/5232-2030-0x00000000051B0000-0x00000000057DA000-memory.dmp

              memory/5232-2031-0x0000000004F20000-0x0000000004FA2000-memory.dmp

              memory/5232-2029-0x00000000029D0000-0x0000000002A06000-memory.dmp

              memory/5232-2032-0x00000000057E0000-0x0000000005802000-memory.dmp

              memory/5232-2033-0x0000000005950000-0x00000000059B6000-memory.dmp

              memory/5232-2034-0x0000000005A40000-0x0000000005AA6000-memory.dmp

              memory/5232-2041-0x0000000005AB0000-0x0000000005E07000-memory.dmp

              memory/5232-2042-0x00000000059D0000-0x00000000059E0000-memory.dmp

              memory/5232-2043-0x0000000005F20000-0x0000000006022000-memory.dmp

              memory/5232-2049-0x0000000007670000-0x0000000007C16000-memory.dmp

              memory/5232-2048-0x00000000065D0000-0x00000000065F2000-memory.dmp

              memory/5232-2047-0x0000000006580000-0x000000000659A000-memory.dmp

              memory/5232-2046-0x0000000007020000-0x00000000070B6000-memory.dmp

              memory/5232-2045-0x0000000006110000-0x000000000615C000-memory.dmp

              memory/5232-2044-0x0000000006070000-0x000000000608E000-memory.dmp

              memory/5524-2269-0x0000000002DF0000-0x0000000002DFA000-memory.dmp

              memory/5524-2064-0x00000000069D0000-0x0000000006A1C000-memory.dmp

              memory/5524-2065-0x0000000007E50000-0x00000000084CA000-memory.dmp

              memory/5524-2067-0x00000000705C0000-0x000000007060C000-memory.dmp

              memory/5524-2066-0x0000000007B80000-0x0000000007BB4000-memory.dmp

              memory/5524-2074-0x0000000007B60000-0x0000000007B7E000-memory.dmp

              memory/5524-2076-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

              memory/5524-2062-0x0000000005FC0000-0x0000000006317000-memory.dmp

              memory/5524-2075-0x0000000007BC0000-0x0000000007C64000-memory.dmp

              memory/5524-2077-0x0000000007D10000-0x0000000007D5A000-memory.dmp

              memory/5524-2078-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

              memory/5524-2079-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

              memory/5524-2080-0x0000000007D70000-0x0000000007D85000-memory.dmp

              memory/5524-2081-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

              memory/5524-2082-0x0000000007DB0000-0x0000000007DB8000-memory.dmp

              memory/5524-2084-0x0000000007DA0000-0x0000000007DB4000-memory.dmp

              memory/5524-2085-0x0000000008570000-0x0000000008582000-memory.dmp

              memory/5524-2086-0x00000000079A0000-0x00000000079AA000-memory.dmp

              memory/5524-2265-0x0000000007E40000-0x0000000007E4E000-memory.dmp

              memory/5524-2268-0x0000000008600000-0x000000000861E000-memory.dmp

              memory/5852-2559-0x00000225621A0000-0x00000225622A2000-memory.dmp

              memory/5852-2507-0x0000022546430000-0x0000022546FA8000-memory.dmp

              memory/5852-2520-0x0000022561FC0000-0x0000022562010000-memory.dmp

              memory/5852-2521-0x0000022561F70000-0x0000022561F92000-memory.dmp

              memory/5852-2562-0x0000022561FA0000-0x0000022561FBE000-memory.dmp

              memory/5852-2561-0x0000022562110000-0x0000022562186000-memory.dmp

              memory/5904-2687-0x00000253710A0000-0x00000253710B2000-memory.dmp

              memory/5904-2679-0x00000253712C0000-0x0000025371300000-memory.dmp