netsupport | hxxps://virvatulishop[.]com/labda[.]zip

Resubmissions

09/07/2023, 06:15

230709-g1ee9aah7410

09/07/2023, 06:15

230709-g1cawsbf6x

09/07/2023, 04:36

230709-e8dsksag6710

Analysis

max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://virvatulishop.com/labda.zip
Sample230709-e8dsksag67

Score

10^/10

netsupport rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133333509980101526"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4468	client32.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2064	4008	chrome.exe	76
PID 4008 wrote to memory of 2064	4008	chrome.exe	76
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 4628	4008	chrome.exe	86
PID 4008 wrote to memory of 984	4008	chrome.exe	88
PID 4008 wrote to memory of 984	4008	chrome.exe	88
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87
PID 4008 wrote to memory of 2848	4008	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://virvatulishop.com/labda.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7db69758,0x7ffa7db69768,0x7ffa7db69778
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5088 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1880,i,14315471182121855157,2605518836509833452,131072 /prefetch:8
  2⤵
  PID:2768

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4400

C:\Users\Admin\Downloads\labda\client32.exe
"C:\Users\Admin\Downloads\labda\client32.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

99c73909-0e93-431b-8ca5-6990f11c821c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\99c73909-0e93-431b-8ca5-6990f11c821c.tmp
Size 89KB
SHA256 1a8ae286271f3412ba4d1e0b1a4f69b3e187b8f5aab23206a0f37522e282b139
MD5 f844a702bdb19d14d5ae41fbcd638e66
SHA1 fbbbcade0dd527b2c46707b91c04b7d5fc384789
SHA512 065e42368486840fde91bfff8458f305d4ae62eccaf4f8fc5edfeb43d947c0c3a4a42edd4080f0da2f98a807d6094b1a5a68aad440c03f9f0fa3b79f629a84eb
SSDEEP 1536:E/0F7wh4WJK9sHAi/quHrOvKs6BIK2P0bRMPJU+2obeVzAVuo:E/0FQ4Wl3/quHKvx1K2P9wjV3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7d936af6a747c6b1eebc9bb2d31d151060f99fae96a2798e5bcdce8def0b0f47
MD5 8cafccde40e76f5e3eb95de386fff9df
SHA1 6f00b74e33339e9a27ee8ebe671e8f4cd9b68643
SHA512 2c0d93bb7eaaeeb7b06eccc7fc006e69e5a216edfcca942339f45cbc30f7dfd5cacead49f971dfcfb08c728890372a31ac4fcac06d333ca613492a485bcd52ed
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 eec0e15b57ff4f42c988f3d9523eb55d92bb6b9380ca1ca38f3b2f41bc47a9ef
MD5 e618dc1f111e67636e0bb4055d1d2b4a
SHA1 2e9b522e5095142ad2041781dd6ecc98c4e1504f
SHA512 a85d42a7230e039b7897ff0166d19ef2db5ade62a04afc3fd2021346ace6898dc4264fb045849b613c0824b488f4a764ba4cdb3d4cc76faca4a9a7834da2e0ae
SSDEEP 96:I1aTqXKmpXFXNvXowOPNdKI0oEE8iZRy7Di+6Msmde3IOVpr+EDsjVhYtjEsXt0P:4tpZNvoPNdT8syy+Fe0otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 2f880f5f3278938f1ae935965b322bc26b9a274a92755a75fdbbe1f122412a49
MD5 62f8e5f982baf4533ea82e44c09cbf4a
SHA1 81d94d712022b6c75aa8600ce9c1739fc2fcb76b
SHA512 0b611d20f60d9d4959f84ef8b90e0263491fd23b54e40dcbde807fc17217a509283315427d5c351cd33ddc30895d8291906cc9ae410b9fe4148f81ed51c9fd2f
SSDEEP 384:X1LPLemXb1kXqKf/pUZNCgVLH2HfkSrUiHGCGjyxI:lLPLvb1kXqKf/pUZNCgVLH2HftrUiGC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 174KB
SHA256 62736e0a7205fad21697c2c4f3fe0fdd7ab9b1d3f3123e3eb1c4ae27823adb5e
MD5 aa7ee546027a9c3a280da65f51fa0660
SHA1 ec5afa3feb299122aa1306ec5442f1de5f524ad2
SHA512 734189e46311be826eaf61e00b247e6da5d331ec86ffc373b893cf3dfac26916ca18739285ef07dd83ac6654aed6dfb1b688a2766ed7a016bdf7b12f0bc54235
SSDEEP 3072:RNYcEhe4CW2aSpQlcY0cnwN/0FQ4Wl3/quHKvx1K2P9wjV3S:RKcEhexWDk3OIyQ4GGx11P8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 174KB
SHA256 2a680c7bd5d892325ffe6b6c4fed465c618719207972ea9da83304032c21f79a
MD5 bfb7b35efb9ba51c8bf069a8b91a4067
SHA1 4622268c100dc8b64c0713dde495d1924d442413
SHA512 04d611f7be6a27a61e4d3f0b9b3dbe8c0139c23099eb7fe3b136e19d7a66eadbd78103d168b238f2e7b605a9e4d7b58fd08b5b3dd534a383686ab3b6f8e7a2e3
SSDEEP 3072:33dFYcEhe4CW2aSpQlcY0cnwN/0FQ4Wl3/quHKvx1K2P9wjV3S:ndCcEhexWDk3OIyQ4GGx11P8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 1886262986b70943558def3a65a4ed2504f074161a870bfe853a6921223ece73
MD5 5278c683edc0fe5f01e3e1559eb8e9b2
SHA1 636d3b99ccac15df7c0e9fd38033393b57bf362b
SHA512 9e6465ff6040fe3d0fabd9ebe925eb6f6979ffe68a3db4fe5798edfd5b6a2720e9b8e779a570fcf7da0edcbb0389e4ad4c72d29996b725cbb72f2e233b36f719
SSDEEP 3072:3YYpFMvYwdOYcEhe4CW2aSpQlcY0cnwN/0FQ4Wl3/quHKvx1K2P9wjV3S:pFnwdtcEhexWDk3OIyQ4GGx11P8i
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

labda.zip.crdownload

Path C:\Users\Admin\Downloads\labda.zip.crdownload
Size 2.1MB
SHA256 0dcbc734569aab3ad253b1dbfeb73709a75e57d4c0a3bd06b340544431bb07aa
MD5 59936db1ad6f595607d9af20ed1ef6fa
SHA1 f4830530f524f7cb5c202cc3ecf832a2c9071918
SHA512 c326ef9dd6eea41b3e25642c2b0dfa3e544e2b97452600f4554eb98c63c7e9d444e07ee17e66be639a030b968b15e5f8d086c0601febf5e3a6e33225106db846
SSDEEP 49152:LSy5w12YQfwHlxT6s8/rJVs++wrXC/RuCuRLdMQMfba3DQgS85PWZ5FvcB7K:Gb1Efwz6x/lOyr89cdxD1zP+U2
MD5 SHA1 SHA512 SSDEEP

Submit Download