Potassium.rar
- SHA256 3ccedeebeb6b9858b26254256061e60471778257dc394debc4ca4adca2490850
Overview
overview
8Static
static
3Potassium/...um.exe
windows11-21h2-x64
7Potassium/...um.exe
windows11-ltsc_2024-x64
8Potassium/...er.dll
windows11-21h2-x64
1Potassium/...er.dll
windows11-ltsc_2024-x64
1Potassium/...er.exe
windows11-21h2-x64
1Potassium/...er.exe
windows11-ltsc_2024-x64
1Potassium/...um.dll
windows11-21h2-x64
1Potassium/...um.dll
windows11-ltsc_2024-x64
1Potassium/...um.exe
windows11-21h2-x64
5Potassium/...um.exe
windows11-ltsc_2024-x64
5Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Potassium/Potassium.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Potassium/Potassium.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
Potassium/WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Potassium/WebView2Loader.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Potassium/bin/Decompiler.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Potassium/bin/Decompiler.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Potassium/bin/Potassium.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Potassium/bin/Potassium.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Potassium/bin/Potassium.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Potassium/bin/Potassium.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Potassium.rar
- Size 34.7MB
- Sample260825-tp4bfswakd
- SHA256 3ccedeebeb6b9858b26254256061e60471778257dc394debc4ca4adca2490850
- MD5 9c6dbae5966f2b17cafe81c481779894
- SHA1 fd0d8c3c2c99a64884382de909ff245898e53269
- SHA512 29b418c96c08e0e68911bf3f02f1583044d5d154c1b7249881fa26048c36d24d96da4bfb05416a205613ca42159171c6aa1960ca7125f7a8f14fc0cf36d01da8
- SSDEEP 786432:CcJKKLDo/sQd1dvSg75gydyVSkjjmM7k6D3+pLn:CcNLMz75ldyRjmB6Un
- TLSH T17B87335327AE9865EC17111AF3EDB43F42280457EF63201E9C853CE9AEDD528E5EAD30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Potassium/Potassium.exe unpack001/Potassium/bin/Decompiler.exe unpack001/Potassium/bin/Potassium.dll unpack001/Potassium/bin/Potassium.exe
File Explorer
-
Potassium.rar.rar 34.7MB
-
Potassium/Potassium.exe.exe 74.9MB
-
Potassium/WebView2Loader.dll.dll 156KB
-
Potassium/bin/Decompiler.exe.exe 2.5MB
-
Potassium/bin/Potassium.dll.dll 9.9MB
-
Potassium/bin/Potassium.exe.exe 14.1MB
Potassium/Potassium.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 32c23117961e1c5e56d108f087314151f1c714be5015b5622871a2cb346fb0f7
- MD5 eeb010dec5e5c64d818ab2a9eda690e8
- SHA1 fa4e3666ed480fa2308b320d563c6b813c1cedc9
- SHA512 31022291d211e966136617ca868e75819c2094c3f611377a7c0617c1caadf4b28d54a6fe01772aae64136cfbd4ad1204cef648297446e5b2615aaad2511a8e5b
- SSDEEP 196608:c9dnSC56xrIHs2XTWMrd0mzO9dnSC5ZudFcc+/m4hvmS:c9dnSC56xcHs2aMZK9dnSC5Zg+/TRd
- TLSH T1FC0808F9936023BCDC4957BFB96138B4B60F747A37E5CD94C22E4E92581789ECA09843
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35225,
count=1, id=258, version=35225,
Potassium/WebView2Loader.dll
- IMPHASH 90db803f7a0acc2517ef287c1dc1bb76
- SHA256 4cd3ffd5f52122432b6537b360c2317f96650928c927bb3caa59d5807da573a9
- MD5 daf9a81004a961e39650a0e2bafe233e
- SHA1 62f863adbef09905c75f475cdd5ce68b0aaaf73f
- SHA512 95f1ffa93b0c16fdbaf9eb2d9f9fdbe63b1946a7cea0e366a9c68fd4695a97c7681bf9e2b2f372c8ab6430c0a37cac733154e94b1d7a76cbfa3c1de340d5ce33
- SSDEEP 3072:8nVs+j4uIGieBiCIV6A9S4arvNQG/pTNgWEtJctHVA9rWt:gj4NCy6A9S4YcWEtJeVAk
- TLSH T174F34B5BB2E90077E17BC278C5A34A16E776B8111750AAEF036447791F237D0AE3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
77:92:aa:d6:39:7b:db:80:60:68:c4:f7:d5:d6:b9:56:81:17:74:f9:1b:cf:27:61:b2:65:8c:d8:dd:72:4e:9f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 31, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
18720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Potassium/bin/Decompiler.exe
- IMPHASH ccbfdccfe0fea4c041ebdfd834149cfe
- SHA256 0ae066344b869c2e443aea77cf52063e02ed060f1867e54279b9616420a8fc3a
- MD5 3c4625d27f37d8be6d4ba6d4e4e1bdcd
- SHA1 d433c03990c3e5bbb1ee2373c561b16a277cea15
- SHA512 0952011178c417a2c184ca08fd7cd48d6c3735d0dd2416d7aba3153164fe97b5176e6eb2c3120cc39fa13444511212b787ce6fcdc51450702142270f51fc7664
- SSDEEP 49152:EPBu56RV7JJ08KoQyijE1qKJR/nO6ocT:dwy
- TLSH T1ECC518757B5A98BCD59AC43083068A775A3534DB0B35B8FF04C992792FA9EF45F38208
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1846368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
bcryptprimitives
ProcessPrng
kernel32
HeapAlloc
InitializeSListHead
GetSystemTimeAsFileTime
GetFileSizeEx
CreateFile2
UnmapViewOfFile
MultiByteToWideChar
CloseHandle
CreateFileMappingFromApp
MapViewOfFileFromApp
GetSystemInfo
Sleep
GetLastError
WaitForSingleObject
SetLastError
GetCurrentThreadId
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
CreateThread
GetCurrentProcessId
GetCurrentProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetStdHandle
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetEnvironmentVariableW
lstrlenW
SwitchToThread
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
GetModuleHandleW
FormatMessageW
GetModuleHandleA
SetUnhandledExceptionFilter
ws2_32
WSAAccept
send
WSAStartup
getaddrinfo
listen
shutdown
getpeername
closesocket
bind
WSACleanup
WSASocketW
getsockname
socket
ntohs
recv
WSAPoll
freeaddrinfo
getnameinfo
setsockopt
msvcp140
?_Throw_Cpp_error@std@@YAXH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
__crtLCMapStringA
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
_Cnd_signal
_Thrd_hardware_concurrency
?__ExceptionPtrCreate@@YAXPEAX@Z
_Strxfrm
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Strcoll
_Cnd_do_broadcast_at_thread_exit
_Cnd_wait
_Thrd_id
_Query_perf_counter
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_compare
__C_specific_handler
__current_exception_context
__current_exception
_CxxThrowException
memset
memmove
memcmp
memcpy
__CxxFrameHandler3
__RTtypeid
strchr
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_exit
_crt_atexit
__p___argc
__p___argv
_c_exit
_initterm_e
_cexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm
_get_initial_narrow_environment
_set_app_type
_beginthreadex
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_errno
exit
terminate
api-ms-win-crt-filesystem-l1-1-0
_wstat64i32
api-ms-win-crt-convert-l1-1-0
strtoull
strtoul
strtoll
api-ms-win-crt-string-l1-1-0
isalnum
strlen
isdigit
strncmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_collate_cp_func
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
ceilf
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
ntdll
NtWriteFile
RtlNtStatusToDosError
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
511KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=34, id=261, version=35721,
count=6, id=257, version=35721,
count=105, productName=Unmarked objects (old),
count=9, id=257, version=33145,
count=286, id=1, productName=Unmarked objects,
count=1, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
Potassium/bin/Potassium.dll
- SHA256 f3eb9b13c4c44139e98f85eacabc567816a64cee5fca66f24d14ea311f326d93
- MD5 f56d2ae22bc4bb894b14db8afd98e6ea
- SHA1 2a2f5855f4319c603ad6098f1874755e27519fd8
- SHA512 d36ab3384b2b8b0e10a2bba576a2f1d9a638e9553a4bd05f6e171e3ca31beabdf6e726cef767ed5c7803bfbfdcffb922ac1d7596835213e8b86157900b69f052
- SSDEEP 49152:HbHWRthvXqWoP8EWpR4Z3Oo/CdJNrN0TEqRxgUgUZZs2S7XhCxbOItS8tiDxKJMr:3WoP1ozgGFctqDxKJMLBotxB+1J
- TLSH T186A67D6551F409E8C3BBC079EA4A9E13F6717C4D8320B6EB8EA14B511BA37E0677E350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3761824
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
927KB
Virtual Size
926KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
145KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=253, version=35721,
count=8, id=260, version=35721,
count=32, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=215, id=260, version=34810,
count=45, id=261, version=33521,
count=1, id=259, version=33521,
count=568, id=1, productName=Unmarked objects,
count=25, id=257, version=33145,
count=176, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
Potassium/bin/Potassium.exe
- IMPHASH 019c88bdd50dcc254c42159c39abf012
- SHA256 eba4c721e04562a9411d1d115514796c055f67c0ea3d91994bdaadb7e31a568e
- MD5 6d1e4aa7ed1304e60d9219f6151a7eac
- SHA1 ef35919519c757a1946f46a3bd68be1b337071c1
- SHA512 aae198e8e82b3ea7ba3b65fd386ffc6b0dde565aca4a6820217fdc1391434f131d755ade75b8a904e27e0bd17ff8bce4659f12b9c3fc58ef39eb077c9cf979d9
- SSDEEP 393216:fkLeqUDt+SkHwv3aidtCZo8zTk51SWhQHvb1V3o:fkLeqmsShSidEk/SWhWxFo
- TLSH T148E612E658C562F4C8D74B64A24A1BCE65F0E4AA5AB8BC1C3BC11C434F31FEB4649D27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
18124894
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
advapi32
RegSetKeyValueW
msvcp140
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
ntdll
NtQueryObject
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Name
.text
Size
Virtual Size
202KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.LHv
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Z~y
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.$l
Size
14.1MB
Virtual Size
14.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ