Overview

overview

10

Static

static

5

chocoGUIv2.exe

windows10-2004-x64

10

chocoGUIv2.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 03:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    chocoGUIv2.exe
  • Size 1.1MB
  • Sample261027-ec8m3scf35
  • SHA256 8f7a9c3ae7636f27bf7b29f99e616c934699e4d98b6fce496d0a6494bd8a3688
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://chocolatey.org/install.ps1

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 59 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe
    "C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:252
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"
        3⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\SysWOW64\setx.exe
          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465678532678
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2388
        • C:\Windows\SysWOW64\setx.exe
          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465683142997
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5584
        • C:\Windows\SysWOW64\setx.exe
          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465687262599
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2780
        • C:\Windows\SysWOW64\setx.exe
          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465704506022
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3272
        • C:\ProgramData\chocolatey\choco.exe
          "C:\ProgramData\chocolatey\choco.exe" -v
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:3320
    • C:\ProgramData\chocolatey\choco.exe
      C:\ProgramData\chocolatey\choco.exe
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4304
    • C:\ProgramData\chocolatey\choco.exe
      C:\ProgramData\chocolatey\choco.exe
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chocolatey.config
        • Path C:\ProgramData\chocolatey\config\chocolatey.config
        • Size 809B
        • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        choco.summary.log
        • Path C:\ProgramData\chocolatey\logs\choco.summary.log
        • Size 147B
        • SHA256 9a8044050bb6643d6619b00e2cc1045f9d105384f8b407a26cec03c3fa6d9c0d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        choco.summary.log
        • Path C:\ProgramData\chocolatey\logs\choco.summary.log
        • Size 415B
        • SHA256 7e370ad19902cf08f84d5b8770d9424816d0204f9c7370b879a5f763bdbf7602
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        chocolatey.log
        • Path C:\ProgramData\chocolatey\logs\chocolatey.log
        • Size 1KB
        • SHA256 266fc3bcfaf3574f946c8f6ba47a119a8047a46c9e18a7a4801bdc1dde739334
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        chocolatey.log
        • Path C:\ProgramData\chocolatey\logs\chocolatey.log
        • Size 4KB
        • SHA256 0c15ecabf5213ee9e2a1dd5d0ffdfeda41e955d016cf57286bfceb5535004c72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chocolatey.log
        • Path C:\ProgramData\chocolatey\logs\chocolatey.log
        • Size 5KB
        • SHA256 32cd490d24a08a871131e6fe1df6b33a0c57a3dde716ce05b1abed00e78b1af4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chocolatey.log
        • Path C:\ProgramData\chocolatey\logs\chocolatey.log
        • Size 13KB
        • SHA256 2e2c3ad9217cc118d9fc0cbcc7060405a8a2c354646c12f066799005ce4448e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_y22nppot.ld5.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y22nppot.ld5.psm1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        chocolatey.zip
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zip
        • Size 5.4MB
        • SHA256 aec2dbd6ce91b7378eb4a0c21524e748d30332ea856e898404999f77328bd504
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CREDITS.json
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.json
        • Size 3KB
        • SHA256 2be866cd3b120d78f25a3957be204f97facea21f7eee42546643e0f76c52ec90
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CREDITS.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.pdf
        • Size 168KB
        • SHA256 52b45cedbbca278ecdef3260c33177ccd3d27e540a0c5124b177fb682b467503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CREDITS.txt
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txt
        • Size 26KB
        • SHA256 8dff5e041e5463df6fbb0877733a25d271509631cc5a64d554908cfef007c274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LICENSE.txt
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txt
        • Size 670B
        • SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        choco.exe
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe
        • Size 11.5MB
        • SHA256 9c858d0b687607ff5c06601469a69e642e7b126fcc9ad3f94e58fd85694c44f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        choco.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe.manifest
        • Size 2KB
        • SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Chocolatey.PowerShell.dll
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
        • Size 38KB
        • SHA256 cee0d7b7841d758ddb04ac1fa783616fe81793ffba3717b3922d7561a52f046a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Chocolatey.PowerShell.dll-help.xml
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xml
        • Size 58KB
        • SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ChocolateyTabExpansion.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\ChocolateyTabExpansion.ps1
        • Size 37KB
        • SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chocolateyInstaller.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1
        • Size 21KB
        • SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chocolateyProfile.psm1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1
        • Size 15KB
        • SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chocolateyScriptRunner.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyScriptRunner.ps1
        • Size 17KB
        • SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Format-FileSize.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Format-FileSize.ps1
        • Size 15KB
        • SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-CheckSumValid.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-CheckSumValid.ps1
        • Size 25KB
        • SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-ChocolateyConfigValue.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyConfigValue.ps1
        • Size 15KB
        • SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-ChocolateyPath.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyPath.ps1
        • Size 16KB
        • SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-ChocolateyUnzip.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyUnzip.ps1
        • Size 25KB
        • SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-ChocolateyWebFile.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyWebFile.ps1
        • Size 31KB
        • SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-FtpFile.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-FtpFile.ps1
        • Size 22KB
        • SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-OSArchitectureWidth.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-OSArchitectureWidth.ps1
        • Size 16KB
        • SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-PackageParameters.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-PackageParameters.ps1
        • Size 21KB
        • SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-ToolsLocation.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ToolsLocation.ps1
        • Size 17KB
        • SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-UACEnabled.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UACEnabled.ps1
        • Size 15KB
        • SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-UninstallRegistryKey.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UninstallRegistryKey.ps1
        • Size 19KB
        • SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-VirusCheckValid.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-VirusCheckValid.ps1
        • Size 15KB
        • SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-WebFile.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFile.ps1
        • Size 28KB
        • SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-WebFileName.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFileName.ps1
        • Size 23KB
        • SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Get-WebHeaders.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebHeaders.ps1
        • Size 20KB
        • SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-BinFile.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-BinFile.ps1
        • Size 20KB
        • SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyEnvironmentVariable.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
        • Size 18KB
        • SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyExplorerMenuItem.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
        • Size 18KB
        • SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyFileAssociation.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyFileAssociation.ps1
        • Size 17KB
        • SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyInstallPackage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyInstallPackage.ps1
        • Size 28KB
        • SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyPackage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPackage.ps1
        • Size 30KB
        • SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyPinnedTaskBarItem.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
        • Size 16KB
        • SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyPowershellCommand.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPowershellCommand.ps1
        • Size 23KB
        • SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyShortcut.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyShortcut.ps1
        • Size 22KB
        • SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyVsixPackage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyVsixPackage.ps1
        • Size 22KB
        • SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-ChocolateyZipPackage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyZipPackage.ps1
        • Size 24KB
        • SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Install-Vsix.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-Vsix.ps1
        • Size 16KB
        • SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Set-PowerShellExitCode.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Set-PowerShellExitCode.ps1
        • Size 15KB
        • SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Start-ChocolateyProcessAsAdmin.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
        • Size 31KB
        • SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnInstall-ChocolateyZipPackage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
        • Size 16KB
        • SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall-BinFile.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-BinFile.ps1
        • Size 17KB
        • SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall-ChocolateyEnvironmentVariable.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
        • Size 16KB
        • SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall-ChocolateyPackage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyPackage.ps1
        • Size 20KB
        • SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Write-FunctionCallLogMessage.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Write-FunctionCallLogMessage.ps1
        • Size 15KB
        • SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RefreshEnv.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\RefreshEnv.cmd
        • Size 5KB
        • SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        choco.exe
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe
        • Size 143KB
        • SHA256 a158ca956434a4c4cfa696a7dc3711b60b63bab60b5e1a3401ccbd6e28c875ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        choco.exe.ignore
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\redirects\choco.exe.ignore
        • Size 2B
        • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
        • MD5 SHA1 SHA512
        Submit Download

        7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.dll
        • Size 1.3MB
        • SHA256 c6989259a78960805b8b646843d2ef3a8a19e5533359e8a252aad2f3cc78c844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe
        • Size 349KB
        • SHA256 285e5220d6d4240b6a4bdb6357d427e457313376e3464d3cb973637a384ed02a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe.manifest
        • Size 513B
        • SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7zip.license.txt
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7zip.license.txt
        • Size 5KB
        • SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        checksum.exe
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe
        • Size 38KB
        • SHA256 3e45051aef3a7ffb711240719c0f3cc744dfc706e1e5e7fba608d65feb7922e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        checksum.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.exe.config
        • Size 150B
        • SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        checksum.license.txt
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\checksum.license.txt
        • Size 95B
        • SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        shimgen.exe
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.exe
        • Size 555KB
        • SHA256 50a349f3c15353bb9033c4e9d4660ebd9677667d6d3cd2951cf7429c4fb6084f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shimgen.license.txt
        • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\shimgen.license.txt
        • Size 3KB
        • SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3320-354-0x00000277D45D0000-0x00000277D5148000-memory.dmp
        Download

        memory/3320-408-0x00000277D6EC0000-0x00000277D6EDE000-memory.dmp
        Download

        memory/3320-407-0x00000277EF930000-0x00000277EF9A6000-memory.dmp
        Download

        memory/3320-368-0x00000277D6E30000-0x00000277D6E52000-memory.dmp
        Download

        memory/3320-367-0x00000277D57B0000-0x00000277D5800000-memory.dmp
        Download

        memory/3528-23-0x0000000007F60000-0x0000000007FF6000-memory.dmp
        Download

        memory/3528-20-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-37-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-35-0x0000000008DE0000-0x000000000939A000-memory.dmp
        Download

        memory/3528-34-0x00000000087F0000-0x0000000008812000-memory.dmp
        Download

        memory/3528-33-0x0000000008000000-0x0000000008008000-memory.dmp
        Download

        memory/3528-32-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-31-0x00000000731D2000-0x00000000731D3000-memory.dmp
        Download

        memory/3528-30-0x00000000086A0000-0x00000000086BC000-memory.dmp
        Download

        memory/3528-29-0x0000000007F30000-0x0000000007F45000-memory.dmp
        Download

        memory/3528-28-0x0000000007F10000-0x0000000007F20000-memory.dmp
        Download

        memory/3528-27-0x0000000007EE0000-0x0000000007EF1000-memory.dmp
        Download

        memory/3528-26-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-25-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-24-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-0-0x00000000731D2000-0x00000000731D3000-memory.dmp
        Download

        memory/3528-22-0x0000000007EB0000-0x0000000007EBA000-memory.dmp
        Download

        memory/3528-21-0x0000000007DB0000-0x0000000007E53000-memory.dmp
        Download

        memory/3528-16-0x000000006FB60000-0x000000006FBAC000-memory.dmp
        Download

        memory/3528-38-0x00000000088A0000-0x00000000088B2000-memory.dmp
        Download

        memory/3528-19-0x0000000007D80000-0x0000000007DA0000-memory.dmp
        Download

        memory/3528-15-0x0000000007D40000-0x0000000007D76000-memory.dmp
        Download

        memory/3528-14-0x0000000006D30000-0x0000000006D4A000-memory.dmp
        Download

        memory/3528-13-0x0000000008020000-0x000000000869C000-memory.dmp
        Download

        memory/3528-12-0x0000000006820000-0x000000000686C000-memory.dmp
        Download

        memory/3528-11-0x0000000006800000-0x000000000681E000-memory.dmp
        Download

        memory/3528-10-0x00000000062B0000-0x000000000660B000-memory.dmp
        Download

        memory/3528-39-0x0000000008870000-0x000000000887A000-memory.dmp
        Download

        memory/3528-7-0x0000000006180000-0x00000000061E6000-memory.dmp
        Download

        memory/3528-128-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-147-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-6-0x0000000006110000-0x0000000006176000-memory.dmp
        Download

        memory/3528-170-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-222-0x00000000088E0000-0x00000000088EE000-memory.dmp
        Download

        memory/3528-5-0x0000000006070000-0x0000000006092000-memory.dmp
        Download

        memory/3528-426-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-4-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-3-0x0000000005A20000-0x000000000606A000-memory.dmp
        Download

        memory/3528-2-0x00000000731C0000-0x000000007397C000-memory.dmp
        Download

        memory/3528-1-0x0000000005350000-0x0000000005386000-memory.dmp
        Download