Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 03:49

General

  • Target
    chocoGUIv2.exe
  • Size 1.1MB
  • Sample261027-edefmabs5m
  • SHA256 a3e93c6c9aa61979b12cb8200c7d9a4a02c323a1366f14b478e61de40b955a0c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Language
  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://chocolatey.org/install.ps1

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe
    "C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Windows\System32\setx.exe
          "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465739682650
          4⤵
            PID:3496
          • C:\Windows\System32\setx.exe
            "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465744213734
            4⤵
              PID:1284
            • C:\Windows\System32\setx.exe
              "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465748745297
              4⤵
                PID:4004
              • C:\Windows\System32\setx.exe
                "C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 134375465770307752
                4⤵
                  PID:220
                • C:\ProgramData\chocolatey\choco.exe
                  "C:\ProgramData\chocolatey\choco.exe" -v
                  4⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  PID:2504
            • C:\ProgramData\chocolatey\choco.exe
              C:\ProgramData\chocolatey\choco.exe
              2⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of AdjustPrivilegeToken
              PID:1684
            • C:\ProgramData\chocolatey\choco.exe
              C:\ProgramData\chocolatey\choco.exe
              2⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Suspicious use of AdjustPrivilegeToken
              PID:4220

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                CREDITS.json

                • Path C:\ProgramData\chocolatey\CREDITS.json
                • Size 3KB
                • SHA256 2be866cd3b120d78f25a3957be204f97facea21f7eee42546643e0f76c52ec90
                • MD5 SHA1 SHA512 TLSH

                CREDITS.pdf

                • Path C:\ProgramData\chocolatey\CREDITS.pdf
                • Size 168KB
                • SHA256 52b45cedbbca278ecdef3260c33177ccd3d27e540a0c5124b177fb682b467503
                • MD5 SHA1 SHA512 SSDEEP TLSH

                CREDITS.txt

                • Path C:\ProgramData\chocolatey\CREDITS.txt
                • Size 26KB
                • SHA256 8dff5e041e5463df6fbb0877733a25d271509631cc5a64d554908cfef007c274
                • MD5 SHA1 SHA512 SSDEEP TLSH

                LICENSE.txt

                • Path C:\ProgramData\chocolatey\LICENSE.txt
                • Size 670B
                • SHA256 a42ac97c0186e34bdc5f5a7d87d00a424754592f0ec80b522a872d630c1e870a
                • MD5 SHA1 SHA512 TLSH

                choco.exe.manifest

                • Path C:\ProgramData\chocolatey\choco.exe.manifest
                • Size 2KB
                • SHA256 d715d6071e5cdd6447d46ed8e903b9b3ad5952acc7394ee17593d87a546c17fc
                • MD5 SHA1 SHA512 TLSH

                chocolatey.config

                • Path C:\ProgramData\chocolatey\config\chocolatey.config
                • Size 809B
                • SHA256 86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594
                • MD5 SHA1 SHA512 TLSH

                chocolatey.config

                • Path C:\ProgramData\chocolatey\config\chocolatey.config
                • Size 9KB
                • SHA256 e965ae07d0a7a1a3a8fe642f732b3177e80c83c3396c96a68a520f2900c53d0d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Chocolatey.PowerShell.dll-help.xml

                • Path C:\ProgramData\chocolatey\helpers\Chocolatey.PowerShell.dll-help.xml
                • Size 58KB
                • SHA256 a0bcb2523147215e66a126f8b69e578043c14fee3d72df085f54c53e0d3cfbd9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ChocolateyTabExpansion.ps1

                • Path C:\ProgramData\chocolatey\helpers\ChocolateyTabExpansion.ps1
                • Size 37KB
                • SHA256 1a9137de5f6b86e6bf4e478e7acdf95433107e010fed460faad88d94eabb50e6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chocolateyProfile.psm1

                • Path C:\ProgramData\chocolatey\helpers\chocolateyProfile.psm1
                • Size 15KB
                • SHA256 ed69cde7544efe46ecbc66b10edc55140e49cd2fa17f5ccf0e214d769e3cad2b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chocolateyScriptRunner.ps1

                • Path C:\ProgramData\chocolatey\helpers\chocolateyScriptRunner.ps1
                • Size 17KB
                • SHA256 859cfa5d9dc747a5bc5651331977beef2177cf8335a24a8f0a26d7965fd66944
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chocolatey.nupkg

                • Path C:\ProgramData\chocolatey\lib\chocolatey\chocolatey.nupkg
                • Size 5.4MB
                • SHA256 aec2dbd6ce91b7378eb4a0c21524e748d30332ea856e898404999f77328bd504
                • MD5 SHA1 SHA512 SSDEEP TLSH

                choco.summary.log

                • Path C:\ProgramData\chocolatey\logs\choco.summary.log
                • Size 147B
                • SHA256 1084e5ad87492eac7b60b13fd14639c453e24397d76fcc9f14736b674cfbf0e7
                • MD5 SHA1 SHA512 TLSH

                choco.summary.log

                • Path C:\ProgramData\chocolatey\logs\choco.summary.log
                • Size 415B
                • SHA256 ab0522f97aba791fd4b75bfa060547c4fe4853a2906eebbe70a00275c12dd148
                • MD5 SHA1 SHA512 TLSH

                chocolatey.log

                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 839B
                • SHA256 46ced4c39fe0324a6f0f0e8c498b7934a703f7cba32af9dc6da3e128ce43531e
                • MD5 SHA1 SHA512 TLSH

                chocolatey.log

                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 1KB
                • SHA256 77b006c479e52455cb1635bc726a7d42cf1d05275f354754c9dbd51dd018ef03
                • MD5 SHA1 SHA512 TLSH

                chocolatey.log

                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 4KB
                • SHA256 6b1c2c0f026fc5a6139b65e6e8ab47bfb619693f8f9f754501677858edd74e4a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chocolatey.log

                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 5KB
                • SHA256 2689122e2989c454992743434f3e4fabe19e19220c7f3ebaa27892635486992c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chocolatey.log

                • Path C:\ProgramData\chocolatey\logs\chocolatey.log
                • Size 11KB
                • SHA256 225d763942293a500833318d02f8e1c5d3ca80cf59bfa523f12e4fbed75d60be
                • MD5 SHA1 SHA512 SSDEEP TLSH

                RefreshEnv.cmd

                • Path C:\ProgramData\chocolatey\redirects\RefreshEnv.cmd
                • Size 5KB
                • SHA256 c22f5753a182443f8210905b3ae631ee6d7d711bc54003ec7510d23ba4e9e1b8
                • MD5 SHA1 SHA512 SSDEEP TLSH

                choco.exe

                • Path C:\ProgramData\chocolatey\redirects\choco.exe
                • Size 143KB
                • SHA256 a158ca956434a4c4cfa696a7dc3711b60b63bab60b5e1a3401ccbd6e28c875ba
                • MD5 SHA1 SHA512 SSDEEP TLSH

                choco.exe.ignore

                • Path C:\ProgramData\chocolatey\redirects\choco.exe.ignore
                • Size 2B
                • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                • MD5 SHA1 SHA512

                7z.dll

                • Path C:\ProgramData\chocolatey\tools\7z.dll
                • Size 1.3MB
                • SHA256 c6989259a78960805b8b646843d2ef3a8a19e5533359e8a252aad2f3cc78c844
                • MD5 SHA1 SHA512 SSDEEP TLSH

                7z.exe

                • Path C:\ProgramData\chocolatey\tools\7z.exe
                • Size 349KB
                • SHA256 285e5220d6d4240b6a4bdb6357d427e457313376e3464d3cb973637a384ed02a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                7zip.license.txt

                • Path C:\ProgramData\chocolatey\tools\7zip.license.txt
                • Size 5KB
                • SHA256 519ac0a4bded9c18ea02e0afb71f663d8c47373bd9facd3ac96a79f51d77765d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                checksum.exe

                • Path C:\ProgramData\chocolatey\tools\checksum.exe
                • Size 38KB
                • SHA256 3e45051aef3a7ffb711240719c0f3cc744dfc706e1e5e7fba608d65feb7922e1
                • MD5 SHA1 SHA512 SSDEEP TLSH

                checksum.exe.config

                • Path C:\ProgramData\chocolatey\tools\checksum.exe.config
                • Size 150B
                • SHA256 9b250c32cbec90d2a61cb90055ac825d7a5f9a5923209cfd0625fca09a908d0a
                • MD5 SHA1 SHA512 TLSH

                checksum.license.txt

                • Path C:\ProgramData\chocolatey\tools\checksum.license.txt
                • Size 95B
                • SHA256 29472b6be2f4e7134f09cc2fadf088cb87089853b383ca4af29c19cc8dfc1a62
                • MD5 SHA1 SHA512 TLSH

                shimgen.exe

                • Path C:\ProgramData\chocolatey\tools\shimgen.exe
                • Size 555KB
                • SHA256 50a349f3c15353bb9033c4e9d4660ebd9677667d6d3cd2951cf7429c4fb6084f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                shimgen.license.txt

                • Path C:\ProgramData\chocolatey\tools\shimgen.license.txt
                • Size 3KB
                • SHA256 d4d2ef2c520ec3e4ecff52c867ebd28e357900e0328bb4173cb46996ded353f4
                • MD5 SHA1 SHA512 TLSH

                choco.exe.log

                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\choco.exe.log
                • Size 2KB
                • SHA256 ff49c99d1003a4a1fe10810a0252dea199b17c3c5699020e0680e9af591b28a3
                • MD5 SHA1 SHA512 TLSH

                __PSScriptPolicyTest_ztcakbup.1gf.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ztcakbup.1gf.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH

                choco.exe

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exe
                • Size 11.5MB
                • SHA256 9c858d0b687607ff5c06601469a69e642e7b126fcc9ad3f94e58fd85694c44f5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Chocolatey.PowerShell.dll

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll
                • Size 38KB
                • SHA256 cee0d7b7841d758ddb04ac1fa783616fe81793ffba3717b3922d7561a52f046a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                chocolateyInstaller.psm1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1
                • Size 21KB
                • SHA256 4af7d8dcdba7335f96d4d7f9b7ab75b29a890380d8c7c35c59f60739db8a604e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Format-FileSize.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Format-FileSize.ps1
                • Size 15KB
                • SHA256 d47a44752fd6a983f9ab0e48aa8b12a2b0bc772ea0bb380c64723bb8e0b2ccbb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-CheckSumValid.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-CheckSumValid.ps1
                • Size 25KB
                • SHA256 5f88f0beaa6cce518833111f16b532e33f80ba3ea5b878c2690b4fc1218cf3b2
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-ChocolateyConfigValue.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyConfigValue.ps1
                • Size 15KB
                • SHA256 83eb927efcd495e15fd4ff5d043e1f0cf4b2dceded9aeb5a4af3db0cde2bfd8b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-ChocolateyPath.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyPath.ps1
                • Size 16KB
                • SHA256 18f1e1dc7ea4c3daae3fc51fd1373330c0132270180ed93bcac7a1d2843353f5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-ChocolateyUnzip.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyUnzip.ps1
                • Size 25KB
                • SHA256 bb77491d99fa16f09048e81a2cedc29f3e6397d0d166ba2f72317aca04347c25
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-ChocolateyWebFile.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ChocolateyWebFile.ps1
                • Size 31KB
                • SHA256 5a763e6f6895fb36c99c942c56b2e5860e316978ce61ffb6d5a4599b357eae4e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-FtpFile.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-FtpFile.ps1
                • Size 22KB
                • SHA256 a0d1fcec293a9d8b1340bbf54194884ef1c7495c3cbe9d4d5673edf2e5ccfb43
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-OSArchitectureWidth.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-OSArchitectureWidth.ps1
                • Size 16KB
                • SHA256 30f831b5189132d642edfd7cc9e4f44b11ae357652e1748073d94206544d4b77
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-PackageParameters.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-PackageParameters.ps1
                • Size 21KB
                • SHA256 d537580623ca8088692ad463e8913a83edb50963bd4b3b2b7b579e4e2b3b71f9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-ToolsLocation.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-ToolsLocation.ps1
                • Size 17KB
                • SHA256 10ef1bd8a810ee08f601a207ac83a4c7d9ebad1a4777378cf3749e3c56b98c48
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-UACEnabled.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UACEnabled.ps1
                • Size 15KB
                • SHA256 3f0c1c8c91696c6ae9c0e41589319d200d2c4bd16cabf4e2f1a11fc947a72f91
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-UninstallRegistryKey.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-UninstallRegistryKey.ps1
                • Size 19KB
                • SHA256 573fd644bee61bf85053989c7111be4a33223ce9bfd0ae5f95e05382fa08a1f5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-VirusCheckValid.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-VirusCheckValid.ps1
                • Size 15KB
                • SHA256 73d85aa2297033f106a0c8c3138efb9ad36f97ed108e040f12348fae94c56f74
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-WebFile.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFile.ps1
                • Size 28KB
                • SHA256 2dc9ae2d1de175e6b867ff89f84ba25d08dd5f41b84e2818318ca23f3eb5797e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-WebFileName.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebFileName.ps1
                • Size 23KB
                • SHA256 db062d9d09d7dae751e626bf97138eae6e9350112e2738cb3be9ef78dbdace1a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Get-WebHeaders.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Get-WebHeaders.ps1
                • Size 20KB
                • SHA256 1d15d738c319132c792ac6f8820f50ccb0fc32597e9c886746bcc31fcce2c683
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-BinFile.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-BinFile.ps1
                • Size 20KB
                • SHA256 767fd247f1f93cac6188ba1a0c3398b87cf3178e25ded4a16ced7e9bb3cd27f6
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyEnvironmentVariable.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyEnvironmentVariable.ps1
                • Size 18KB
                • SHA256 223f17f84d214c9fa9478817eff65a2681d505dfbfb6b81a2121e446e9614000
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyExplorerMenuItem.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyExplorerMenuItem.ps1
                • Size 18KB
                • SHA256 1e2fb44e0be817b5e16a03a30502c65f61dddc551bd3923ea571e3f83980e049
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyFileAssociation.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyFileAssociation.ps1
                • Size 17KB
                • SHA256 9c7c53d9ef8b902f60d5448adbe96fc1eda319c1dd6e6e7c8a4ffb3eb46c28db
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyInstallPackage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyInstallPackage.ps1
                • Size 28KB
                • SHA256 09e1973a0286c5912c7f233fce89b2efd9347efdd085869437d9fcbe69a5c5d7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyPackage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPackage.ps1
                • Size 30KB
                • SHA256 16b5df14198360715d06a5f12f2b1976d38e729bbe37748e0cbb17f57c4f367e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyPinnedTaskBarItem.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPinnedTaskBarItem.ps1
                • Size 16KB
                • SHA256 dba9b9e9329fa5d918b1e941dbfed9363a616033cdfcad4a0c60af9c41c4c4ac
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyPowershellCommand.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyPowershellCommand.ps1
                • Size 23KB
                • SHA256 aeee93f35724d656a73d1572522fe9b985fa1cae6978b0405398ef9327a1580d
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyShortcut.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyShortcut.ps1
                • Size 22KB
                • SHA256 3410aeb9bc5106b29f2c4cbc74c9febdc229c569153ddb1e41188a7396079a3b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyVsixPackage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyVsixPackage.ps1
                • Size 22KB
                • SHA256 4e982ce84c225c6870cc78120e5f85fb622756feff4c7e8eb7088473a2538620
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-ChocolateyZipPackage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-ChocolateyZipPackage.ps1
                • Size 24KB
                • SHA256 b0211091d5fe20e5e917855550eefb2961be6556a6f4f8a9c98619723a062cb7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Install-Vsix.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Install-Vsix.ps1
                • Size 16KB
                • SHA256 dad0ef31eb232c6c189e0ad947e62e71c5239bf2dad8f9d72a06cf3544a427a4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Set-PowerShellExitCode.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Set-PowerShellExitCode.ps1
                • Size 15KB
                • SHA256 fffb05319b00efb87d2705760ef351c11ad2b1913469635b980d386310bf0e1f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Start-ChocolateyProcessAsAdmin.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Start-ChocolateyProcessAsAdmin.ps1
                • Size 31KB
                • SHA256 694c4daed9add47d4ece4bd07568aa57dbc1f3316426f78ce5fd1ef2f2ce2625
                • MD5 SHA1 SHA512 SSDEEP TLSH

                UnInstall-ChocolateyZipPackage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\UnInstall-ChocolateyZipPackage.ps1
                • Size 16KB
                • SHA256 599ea45533dc1ab68a9646c6a88b71f4fc11a8669fa3ee8f41360435ca8816dc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Uninstall-BinFile.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-BinFile.ps1
                • Size 17KB
                • SHA256 f706530f0cdabb2f02c9d5b70d7de77d1f02fc4f6730c815ff8410dcf208b9fc
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Uninstall-ChocolateyEnvironmentVariable.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyEnvironmentVariable.ps1
                • Size 16KB
                • SHA256 c20b736bce859734c4497c6d5aaec13bfa3c201461cc02f48a7539fea54be59e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Uninstall-ChocolateyPackage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Uninstall-ChocolateyPackage.ps1
                • Size 20KB
                • SHA256 07ced451a144a7f6e3fd24d19bfcb2e2a5ea49a969a036754cb833dc2d2986cb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                Write-FunctionCallLogMessage.ps1

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\functions\Write-FunctionCallLogMessage.ps1
                • Size 15KB
                • SHA256 117e7bbfd11da2f5bd00f66aa004837dd774485e96334fb42b8ac537f4fb012b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                7z.exe.manifest

                • Path C:\Users\Admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\tools\7z.exe.manifest
                • Size 513B
                • SHA256 6b7368ce5e38f6e0ee03ca0a9d1a2322cc0afc07e8de9dcc94e156853eae5033
                • MD5 SHA1 SHA512 TLSH

                memory/2504-484-0x0000017B3EEB0000-0x0000017B3EF26000-memory.dmp

                memory/2504-431-0x0000017B21380000-0x0000017B21EF8000-memory.dmp

                memory/2504-485-0x0000017B23AF0000-0x0000017B23B0E000-memory.dmp

                memory/2504-445-0x0000017B3C410000-0x0000017B3C460000-memory.dmp

                memory/4556-193-0x0000018DCBD30000-0x0000018DCBD40000-memory.dmp

                memory/4556-194-0x0000018DCBD30000-0x0000018DCBD40000-memory.dmp

                memory/4556-340-0x0000018DCBD30000-0x0000018DCBD40000-memory.dmp

                memory/4556-190-0x0000018DCEAB0000-0x0000018DCEABE000-memory.dmp

                memory/4556-0-0x0000018DCBD30000-0x0000018DCBD40000-memory.dmp

                memory/4556-13-0x0000018DCBD20000-0x0000018DCBD2A000-memory.dmp

                memory/4556-12-0x0000018DCEAC0000-0x0000018DCEAD2000-memory.dmp

                memory/4556-10-0x0000018DCBD30000-0x0000018DCBD40000-memory.dmp

                memory/4556-2-0x0000018DCBC90000-0x0000018DCBCB2000-memory.dmp

                memory/4556-1-0x0000018DCBD30000-0x0000018DCBD40000-memory.dmp