f1884f8ba3dca8b46c0a6afb7a7cb760725729be841e11f7358935e418b3bf56

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 24.1MB
Sample260825-18aa2ser2v
SHA256 f1884f8ba3dca8b46c0a6afb7a7cb760725729be841e11f7358935e418b3bf56
MD5 a7b29a10c2b9e0f13b686dbc0e7adf43
SHA1 cd7c94679556c2fb73d25ee0d8ef577c645aae1f
SHA512 28b0545b90161ce399fd73954467c1e62d43145469d4fa852ccb143be33beb8cf0c379894e9e7dac6be0b4d8080bb55e8311b05bbb880b52e555fdc43a68c829
SSDEEP 196608:CpYziqeLfUszsYi1NcVr+aZnhQR0KJNTTH1/El+e9p3wOT0q:CpYzgqD16HZhQqKfT0+S3wOIq
TLSH
T1144729257A5A996CC05BC074C38B8A734A7130CA0B35B9FF549492792F7EAF42F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5988	Decompiler.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_223097069\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_223097069\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_223097069\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_223097069\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_223097069\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_916832435\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1497198230\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1497198230\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2704_1497198230\manifest.json	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2140	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321701020210639"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4660	Potassium.exe
4660	Potassium.exe
4660	Potassium.exe
4660	Potassium.exe
4660	Potassium.exe
4660	Potassium.exe
4660	Potassium.exe
4660	Potassium.exe
2988	msedgewebview2.exe
2988	msedgewebview2.exe
4284	chrome.exe
4284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2704	msedgewebview2.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4660	Potassium.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2704	4660	Potassium.exe	89
PID 2704 wrote to memory of 5092	2704	msedgewebview2.exe	90
PID 2704 wrote to memory of 2936	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 2936	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 2936	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 2936	2704	msedgewebview2.exe	91
PID 2704 wrote to memory of 2476	2704	msedgewebview2.exe	92
PID 2704 wrote to memory of 1352	2704	msedgewebview2.exe	93
PID 2704 wrote to memory of 1352	2704	msedgewebview2.exe	93
PID 2704 wrote to memory of 1352	2704	msedgewebview2.exe	93
PID 2704 wrote to memory of 4828	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 4828	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 4828	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 4828	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 4828	2704	msedgewebview2.exe	94
PID 2704 wrote to memory of 800	2704	msedgewebview2.exe	98
PID 2704 wrote to memory of 800	2704	msedgewebview2.exe	98
PID 2704 wrote to memory of 800	2704	msedgewebview2.exe	98
PID 2704 wrote to memory of 3612	2704	msedgewebview2.exe	99
PID 2704 wrote to memory of 3612	2704	msedgewebview2.exe	99
PID 2704 wrote to memory of 3612	2704	msedgewebview2.exe	99
PID 4660 wrote to memory of 5988	4660	Potassium.exe	100
PID 2704 wrote to memory of 2988	2704	msedgewebview2.exe	105
PID 4284 wrote to memory of 5172	4284	chrome.exe	107
PID 4284 wrote to memory of 5940	4284	chrome.exe	108
PID 4284 wrote to memory of 5940	4284	chrome.exe	108
PID 4284 wrote to memory of 2140	4284	chrome.exe	109
PID 4284 wrote to memory of 252	4284	chrome.exe	111
PID 4284 wrote to memory of 252	4284	chrome.exe	111
PID 4284 wrote to memory of 800	4284	chrome.exe	112
PID 4284 wrote to memory of 5428	4284	chrome.exe	113
PID 4284 wrote to memory of 800	4284	chrome.exe	112
PID 4284 wrote to memory of 5428	4284	chrome.exe	113
PID 4284 wrote to memory of 4076	4284	chrome.exe	114
PID 4284 wrote to memory of 4076	4284	chrome.exe	114
PID 4284 wrote to memory of 4496	4284	chrome.exe	115
PID 4284 wrote to memory of 4496	4284	chrome.exe	115
PID 4284 wrote to memory of 1952	4284	chrome.exe	116
PID 4284 wrote to memory of 260	4284	chrome.exe	117
PID 4284 wrote to memory of 260	4284	chrome.exe	117
PID 4284 wrote to memory of 2836	4284	chrome.exe	118
PID 4284 wrote to memory of 2836	4284	chrome.exe	118
PID 4284 wrote to memory of 4600	4284	chrome.exe	119
PID 4284 wrote to memory of 4600	4284	chrome.exe	119
PID 4284 wrote to memory of 3568	4284	chrome.exe	121
PID 4284 wrote to memory of 3568	4284	chrome.exe	121
PID 4284 wrote to memory of 2064	4284	chrome.exe	122
PID 4284 wrote to memory of 2064	4284	chrome.exe	122
PID 4284 wrote to memory of 5564	4284	chrome.exe	123
PID 4284 wrote to memory of 5564	4284	chrome.exe	123
PID 4284 wrote to memory of 1328	4284	chrome.exe	126
PID 4284 wrote to memory of 1328	4284	chrome.exe	126
PID 4284 wrote to memory of 4116	4284	chrome.exe	127
PID 4284 wrote to memory of 3856	4284	chrome.exe	128
PID 4284 wrote to memory of 4116	4284	chrome.exe	127
PID 4284 wrote to memory of 3856	4284	chrome.exe	128
PID 4284 wrote to memory of 5664	4284	chrome.exe	129
PID 4284 wrote to memory of 5664	4284	chrome.exe	129
PID 4284 wrote to memory of 3816	4284	chrome.exe	130
PID 4284 wrote to memory of 3816	4284	chrome.exe	130
PID 4284 wrote to memory of 4852	4284	chrome.exe	131
PID 4284 wrote to memory of 4400	4284	chrome.exe	132
PID 4284 wrote to memory of 4852	4284	chrome.exe	131
PID 4284 wrote to memory of 4400	4284	chrome.exe	132

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4660.3560.2482174645409804677 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x128,0x194,0x7ffc3e195fd8,0x7ffc3e195fe4,0x7ffc3e195ff0
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2416 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4652 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.0.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4684 --field-trial-handle=1748,i,4175063457189967732,13024108895735321443,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:2220
- C:\Users\Admin\AppData\Local\Temp\bin\Decompiler.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:5988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc5347c728,0x7ffc5347c734,0x7ffc5347c740
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,11058055163975293196,12569080014510882132,262144 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,9252480895433833821,14632627167904726959,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,17093342777059239642,12723895488766397865,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
  2⤵
  PID:252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,4983748265431544202,2331144081099178133,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,1411136622569785236,1836927665315967566,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,14331203613484935039,17666986293104735646,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,15593522765732031582,8710871526215903680,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,17071442317364893676,11172443880070202991,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,9106893628824828412,10668838756736581368,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,13575364868025029000,11602220670129040379,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,13969440165632191718,16549284358463737125,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5884,i,10446853418625444579,13375417894213111997,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6032,i,18114365835526715419,13496713127618386438,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4916,i,13701450579193194954,724023885931794487,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6040,i,17038017646080336738,12363070367360936508,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,16977143202452900578,14226900897687821052,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6272,i,8618295090619526035,11210260254244937204,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,16234306086652467538,3123023744438922461,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,17847972733662626409,7750317703212638669,524288 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4764,i,6456251712648644130,10865102764575303366,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5412,i,3902596616104353583,3977685635460517191,2097152 --field-trial-handle=1892,i,13309980157449553265,16619151933991593673,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
  2⤵
  PID:4400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7d41713eba0000224e89b0ddac4b14f75515f719b4b067d0b9a2ad4d78922c31
MD5 583325ec1d65724d4e6cca4937b57622
SHA1 bacac452aeb6d7ec31955bc482353f00aff9609f
SHA512 9770528ec37d3c631a3ce40317ae17dca5a62ff5163d09500fbf5410dfafec507d9661374a3d64e0bbeb6e820da5d24f520554cf3a094fd8b62c8670b015b5e4
SSDEEP 192:gRSy+S0v7FAPRp279gHsb+WNnfA0uNe0qu7aCVyIsnAUge:gRSyPwUXcqwY0hoaCe
TLSH
T16F32B42EAE15693B6DDAC21EFE657793D7F5102271D42E80EAFC892C15E75CC221B00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 12cecafca58ff5736c89fd56a4d86b792214eaa4badc4eaebc8644231c6ae0fd
MD5 52959b89b0099153d383c846d194bb2e
SHA1 efd5d46b761a9dbbf0f496e933718c70293048aa
SHA512 bfd484ad9a918c9181f207a15c4fa48cde45529acaabf28c81c70479636eb996efd4788245ba42018515dc7ea851200f39b08359b1d17f865a20f4072d0a5596
SSDEEP 384:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCXODID+ErU38YHGyo5q4DYRff8lWc:pPIf7KxkXqKf/pUZNCgVLH2HfgsjQO81
TLSH
T11D52E827684D8A7B0FD8D58DDC226F8FADF50157A1A84D2853FB5C0803A9BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d8215b6957cce02f3a81393c6a0a60b5447b978c9f1536ba98772ee4bfebc43b
MD5 f5e8454e47170adfdc162e7cd5b6d060
SHA1 1e1975b6147c01cdb4dbe48dfaabf75545482eb1
SHA512 bfc3e0d68f76bb860a7f26cd713000a3b6bc75112d8c12bd78962ad33b47db2b1bc821e3bb62b0b8a881291c259d92c12fa35f659d900131ede3ed6b4942da94
TLSH
T147A0021082FD3D51DD505270A5750552E262885E1A938B0368DA0C56885F5C0C121641
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ba5f1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ba5f1.TMP
Size 48B
SHA256 e39b16d3f2428c333fa1c24516d2473b442004463aabdb6baa0e69a7ba927260
MD5 a785b1550df51467d5a66b7929a42d02
SHA1 393cb66785ab12effcb3a7eebad340d9628d4126
SHA512 3b239e90c0fd9f873cb5c3968d7b04404a157664ef172761cea0c84ca4f1facfaddd0b6cfde9105338889db2f250704265a1fc2d7e1489053ac099d5bcfa4929
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 396d2d4a05959245b0d03f5215cc8be957b701e872a7503c51f26facbc53d66c
MD5 9bee90af0e33048ca1a003f677814624
SHA1 6b0b1e6fe8643dd462f931877dd801da7910b11a
SHA512 0fdc8d6fc4fecfb133c37b311db38e5a1adeeaaf02675431a22146ab06b7a204902de25dec97b9815ef423ec87a9a9fe542fd407f1f7146cc667c3df91a99e56
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok556DRwB6gGyvXkQKrbfyYv4a:RC0G4DkG/FZ9kGDUDu+MpQKrbfX
TLSH
T1ACA1E672A46D8EB79976C448F5973A03CEA4A0ABA611AF44DEDC4E0C11FB1ED0342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a3a36ac584d7e3e7a3ef26842d6fc8ea82bf1c76705f642ec12111b909906ae3
MD5 a97dbc0a5eda1fe7cd9149c43c974ebe
SHA1 3d17340a10ecdbbe187886e4edc1aeb71123deec
SHA512 8358749a5424e924c6c09b230b31f94cdc82dbd35feda336197bdaa4395d81cf29e819baeb5f77442caa57dbaf7bfd7bbb6ad2e32da368d5976ff3be00dc20b9
SSDEEP 3072:+HUXOxG9nuTy1heAuN95jxluGxqFZILHwL3id:bPJuTkwD5jxluGxqFZILQLU
TLSH
T13FD312D2EF6DBDB7187EC91D31D72552C8C8CC0798AD6E406BC44E4C638ADD3A726942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Decompiler.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\Decompiler.exe
Size 2.5MB
SHA256 0ae066344b869c2e443aea77cf52063e02ed060f1867e54279b9616420a8fc3a
MD5 3c4625d27f37d8be6d4ba6d4e4e1bdcd
SHA1 d433c03990c3e5bbb1ee2373c561b16a277cea15
SHA512 0952011178c417a2c184ca08fd7cd48d6c3735d0dd2416d7aba3153164fe97b5176e6eb2c3120cc39fa13444511212b787ce6fcdc51450702142270f51fc7664
SSDEEP 49152:EPBu56RV7JJ08KoQyijE1qKJR/nO6ocT:dwy
TLSH
T1ECC518757B5A98BCD59AC43083068A775A3534DB0B35B8FF04C992792FA9EF45F38208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4284_1904813588\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f706db19c7ca55e583230e15be1bc0b0c3e78d3c48e04cf2f56aa9975577bc13
MD5 57c70cde4c831e84fa295c3a4f9c3b92
SHA1 40f1006217301ce5f537e7e67fce8af4aa58ffc2
SHA512 107f70b907c0ef4c7a240d7b4c89478be182489a2056e79cb09803e2c1d8cf024b256eeacfea4acd9ec1a76d12aa05eb69ab4555b81187bc0780a08bb8f0cdba
TLSH
T108D0121333914635C81038730103660D0811C20F80454000E428C65F2A040540E03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0572203bdc4d7e60ad44d9ab83153421ec85280451b2ff6b355d3c8521ad15ad
MD5 7d73afe8e6397f80e37833c7e8f59b22
SHA1 d75e9f528c2f238c1d946d68cea4e945383a4ef0
SHA512 1abf406f96ec614dd5381e4d8fb65d917adfc8d9ab9c02ea5fae9ab9a9f6501107fd721604c1598fd3314d02f3cf191c059cbcb4a227fb4f8425ab658e9da493
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

678c6471-949b-44c9-a2e5-d8869050522b.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\678c6471-949b-44c9-a2e5-d8869050522b.tmp
Size 6KB
SHA256 0771d34cb7bf79a19cd5b90a1e4aa71a904f1865765c1d3d927cee4fd8249483
MD5 8391aa16096cb336666583c4c333b438
SHA1 0bd449cb2f89dc4fa5ad67e9bf7df64450369633
SHA512 552912baa4f12ebd9721a8407412bbefdbe9f17bed78fb50b752b8cb72776dbb00d302093d33f44ef01244c126cee26c3e4f07a3631edabea9758354d9e4e132
SSDEEP 96:stN/dJYcnb93kmo5h16Z00s7/x+6MhmuecJqZ1eje9vK+gNZ28XM1C7K:stRPnVon0sV+FdqZQj8ynZG6K
TLSH
T1ABD185015E24797B8CC7E509FB29BB47E2F5507270D11E58EBF84A2C04DA6CC621B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 6a92fe8254538d1d17be3057d289020c004d073d63e309f332a599f1a8d641b6
MD5 b03ee7292f8409d9a96ff525e671458c
SHA1 fce24bffd7782fe88e6c0c3b2d48ca00bdb17635
SHA512 43df3f5a0b3ee0b056f8c0e1fb9742d8d38770326b09c10420b3972089cded09e4feabdd0262ae951474dd51bcc634e23a3c4458d2ca80ffb26136d7b8498ef1
TLSH
T16EB011A280CE0022C200AAB000C300883230AA02030B8E02C08830A8A032F88E232022
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b5d9.TMP

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59b5d9.TMP
Size 48B
SHA256 d5599d7489088c36a7b66c10fb5a557c482c858092963c99cf4edc7e35a2bd2e
MD5 c2188d844e826613b999ab974fbe24a0
SHA1 4f37d3a2d906f0367346175ecf1782686a0750ce
SHA512 52199c295e3d566abbcb97d4a0f93b876fb94b94f551db5a40695f2039092dae3dcf74b28b7d022524514358ec2d18021151749ee4122a506ac5fb6433235830
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8c43.TMP

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State~RFe5a8c43.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 bb075fd7b8e6e690d67d830975358fe4e5c1d45b76a7c7a9a78295a71e5c5f9b
MD5 d700e9948d846f8aa309f3250af8513e
SHA1 9dda30279f253a56f8135b36fc2953c9516c3352
SHA512 1981bf68da5119038cd39c8a262db0acd8a73a967dcc964dff597ebe001955a3de26b088860a564557a929f8d306c851ac5ed23092a8f50aa570a9628c48bf4d
SSDEEP 96:stN/dJYzGnb93k+GQo5h16Z00sLV8/x+6MhmuecJazvGje9vK+g+wd2I8XM1C7K:stRPJKQon0sLs+Fdaz+j8ypd2g6K
TLSH
T18FE185056E24697B8CC7E51DFB39BB57E2F5607262901E48EBFC492C04DB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 7f6a8067aa20d39811205c306ab727875dff505b1a86eddafd3ed30167e9c808
MD5 76f8badd4cbdd1144f9989659a9c9b07
SHA1 757907dd9acd37e9f94967c510ac9151db77b2f6
SHA512 86d16794e5c4e1bab324d30049989ae4c1a0b18c678a09be1294931970243752ff7b5cb3db4f3633b860b7f1b049bdfe47ca1344749a6be2fafcf4961468836b
SSDEEP 96:stN/dJYzGnb93kmo5h16Z00sLV8/x+6MhmuecJXFMHnje9vK+g3pU28XM1C7K:stRPJVon0sLs+FdXFqj8ynUG6K
TLSH
T163D184025E24797B8CC7E519FB39BB57E2F9607260902E48EBFC492C04DB6DC621790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 15KB
SHA256 4cf0ad4d8339f120ea7fc8892431a6f4d164ef365d3582077e8f970f74e5cdeb
MD5 eb91d9e53abb7d781a731b8bf0c82229
SHA1 4850906555914d5e3d27b462219cd2adda103808
SHA512 02958225771cfd5f18289fe983a6f242926c0230698d4d32ac65746717b5e6380c6fa0550adae9054d5fa4eb8f0752c3a1a30248be23cf9d647b4904be69569d
SSDEEP 384:xw+aQikB+z/xvxjg/qhEwNBSRybmIY20MUfS2MXs:xP/UxvxjgC+Zqm/2lUH4s
TLSH
T177728E27A5797D27A5F3EA11BA4E178BDAB9847290C16E784AFC5F0D06872CC1306D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 2KB
SHA256 8fb33ceee54b8151c829c232b514d6d37cd3d82d5e4e72b13a772917bc456301
MD5 29db2516bf928d4c57f5093758a0e9f0
SHA1 f7b424061f336e89ef58b4bd9ca55c2fac6cd01c
SHA512 e56c97d1818d6ad5cbcee553c61d46bcf3591522ed2edc5b42fe978efab8ce84f21ce7a8bf11619c2f6a1a718dd786cc0f5e3effa22f7573e3eae120321cdde4
TLSH
T1105165337961AB37DDF28A05F94B7BA78E3A5062A6512F10A6DC0F1C01DB55C2346C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 17KB
SHA256 3a5ac02bbfe75ceb8d2fe01b8eaaa49d2deecddb4b2fcd3f607bb467597a05a5
MD5 9f8dd3ffa5437c18e500c3c58bd1584f
SHA1 39a9d9faa8934b9fdac62254920ba76229fd7167
SHA512 108fff0213d3da090365f187ada2240c96ea362481a2220d817852cdd717bbd2d2554e19321d040df42d484f9a3897317faae8d512a16689889b262c282212bd
SSDEEP 384:xF+aQikB+z/xvxjg/qhEvNlRJbmIYazuo0MUfS2MXs:xQ/UxvxjgC+9Bm/euolUH4s
TLSH
T130828D36E879AE27A9F3DA41BB4A67DBCAF4846251C15EE84DEC1F0D06C72DC1306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 3KB
SHA256 bbe3c0c133cd8ebcbfe4ebfdc71883182ddf5d19b5de8ea4ae1c5e0791572bad
MD5 9c76ac29fca91747fb95e7a63abbf9aa
SHA1 f94b871a1cd2930cbf5eeb9ad78017c3e2cae3cb
SHA512 ccd8a1e7e3b08da911db51e13e93b83bb41369f72c11dbb6f4088563eeb94c5409c7d0a660172070cfce5483d39c3216a5f2dadee56deccbf72bffbe096f76f3
TLSH
T1536153376971AA279DF2DE05F9863B57AAA55023E5913F55D6EC0F0C01DB29C2342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 17KB
SHA256 c27310ca52f9c6d2e74255f668b9a98712a57c0df9b84219d3f4da3db53b5eab
MD5 e93bc7dd312f043b22f77fa573e61680
SHA1 99a3249c7c5908908b0bebc031a55b6737c9423f
SHA512 f3703c9fcc991e3d2d427f917a67f32744947a9dfc55d56405338cdb937c0bc8f63d4b1b56153e7d248aa6c03c38a7a6d05d3d275775adf1e0f29af580ea05b4
SSDEEP 384:x9+aQikB+z/xvxjg/qhEk3NlRJXmIYazuolUfS2MXs:xI/UxvxjgC+k1dm/euolUH4s
TLSH
T15E828E36E879AE27A8F3DA41BB4A67DBCAF4846251C15EE44DEC1F0D06C72CC1346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596325.TMP

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State~RFe596325.TMP
Size 1KB
SHA256 896f1ad01d7df7b790a40725d04e5e9fe14554b28f2775c800ba80c9e85fc433
MD5 6aae55124b92b70d26ebeb4f34bec334
SHA1 7e9cf85893162fec126ae4cc30721df55a9fdf17
SHA512 b442229a57e1218296e55feed23b7de1e55a666fbe37206a28ff6c76fa22cf313beec7bc945bfa3d34c17d2c4940ac3d1e71dda3216486c2da23f3c0c8c41099
TLSH
T1512138B3A9916733ECD59642B2477BE74D21107792614F00B1DD4F1C059709DA61DC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/800-217-0x000002925C1C0000-0x000002925C1C1000-memory.dmp

Download

memory/800-216-0x00007FFC5CC60000-0x00007FFC5CC61000-memory.dmp

Download

memory/800-234-0x000002925C190000-0x000002925C1BA000-memory.dmp

Download

memory/2220-768-0x000001A8ECFB0000-0x000001A8ECFDA000-memory.dmp

Download

memory/2220-757-0x000001A8ECFE0000-0x000001A8ECFE1000-memory.dmp

Download

memory/2936-24-0x00007FFC5C8D0000-0x00007FFC5C8D1000-memory.dmp

Download

memory/2988-315-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-316-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-317-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-314-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-308-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-306-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-312-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/2988-313-0x0000015F52720000-0x0000015F52721000-memory.dmp

Download

memory/3612-255-0x0000027C02CF0000-0x0000027C02CF1000-memory.dmp

Download

memory/3612-290-0x0000027C02CC0000-0x0000027C02CEA000-memory.dmp

Download

memory/4828-91-0x00007FFC5C8D0000-0x00007FFC5C8D1000-memory.dmp

Download