Analysis

  • max time kernel
    9s
  • max time network
    880s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231222-en
  • resource tags

    arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/01/2024, 05:00

General

  • Target

    https://1fichier.com/?n6f0qzaudxj147z5rcyc

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce2be9758,0x7ffce2be9768,0x7ffce2be9778
    1⤵
      PID:1088
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://1fichier.com/?n6f0qzaudxj147z5rcyc
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
        2⤵
          PID:4616
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
          2⤵
            PID:3308
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
            2⤵
              PID:4368
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
              2⤵
                PID:4872
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:2
                2⤵
                  PID:4608
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5008 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                  2⤵
                    PID:4188
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                    2⤵
                      PID:4520
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                      2⤵
                        PID:4648
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2256 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                        2⤵
                          PID:3896
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4420 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                          2⤵
                            PID:4368
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5296 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                            2⤵
                              PID:772
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                              2⤵
                                PID:1176
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5020 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                                2⤵
                                  PID:2228
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5780 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                                  2⤵
                                    PID:1924
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5952 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:1
                                    2⤵
                                      PID:3104
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6028 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                                      2⤵
                                        PID:3480
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6016 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                                        2⤵
                                          PID:1848
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3296 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:2
                                          2⤵
                                            PID:1484
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                                            2⤵
                                              PID:2260
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=748 --field-trial-handle=1840,i,3112805244949873992,2096759737596474940,131072 /prefetch:8
                                              2⤵
                                                PID:1700
                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                              1⤵
                                                PID:5048
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:4960
                                                • C:\Program Files\7-Zip\7zG.exe
                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\game-calico-(48136)\" -spe -an -ai#7zMap32309:100:7zEvent16371
                                                  1⤵
                                                    PID:3244
                                                  • C:\Users\Admin\Desktop\game-calico-(48136)\setup_calico_1.0.12_(48136).exe
                                                    "C:\Users\Admin\Desktop\game-calico-(48136)\setup_calico_1.0.12_(48136).exe"
                                                    1⤵
                                                      PID:3596
                                                      • C:\Users\Admin\AppData\Local\Temp\is-HBILB.tmp\setup_calico_1.0.12_(48136).tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-HBILB.tmp\setup_calico_1.0.12_(48136).tmp" /SL5="$20320,455801775,192512,C:\Users\Admin\Desktop\game-calico-(48136)\setup_calico_1.0.12_(48136).exe"
                                                        2⤵
                                                          PID:2332
                                                          • C:\GOG Games\Calico\__redist\ISI\scriptInterpreter.exe
                                                            "C:\GOG Games\Calico\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Calico\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Calico" /productId="1167578660" /buildId="54522520289383220" /versionName="1.0.12" /Language="English" /LANG="english"
                                                            3⤵
                                                              PID:2656
                                                              • C:\Users\Admin\AppData\Local\Temp\is-UBEG1.tmp\scriptInterpreter.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-UBEG1.tmp\scriptInterpreter.tmp" /SL5="$10384,662929,192512,C:\GOG Games\Calico\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Calico\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Calico" /productId="1167578660" /buildId="54522520289383220" /versionName="1.0.12" /Language="English" /LANG="english"
                                                                4⤵
                                                                  PID:1496
                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                            1⤵
                                                              PID:4644
                                                            • C:\Windows\system32\OpenWith.exe
                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                              1⤵
                                                                PID:5028
                                                              • C:\GOG Games\Calico\Calico.exe
                                                                "C:\GOG Games\Calico\Calico.exe"
                                                                1⤵
                                                                  PID:1964
                                                                  • C:\GOG Games\Calico\UnityCrashHandler64.exe
                                                                    "C:\GOG Games\Calico\UnityCrashHandler64.exe" --attach 1964 1973712457728
                                                                    2⤵
                                                                      PID:1564
                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D0
                                                                    1⤵
                                                                      PID:484

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

                                                                            Filesize

                                                                            30KB

                                                                            MD5

                                                                            bb8fc6a24d42de2b2a3d82cceac4c387

                                                                            SHA1

                                                                            4ddb0861ceb1d8bc3ae1769e34742dbf35eeee67

                                                                            SHA256

                                                                            fe83206c38ace49fab2130768433bb1742d77dbafeac664bb2b97b72b184f04c

                                                                            SHA512

                                                                            44d33bb9b0d86147e6a858b17df14d9e8b25fb1b979de611ab67ecaae3caab657d79a8eb5c058f37650f43b7f8a24b6735cf2e9fc2683888c4ad660c0d2ea07f

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

                                                                            Filesize

                                                                            27KB

                                                                            MD5

                                                                            85b64092e29f214cb15259728217729d

                                                                            SHA1

                                                                            7d40282880e9b86cc2b12a3bed6e86fa9a735a5c

                                                                            SHA256

                                                                            e9b64a70b323b0abd48c01a9488eb33062ae4cd586747ca8eb440547dfc81806

                                                                            SHA512

                                                                            55ed4f4ee43d04cc77ad43c9d28d0bcfdeedc51af52168b612988bd2a729254e4edf391096c2af8592ec95c4b6f62ffa6a8eea73bf38e31f52de873e7db5eccb

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

                                                                            Filesize

                                                                            16KB

                                                                            MD5

                                                                            9c6b5ce6b3452e98573e6409c34dd73c

                                                                            SHA1

                                                                            de607fadef62e36945a409a838eb8fc36d819b42

                                                                            SHA256

                                                                            cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

                                                                            SHA512

                                                                            4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            744B

                                                                            MD5

                                                                            edf95addb74fe6ea249ed6ebbb463086

                                                                            SHA1

                                                                            9130c4fdd71263eeb9b56a610cf4c2914a84d9e8

                                                                            SHA256

                                                                            d852c6234e1b08311f57e2edb1c20f95c7ee26f43b017102fd29a73f28403416

                                                                            SHA512

                                                                            7adfe6afee7a6c9bbcfe2567bc333941f776c132aaba2708b7e69aa38afba4d2e09f3aa9024795e2a2a10373f04a1036ab65f811d1ab80d69f7e9700065892a8

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            360B

                                                                            MD5

                                                                            973e3d469845caafed2495b0c2fa8861

                                                                            SHA1

                                                                            45898f315bc4b03796c0187c4bfebe094c3b4223

                                                                            SHA256

                                                                            7074b63b194149e6a86df28a46f957a800afd963188906e32c846e479a78a2d1

                                                                            SHA512

                                                                            1d59eab9103915bb468fbf82d0650df359d2dcbc27d690210cf7608f916ad16d707dfb6cf87e97fb1fad979baa468a7755b09f854022aebeced59c37b9881b13

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                            Filesize

                                                                            744B

                                                                            MD5

                                                                            f0b39a89e717753c415cbc191c085a23

                                                                            SHA1

                                                                            cfffb6414e67950162608d1272b20b992d5097e3

                                                                            SHA256

                                                                            d571ef53cbd592e1d3fa705289c7a1aafef112aa2e95e6c4409c3b00bf308c7e

                                                                            SHA512

                                                                            60eb6e543326bc76c83c96f2cabd423da67134120448293d7cc3dd388c174d1bf8a67c0d53f3ddf6413791c82760d9199cbd25a5eac8aefbd48321d401baee55

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            11e943aab6044f9819ad4da13feb252e

                                                                            SHA1

                                                                            2354d133d1d061f407223d5b80603f25dbdca8d9

                                                                            SHA256

                                                                            95893b971067a2456268e9634351448b84b8a9bada60ac65b3c79fe56a5eb931

                                                                            SHA512

                                                                            a852c4bc5a36f2d1aa6f131a279b49f3b93f489346963ed5d1a956677d9f10919bd559d167dfc1d36607bae2c3b728480fb05849031c5fe81d71ce4386d457dd

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            a89b97fa0250874f2595c522086ef493

                                                                            SHA1

                                                                            3ff14b8c48695dcfbd199b0375467cc2b6648aaa

                                                                            SHA256

                                                                            0f68a0793a1076bb99e8cfb7efbd464ef1e61947d7bade0bed7d7bc4697c7faa

                                                                            SHA512

                                                                            ef82d620b0d8165cc9833b58bc6d498b2d646ce470284edb70c2fa7ce6883bbec7a590e22c1da59c667fdb623aac9dfb82e51196ff215697bfae74019f7082e3

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            1714380c4889050be438da0ef4feedbe

                                                                            SHA1

                                                                            f948d5fc3a1040b13883cc89f56755a5f81f7850

                                                                            SHA256

                                                                            3b1fdadc42db727aa037027302a91b6acd0583112bfca0d5fde8345635623886

                                                                            SHA512

                                                                            ee26382e87f09d30327985e20c7c40c0d21c87933a9d16145ae1eefdb55b73c9856a242837c28da4254ab4460bf5f4d35003171448567eb364b9c326f85213d2

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                            Filesize

                                                                            538B

                                                                            MD5

                                                                            e08b0d83fc0810e39bfabdf4c0062dd1

                                                                            SHA1

                                                                            c8ec822066a78a9c9b1ede38c38ca85869355705

                                                                            SHA256

                                                                            8a0204a33653c733039373d29aee7a00f1b3bf002d816664f65d0c6a18d40b9e

                                                                            SHA512

                                                                            5809d541d4c210ce45af53f8659bd69a486e515a9403d279f7621d02c9e194e264e2045ee35c365d10b8987bd291a6d36aff032159036ef6a4a780d3a9e911fd

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                            Filesize

                                                                            705B

                                                                            MD5

                                                                            86281e8bccbaa6c90573f19d72ced9a4

                                                                            SHA1

                                                                            119c13742f63338e79e91b54ccbc5e90bce26e9d

                                                                            SHA256

                                                                            5cd4c28715a0e833a5a31d4978d688da8333a78059ce6b6aafc96006728eb71c

                                                                            SHA512

                                                                            b7aef8315d0774d1ae6e7d66890290dac0c10184e376b44355838480369fd3c4c975f0661dd580a14cf21014911bd5da0f73476591a60b23771f2ba148fecebc

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                            Filesize

                                                                            705B

                                                                            MD5

                                                                            eda2b5e8985ca77c984b4846e6eb1054

                                                                            SHA1

                                                                            7fc73a76e9f8c016757a2819ae4930981e53287a

                                                                            SHA256

                                                                            9eda8bc92ce8abaec65ec0eb965ae8b1db3a434188bd5dd853acb08cdfc3c46e

                                                                            SHA512

                                                                            caf224faa9688444033a45d5c87351411a39291c6c5e1d1c420f990db8ee7f3fbc1fd7ff23b8ea33d46a4ca13df2ecdb5fad1c8d7043cf02d9e4d42e5a5842c0

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            185a1f560b9abc2d21e8a05911ec1447

                                                                            SHA1

                                                                            414b35fad6c2984e249a3a4f80f287309496d906

                                                                            SHA256

                                                                            bcff37901cea0f8fa6beafdf364801c03ebc369775ab605dbf363bde65d56d50

                                                                            SHA512

                                                                            71dc5c60c4d4b80b3b93a1d9a31a56bc6cbefe7ae9337534c61fb627a244fd556b152942be8700b66c2a89221d93564a65677530af8a5eae83a5705235b8c57f

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            4a25238bf1d0fb6c16f76c0169a905a3

                                                                            SHA1

                                                                            e7f7364dbf8275a564ee1e912756435e06eebaac

                                                                            SHA256

                                                                            785aa1f140f29fffc9da26031d6d8bcbea8e22199815dfed2273c642a7742f44

                                                                            SHA512

                                                                            a06be7149f92486b1f4359fd736c5006c80fba5e3cdbf8f8cdb72df6fdb3801bd9720d45945c7cdcdde272e513487464243650801625d139ec5766410672f76c

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            b29073dd6e9facd8ba171d5ad47f6025

                                                                            SHA1

                                                                            5cd2537e451ba05a973ddde9f6507178986015d1

                                                                            SHA256

                                                                            213e0737517445ca41d4d041e38deb6a25cc119eaf59a245bd500350c1ed90d1

                                                                            SHA512

                                                                            aaefa67bb36cdc8f14b48127740ae3d756767bbdd5d19250d77c867c6fc5d518b41db8008c6e3464fad161fe534b5cbea97ac1ab8ecb6fda2c2f4d83212879c4

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            e4d4f3550545177214a94ce58b452c79

                                                                            SHA1

                                                                            46df92f284832a19b4d6019645fba28779a386b0

                                                                            SHA256

                                                                            77436b65306a3e656be889330564c343ba3d9d87039e5d9ea439e15849e4b015

                                                                            SHA512

                                                                            f20fde7ea79fdd6b378f9595a9c1b13288789d9346387a0dd3b417cda9c5642cecab1ee0208b61ba5a550ffe18ae094801a3b1ead0b22d4781f6f26f094660ff

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            b55ddf227293d56f6823dd843bc20e6b

                                                                            SHA1

                                                                            da9ae630668b0cd7efbfce7b973c00c9969b6194

                                                                            SHA256

                                                                            7d49fce3e022f1baadd6f7141752a57f2c82f8fe8b14b0171f54123efb7f1b8b

                                                                            SHA512

                                                                            12d72384ba78ebe905571b23d67acd05124013e125d001d9bcc7d77a989d297c6901d35c4ebca45f71c9f1872f9b1f204019b7798b464e20955d88cd3bae963d

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            3b2b247036f3d92266862eff364b213d

                                                                            SHA1

                                                                            04e93f383ad7a5ccb36f6c4e8661e909421cf08b

                                                                            SHA256

                                                                            b0ad4f2d9b2a61a5b30a9ac9d837f0ff3573da37145443f7c22f819892598c24

                                                                            SHA512

                                                                            79dae42e4e104c19d69d6668ea7c5268af7665930c2b87847899f73b8dd911f84b71194bbee0526d6e53a2eee773c65cfa546376aee9475394d562d7af716985

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                            Filesize

                                                                            6KB

                                                                            MD5

                                                                            12ba6cfbb06a2aaafa3a3276e4a3a577

                                                                            SHA1

                                                                            2e593b17242930ed0a0667bbe0a61928ace59508

                                                                            SHA256

                                                                            1e70c815c2126489b07b34a6eb17cbe6b6f1c0856e8963e63d24fc704afcec0d

                                                                            SHA512

                                                                            c495d44263c3083790c63624504bc876530203dab61e4042faa3b8577bdd4b5c3df2e41b228e04da02ac20ae06ff4e8fd40685a825046403ba8e6fa27c1ab160

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                            Filesize

                                                                            114KB

                                                                            MD5

                                                                            224093126c8df1f9579ae64651f0fc36

                                                                            SHA1

                                                                            818ce764ec22f39045e878f581775f1381d16c3f

                                                                            SHA256

                                                                            3e324d7e902202c27dbd565b56109a4fd62300c992f2e0b3b98fb3a742926fa0

                                                                            SHA512

                                                                            84850b5b9ffe3076bb2573230ec98d3bd7b30055ea0c5605a3dcbf14916fb201b629255653b0152bdddac7c4f47a4db1eec3b6e0a3df6c469d60b987dcc8b3fa

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                            Filesize

                                                                            114KB

                                                                            MD5

                                                                            240833885fa16d4b050e13a3539e8740

                                                                            SHA1

                                                                            42fed3e536a5b4350b545294883cd2cd0a8a5041

                                                                            SHA256

                                                                            0c3ffa333d1eb015ddbe0b709304f85509fd295cb94394a60a1919bc7d393992

                                                                            SHA512

                                                                            49765ddddea2c7ae43a738224cd605f5fd407b913d66b92af029858250d365ac8516eaba7cbe4fa1eb710684b715ca5d886c8796e32a9f24c2972dd210c9c013

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                            Filesize

                                                                            98KB

                                                                            MD5

                                                                            3a2e6564a39f52d45140253fffc971c0

                                                                            SHA1

                                                                            f6367faab5ebbb527f7edc573c3d952818f6cee6

                                                                            SHA256

                                                                            9c5f8121ff92c638cb6230f527eb453ab39ac20a9e5383d2f841aee73f4a329c

                                                                            SHA512

                                                                            5dfdef1a5850fab982e228f0fde53f3be60411d720646d95ccd4e189751457076a6a096f9ca365c31d3ef9c86bd932f104bdbaa7ecbad569b3024047d7170f60

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                            Filesize

                                                                            103KB

                                                                            MD5

                                                                            2de2ce20a045a0efe77e27ac7f54a5e6

                                                                            SHA1

                                                                            4cecd8e837b28f43eb2a2fa2a19d0f57cc5bc288

                                                                            SHA256

                                                                            2a5e01a63725556b6a194ccfab9d53a7087708bf3f9ca22193793c45e6308fef

                                                                            SHA512

                                                                            68aecd4bb25edb8303fcb80f7dd621d9b12f635b55f5d3cf7e0d375949727767bbf221f51957849df1e08fa4e6399071bd49d512a9b82f22ca7aa005a7c6bfa4

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58b87d.TMP

                                                                            Filesize

                                                                            93KB

                                                                            MD5

                                                                            d9d56410cfb883011b949cc7e02039f6

                                                                            SHA1

                                                                            bbedb51386065230eda510afd7e9d0363ce5273c

                                                                            SHA256

                                                                            116039b062acd961e5bae3e3a04ee832c910b1f788ef566fb2026cb138a5ab50

                                                                            SHA512

                                                                            9f8a23312fc2e2944deac7bc63c4c63b4503de74c441d3a24918bb47a8874df583e57c8c7bed34a818a980335df423b23becf1bd580e377061cfb73c813da9ca

                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                            Filesize

                                                                            2B

                                                                            MD5

                                                                            99914b932bd37a50b983c5e7c90ae93b

                                                                            SHA1

                                                                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                            SHA256

                                                                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                            SHA512

                                                                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                          • C:\Users\Admin\AppData\Local\Temp\is-HBILB.tmp\setup_calico_1.0.12_(48136).tmp

                                                                            Filesize

                                                                            92KB

                                                                            MD5

                                                                            6515391ea35b33d39bb73ed48deed337

                                                                            SHA1

                                                                            3185b798a7a46c08982a8248904f1296df960a25

                                                                            SHA256

                                                                            bf572cc8d18dcbd148445bf4e925cbe0fc595de3e6d9cc13b60fe5410a736d0e

                                                                            SHA512

                                                                            d04ee383ce4c62b09ec6531bd0d6c69e29c1149f3bfd2598482cfe06f9d45395dd8b741b61add84e34aa3bb362d984caadf9b380ea5a17da1376c688580bffc3

                                                                          • C:\Users\Admin\AppData\Local\Temp\is-SKG0M.tmp\track_center.png

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            3f2b0c22f8ea28dcbb82b39a16a039aa

                                                                            SHA1

                                                                            b3f4dfc2ea86fbdad05877b4c356b7fa8016731d

                                                                            SHA256

                                                                            794f9eeca7fd99846968376b76a296c927532cef1271325cbf555caa0d0d5860

                                                                            SHA512

                                                                            b4bf65d751717e85418947662d315ae3bcb177f60914832fefeeb95da9eddb75eb5531c62e5a5a70ff03c8a025b5a03e61ffbdecc9f483bea9684454ca9362d3

                                                                          • C:\Users\Admin\AppData\Local\Temp\is-SKG0M.tmp\track_left.png

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            55dacb00cbe2825a8540236c5777a205

                                                                            SHA1

                                                                            18a52ac6c741b558500fbc1716d46b4fe4471982

                                                                            SHA256

                                                                            a8340fb5380c922b60ea40043590dba067dcfed6e22636851691df38156a3aa8

                                                                            SHA512

                                                                            2ea444cc1080f20761c8d71d96fcd04ef48254cdc1dc41d1d139f459ea5613fe12f6e4bd026bf33a5c01ff038e72e05dae2f8fba33ff517dd395e1911f10ff10

                                                                          • C:\Users\Admin\Desktop\game-calico-(48136)\setup_calico_1.0.12_(48136).exe

                                                                            Filesize

                                                                            384KB

                                                                            MD5

                                                                            eba19a6981f64fe16473e56d7b94dc7c

                                                                            SHA1

                                                                            d970d52ab8152bc5b9a3af3ace6da353eb611958

                                                                            SHA256

                                                                            02cc877808a06adba2767b8a6e38d173f5db2de2e6f6f56d5ac775bae642dbd7

                                                                            SHA512

                                                                            0e955535ea376a1d84740544284d341b7a4e2a52bb44b061941a51d92f67010b388f256bc8d91e236c166b42f69cecec4f0592dbf37d0462b9fddf9ca4162863

                                                                          • C:\Users\Admin\Desktop\game-calico-(48136)\setup_calico_1.0.12_(48136).exe

                                                                            Filesize

                                                                            381KB

                                                                            MD5

                                                                            b499cf91f6626b3d7c9f9a50e8365658

                                                                            SHA1

                                                                            bb5c71ee588c913d120518667665bcd9a1a12ec9

                                                                            SHA256

                                                                            0b127c0cc8c94174c95c4de140d65bb4634644db0434d3b35584093c3a90b654

                                                                            SHA512

                                                                            f11536dfb8c95524c3c27b5af66ed11ca74b1632f07b4f46038f0d18699a080904995a31674356102c91e1571290dded9a0301a429fbe906ab68265b923ccaa5

                                                                          • C:\Users\Admin\Downloads\game-calico-(48136).rar

                                                                            Filesize

                                                                            92KB

                                                                            MD5

                                                                            8a5ed6a71153eb836792f4393ec7d42a

                                                                            SHA1

                                                                            6b4bf7fa21fe4c0490b9c2823c9aba620583023b

                                                                            SHA256

                                                                            f5eddbcf5b46ba173c7ac2ba2c5d67143c59392c5a1a389798d904f5b3d0a2a1

                                                                            SHA512

                                                                            892c1a8c008e5dce2c43064e59383df58b1a8480fae9b9322b73037d50dd9313f554798cb66567df15f3a0b7ddf744a71483565d01b7ae0b1998a8e91c194fe1

                                                                          • memory/1496-1788-0x0000000001290000-0x0000000001291000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                          • memory/1496-1869-0x00000000032E0000-0x00000000032E1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                          • memory/1964-2035-0x000001CD717E0000-0x000001CD717F0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1989-0x000001CD717D0000-0x000001CD717E0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2023-0x000001CD717D0000-0x000001CD717E0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2022-0x000001CD4E480000-0x000001CD4E490000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2012-0x000001CD70860000-0x000001CD70870000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1993-0x000001CB8A820000-0x000001CB8A830000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1994-0x000001CB8A710000-0x000001CB8A720000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1995-0x000001CD4E470000-0x000001CD4E480000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1996-0x000001CD707E0000-0x000001CD707F0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1992-0x000001CD707C0000-0x000001CD707D0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1975-0x000001CB8A820000-0x000001CB8A830000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2040-0x000001CCABF10000-0x000001CCABF20000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2036-0x000001CD71880000-0x000001CD71890000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2037-0x000001CD707C0000-0x000001CD707D0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2038-0x000001CD707E0000-0x000001CD707F0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1991-0x000001CD71880000-0x000001CD71890000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1990-0x000001CD717E0000-0x000001CD717F0000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1987-0x000001CD4E470000-0x000001CD4E480000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1988-0x000001CD4E480000-0x000001CD4E490000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-1976-0x000001CB8A710000-0x000001CB8A720000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/1964-2039-0x000001CD70860000-0x000001CD70870000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/2332-769-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-910-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1379-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1778-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1062-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1787-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1783-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1782-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-394-0x00000000027F0000-0x00000000027F1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                          • memory/2332-1818-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1821-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1825-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1828-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-396-0x0000000000860000-0x00000000009B2000-memory.dmp

                                                                            Filesize

                                                                            1.3MB

                                                                          • memory/2332-1002-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1868-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1882-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1883-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1889-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-399-0x00000000027F0000-0x00000000027F1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                          • memory/2332-983-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-1096-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-871-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-829-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-794-0x00000000048A0000-0x00000000049A0000-memory.dmp

                                                                            Filesize

                                                                            1024KB

                                                                          • memory/2332-602-0x0000000000860000-0x00000000009B2000-memory.dmp

                                                                            Filesize

                                                                            1.3MB

                                                                          • memory/2332-595-0x0000000004E40000-0x0000000004E4E000-memory.dmp

                                                                            Filesize

                                                                            56KB

                                                                          • memory/2332-572-0x0000000000860000-0x00000000009B2000-memory.dmp

                                                                            Filesize

                                                                            1.3MB

                                                                          • memory/2332-573-0x0000000002FC0000-0x0000000002FD5000-memory.dmp

                                                                            Filesize

                                                                            84KB

                                                                          • memory/2332-574-0x0000000004AE0000-0x0000000004B97000-memory.dmp

                                                                            Filesize

                                                                            732KB

                                                                          • memory/2332-575-0x0000000004E40000-0x0000000004E4E000-memory.dmp

                                                                            Filesize

                                                                            56KB

                                                                          • memory/2332-570-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                          • memory/2332-473-0x0000000004E40000-0x0000000004E4E000-memory.dmp

                                                                            Filesize

                                                                            56KB

                                                                          • memory/2332-426-0x0000000004AE0000-0x0000000004B97000-memory.dmp

                                                                            Filesize

                                                                            732KB

                                                                          • memory/2332-419-0x0000000002FC0000-0x0000000002FD5000-memory.dmp

                                                                            Filesize

                                                                            84KB

                                                                          • memory/2656-1872-0x0000000000A00000-0x0000000000A39000-memory.dmp

                                                                            Filesize

                                                                            228KB

                                                                          • memory/2656-1780-0x0000000000A00000-0x0000000000A39000-memory.dmp

                                                                            Filesize

                                                                            228KB

                                                                          • memory/3596-1954-0x0000000000010000-0x0000000000049000-memory.dmp

                                                                            Filesize

                                                                            228KB

                                                                          • memory/3596-395-0x0000000000010000-0x0000000000049000-memory.dmp

                                                                            Filesize

                                                                            228KB

                                                                          • memory/3596-387-0x0000000000010000-0x0000000000049000-memory.dmp

                                                                            Filesize

                                                                            228KB

                                                                          • memory/3596-389-0x0000000000010000-0x0000000000049000-memory.dmp

                                                                            Filesize

                                                                            228KB