e9cdc917d71daaf861ae462d85483d0f4cb55e1c9b4181ac4dd237e6a5f192f2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 25.4MB
Sample261017-vwt7ssw1ex
SHA256 e9cdc917d71daaf861ae462d85483d0f4cb55e1c9b4181ac4dd237e6a5f192f2
MD5 dac208f02a69b032f7cb0512ff2a5e1d
SHA1 99cc090bdcda9482f6882ae41bf4364335054496
SHA512 78da85607e12e34d963611ab6024834838d42a7e12bc162fe458f4cec4a8ef4bb98792180847774b4bb26b83f39331fbf74db2e93afc0ed35701e815cff8f9e8
SSDEEP 196608:JsqJtqlfcOnRXcd4pEBkvLSQxR5m0KJNTTH1/+30vVUksmLHjL5HD:OlfznSd4pESvLSI9KfTXfJLHjNj
TLSH
T19B473A257B5A996CD05BC474838B4A729A7130CB0B35B9FF449492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4468	Potassium.exe

Loads dropped DLL 3 IoCs

pid	Process
4468	Potassium.exe
4468	Potassium.exe
4468	Potassium.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3624	tasklist.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_42430999\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_42430999\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_393773887\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_42430999\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_393773887\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_393773887\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Mu\Content	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2336	msedgewebview2.exe
2336	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3100	msedgewebview2.exe
6004	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
252	Potassium.exe
4468	Potassium.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 3100	252	Potassium.exe	90
PID 3100 wrote to memory of 4884	3100	msedgewebview2.exe	91
PID 3100 wrote to memory of 5692	3100	msedgewebview2.exe	92
PID 3100 wrote to memory of 5692	3100	msedgewebview2.exe	92
PID 3100 wrote to memory of 5692	3100	msedgewebview2.exe	92
PID 3100 wrote to memory of 5692	3100	msedgewebview2.exe	92
PID 3100 wrote to memory of 4620	3100	msedgewebview2.exe	93
PID 3100 wrote to memory of 4032	3100	msedgewebview2.exe	94
PID 3100 wrote to memory of 4032	3100	msedgewebview2.exe	94
PID 3100 wrote to memory of 4032	3100	msedgewebview2.exe	94
PID 3100 wrote to memory of 4928	3100	msedgewebview2.exe	95
PID 3100 wrote to memory of 4928	3100	msedgewebview2.exe	95
PID 3100 wrote to memory of 4928	3100	msedgewebview2.exe	95
PID 3100 wrote to memory of 4928	3100	msedgewebview2.exe	95
PID 3100 wrote to memory of 4928	3100	msedgewebview2.exe	95
PID 252 wrote to memory of 700	252	Potassium.exe	96
PID 700 wrote to memory of 3624	700	cmd.exe	99
PID 700 wrote to memory of 3804	700	cmd.exe	100
PID 700 wrote to memory of 3648	700	cmd.exe	102
PID 700 wrote to memory of 4468	700	cmd.exe	103
PID 4468 wrote to memory of 6004	4468	Potassium.exe	104
PID 6004 wrote to memory of 3680	6004	msedgewebview2.exe	105
PID 6004 wrote to memory of 4280	6004	msedgewebview2.exe	106
PID 6004 wrote to memory of 4280	6004	msedgewebview2.exe	106
PID 6004 wrote to memory of 4280	6004	msedgewebview2.exe	106
PID 6004 wrote to memory of 4280	6004	msedgewebview2.exe	106
PID 6004 wrote to memory of 4848	6004	msedgewebview2.exe	107
PID 6004 wrote to memory of 5264	6004	msedgewebview2.exe	108
PID 6004 wrote to memory of 5264	6004	msedgewebview2.exe	108
PID 6004 wrote to memory of 5264	6004	msedgewebview2.exe	108
PID 6004 wrote to memory of 3080	6004	msedgewebview2.exe	109
PID 6004 wrote to memory of 3080	6004	msedgewebview2.exe	109
PID 6004 wrote to memory of 3080	6004	msedgewebview2.exe	109
PID 6004 wrote to memory of 3080	6004	msedgewebview2.exe	109
PID 6004 wrote to memory of 3080	6004	msedgewebview2.exe	109
PID 6004 wrote to memory of 1728	6004	msedgewebview2.exe	113
PID 6004 wrote to memory of 1728	6004	msedgewebview2.exe	113
PID 6004 wrote to memory of 1728	6004	msedgewebview2.exe	113
PID 6004 wrote to memory of 5280	6004	msedgewebview2.exe	114
PID 6004 wrote to memory of 5280	6004	msedgewebview2.exe	114
PID 6004 wrote to memory of 5280	6004	msedgewebview2.exe	114
PID 6004 wrote to memory of 2336	6004	msedgewebview2.exe	115
PID 6004 wrote to memory of 4660	6004	msedgewebview2.exe	116
PID 6004 wrote to memory of 4660	6004	msedgewebview2.exe	116
PID 6004 wrote to memory of 4660	6004	msedgewebview2.exe	116

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:252
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.2.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=252.5672.14777413151537966220 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb8b565fd8,0x7ffb8b565fe4,0x7ffb8b565ff0
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1752,i,9255054328686304819,2083428448545670644,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2168 --field-trial-handle=1752,i,9255054328686304819,2083428448545670644,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1752,i,9255054328686304819,2083428448545670644,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3444 --field-trial-handle=1752,i,9255054328686304819,2083428448545670644,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\potassium_update_252.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 252" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- - C:\Windows\system32\find.exe
    find "252"
    3⤵
    PID:3804
- - C:\Windows\system32\xcopy.exe
    xcopy /E /Y /I "C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\*" "C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Potassium.exe
    "C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4468.3220.14752845425923880044 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:6004
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffb8b565fd8,0x7ffb8b565fe4,0x7ffb8b565ff0
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4280
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4848
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2468 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5264
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3556 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4648 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5280
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=820 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2336
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=1844,i,10596214324975119986,12672814476553070497,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

potassium_update_252.bat

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252.bat
Size 688B
SHA256 4ec8bb19212cae6d4c4e0318f8fb9f9c459173bccfb9b994116efe9df43b0032
MD5 72a7515313f86fa4403a8240685ab24a
SHA1 59c22b3447e5bc4701df2f27b9bdf09837f5e805
SHA512 66f96ddbe974e8da77330eaf15b985c7626b9970fb63cf77f68750997f2178733020d89c29d4eb85fa5e2e0bfdcaced3bab75d1a667376808d5955fceec2687c
TLSH
T17201F77D5149CE1715395842C9BE440CF0BEC96F1F0B7EC0871AD47AE15241ABFAD586
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\Potassium.exe
Size 27.0MB
SHA256 045ddabe5cee2d12468ac179759559064e4c61af695396372973138611a6ee27
MD5 d6f96ce56f29c0753e3cfb1efa3e427d
SHA1 b35dc6ac222628e228a4d7a5df60fc49eb95869c
SHA512 571a6f5bc61a6b073197d4cba173de6761f330e92f2cb67b46a40179679022b259a23acb8184767bc4ff636d6af760ec928c4d0fa8230d930c020bbfc2c8c5d2
SSDEEP 196608:vcD9kVhaSQfqvpZZoTOKHBB30vVUkP0KJNTTH1/kapldwfS8ZBDPwdtiyB0nfIZC:3haSQIpZZkOKhOfMKfTyV6wDwdDB5C
TLSH
T1C1574A257A5A996CD05BC474838B4A738A7130CB0B35B9FF549492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autoexec.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\autoexec.lnk
Size 1KB
SHA256 006d6168d27c62c347d1b5c3c493f9d9f47d4f24998cd1ed4e6af55386d2a745
MD5 a2f6abf50bc9a739d90905aa42153343
SHA1 4bb0b291fd763628bc10770ed2ca015bae3d2380
SHA512 d898517c1e201b2b32c2765aa4486bea8190275f12cefa2a93eb44658d693507ecc81f7e27450507e3b392c2f9640d63d3d341d5b1b20677d62ff68d8b172a3e
TLSH
T17B311F1D5ED51720CBB988B617AF2306E76324527BAA4D2606448A4E1A22542BE58F1F
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scripts.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\scripts.lnk
Size 1KB
SHA256 00ee5ac203f530c285231a8d1055764ae6bc6056812b2ff6b2b400c13eedb4e1
MD5 368718555cd69e85c33ab66442815cdb
SHA1 8e2eda2fe3c0a6c853cd471e17a271883f87c42f
SHA512 3e235efa55411fcb8aee573ea8a81298302ebb0003ba20a42e81cf2cb79d7969cd684e009ca2d4e03610225705c9f28e70933dc33c2be16a2683e2d92a536359
TLSH
T18131325D9DC80F31C5F58C7757AF2706DB6054627F9E9D260E94828D1E22A02EC54F1E
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workspace.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_252\unpacked\workspace.lnk
Size 1KB
SHA256 24ab09465ffc09f89917a776325062f23b679456a0d36799b4cab65242f7dbd4
MD5 4cf25c84d3e866e83709df8a6601df61
SHA1 89258dd5f24a2d681702e950f491f200fe4d0941
SHA512 760096b6983d8b9276398e216211b858835e016e7e348838cc59af4f1d3927652cc61d2fa96ca3847dc00b820888516ea76d4dfa7612cc426e14ff26f1e1fc83
TLSH
T1C231351E59C95E35C6F6C83527DF370AE73450A5BF894D01419081491D329C2F854F1F
MD5 SHA1 SHA512 TLSH

Submit Download

21ea9084-c3fe-4f75-8e01-521e0cda2613.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\21ea9084-c3fe-4f75-8e01-521e0cda2613.tmp
Size 3KB
SHA256 1ab65a9ced8cf6ccdd319c80a61316fb88c75f14bfca3e44312151f5085b7b34
MD5 615fb0e41589ed21e39a4f34287c9e8b
SHA1 1ac84932109863642aba60289745d5765e9aa074
SHA512 f581f363fb32082f88eaf4d08f729ac5c5a1e8a2d58e782870720ff3fa962cb920bf05d734a673cc005015127d97eebf41b0fccc519f80c0a2a0290c6a7c79df
TLSH
T1126163336974AA374EF2DA0479862B17BAA55033F5963F55DAEC0F0C01D73981352D27
MD5 SHA1 SHA512 TLSH

Submit Download

2a27d64c-ec75-4763-b6ea-957eae0c422d.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\2a27d64c-ec75-4763-b6ea-957eae0c422d.tmp
Size 3KB
SHA256 a45214cc9cc8a7e9ce609543e3790ce2e9904df3202774f7c1b0217998bc73ff
MD5 b483cc93346af314de2d98b8a31c2552
SHA1 c5b45061c64e382aadeed1df75bbfadb4d24eadc
SHA512 805c843f40076c275f0091386a4ce737e28e35c2668b9d73b9ea04aaa472045a94444d1cc0274faaff465a8674a1ae96f813be929dbe09d166fcb59ce3d856e0
TLSH
T15781962268B4AA379DF2D90979463B57BAA45023F5D93F99D6EC0F0C01D73DD1342827
MD5 SHA1 SHA512 TLSH

Submit Download

3050509f-4452-405e-8185-81be6693a31f.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\3050509f-4452-405e-8185-81be6693a31f.tmp
Size 2KB
SHA256 961b8af198c095b732a75125fb93d11a0999dc8f4f5005750ea9cb3ec40502c2
MD5 96ba9b70427816f3f6b629fc047b86b9
SHA1 b965fb93b31884ffae109ddbb15238f86ad4bfe4
SHA512 2f8c5decccb8162b2103aa528c46e7365fb2a011c2d1622b2f198b21c5fdabbbdda77312614c6795658957c1cf05fee33a216a8050ed6c308923590617499a2c
TLSH
T1CC51953378249B339AF296083A462B63EE359062FA662F106ADD0B0C01D769C5302D37
MD5 SHA1 SHA512 TLSH

Submit Download

3ddd8736-530f-4d1a-85a8-32d12c9e71c9.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\3ddd8736-530f-4d1a-85a8-32d12c9e71c9.tmp
Size 3KB
SHA256 e75ad244f44c9dbf56daf648b87bf917cb343b7020a1937b72f2c362508f041f
MD5 2db71bcb1200e2f28ef0f690e99e1bfa
SHA1 7938ff792461e8c7e5ed8ff9c165900de92e492b
SHA512 5692bae0c138dd7a983d7388b076f7aa39aa4172b31289934fdb3dfedc680bd2ed0753c501799aae35155851db804e071ab94b9e70fd6945262be175a4032da1
TLSH
T1B981942269B4AA379EF2D9097A863B13BA645023F5993F99D6EC0F0C01D73DD1342D27
MD5 SHA1 SHA512 TLSH

Submit Download

681227cb-23a2-446a-ba06-4ee00807850b.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\681227cb-23a2-446a-ba06-4ee00807850b.tmp
Size 16KB
SHA256 bd67421d652b2f725ec111f15daf264428aa1783c30fde0612236883a0747e64
MD5 fc09ba7f90279ed374c79680064715ae
SHA1 3bbabe87fd5a521c4c4aaf7a77932a0185ee276c
SHA512 a2da0592e160cd24084882a108e7d69b15f0e985f078b6ab39f8e3a71633feaea63bedebd9f838a9f5db99973277552d150efb6e59c4e52b0ff8dd9604271f86
SSDEEP 384:r+OBqImmJvGBLx3NaFMJFh3NBSWs+tLyDaBesug6r3:ScvGtlNhlmWY7
TLSH
T13C729D362C756B236CF7C60ABEC92787CA712163C0E56FD5DDEC8F0E019B5941392A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dcd52afe266d483a5dcecb4d9a084da78309050a0d7683b3bf9667801c824429
MD5 62448235046e326a7ad1d02b02b8ef4a
SHA1 fc99887c78e2a2b38e903008ccd98ea9b9bebc7f
SHA512 0fc877f4ba7cedab8987103750e916eb9ccfd1d3d842a9bcfcf3fb18e01abb10c241ebdb2784325ef5b87646bbcaffda3385d57eece5bb56568d8945001c4cab
TLSH
T1E2D012523A0206B4E0202037018362082800D22B410640009439C51D6B040541B224C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7dc08d792f57bf53a3c7b0a4d27b1a1adbcd8f345b3fe720d11147b774a5dfc1
MD5 fa10eddd606e742dc763939240c76791
SHA1 9f7021a3cf326fc20c8c3de5559e1f36deed0c65
SHA512 c5e35ff7f508b6634662167f4c799f7ab2429f1c7ca1b0c7541729780b09c2b7b1bf11228b40433a7123bc10ccdb54222266f6cd5b7fe24be6e97f60145629d8
TLSH
T1D3D012523E0202B4E0202136014262082900D12A420641009439C52D6F040541B224C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 45cede02fac6ff95e991fa241a1387dba2d5a801e05c0f9d6dd34df355a2e261
MD5 3728b6d9a8d06425780e43e84dc30267
SHA1 8f8e074478e285e43a00d1033cba6ff10c8798f2
SHA512 a5d50572edb77b5a482802c99f8b9fa2d7b410479743288d0b904f7d462406a07b34e258d4f99b773c716d4126e275502c189bbc3e6d907ce8ae0e161f8afacb
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

83adee95-a9ee-49e3-b322-19e28d40236b.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\83adee95-a9ee-49e3-b322-19e28d40236b.tmp
Size 6KB
SHA256 58c1ce638f3bcc1c4a6d3435d5ee2bb21f9621a3cdd27fa9953e50f7793a2256
MD5 78a418e56b953069c3cbc775af25cc0a
SHA1 5413ae0a01f2bbb81dccd64d6e322eee5976c99b
SHA512 630fc18d9a8c69a7d79b66e0764c05e5f6253ed404ba74b3a8add2aa2700767c52e5a9e1dfc39b98d6a3c415f0092a27e3e904a037012d5b878fa5ba5b0fcd37
SSDEEP 96:stY/dbf6scbDuk+mefdo5h16Z0dPs7/x+6MhmuecJd751MkkjeKQK+gdSqGzD28U:st8N5Lon9sV+FdRXwjV+DG6K
TLSH
T17CD1A6026E24BA7B4CC6E51DBB75BA57E2F9603275D62E09E7F8492C04D75CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 23b102c7d5ac04fb61d707e1909c0c195e80c77d6dc645d846128c9104598843
MD5 c70f8144bf60b3b8ff4a23e5816d4b36
SHA1 4e4095f681d8fa828f4b24652319c3bc709cdc67
SHA512 e01952268236561c63e5e0a527db834171580eb324c56bd88dd2b9c16d8b98d93b1354666ee19efd18b9fc287bf84fca76e16062174827ac8f4a1929e9727554
SSDEEP 3:LstlNllkll/l78lt:LsX3lEtQlt
MD5 SHA1 SHA512 SSDEEP

Submit Download

4b85f97e62dbfd23_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\4b85f97e62dbfd23_0
Size 256B
SHA256 df5b94f7ee6e35f1b5251ba173707919a7325dd178e3650e90e5348d02f1626d
MD5 6d4dc4cf20a4da985bc0a277ee6e321c
SHA1 6407eae51540d4a3f7809bf8f362694b762ece8a
SHA512 c46b32d28feb23a08ada7d7c2d3f94b8f92a6fffcd60b26b9ab66e382cf8931fe5d0f899599dd86b48cf92e3abeb24cee246b50713f95df79552f7ed3f718207
TLSH
T13DD0A78F89959904C3D56EF4CFFE4EAB8F5791F044ACC5058300E86121C5A94F91DF65
MD5 SHA1 SHA512 TLSH

Submit Download

f0320c507b43bf80_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\f0320c507b43bf80_0
Size 258B
SHA256 3ed9457cfc135c84a7509ec675fbd752916b986ecd8813e5830fcd08ac80af9b
MD5 b47a748ef2c6f334f86c1d43698b9208
SHA1 fe5cb43b59ee0c7eb15b54831ece9a2a9469ef82
SHA512 6b62812e5b327b5b305c606744cb1106db14a48b5812c394c4371d08b1a6e5d2e5bd13f7beac06896b9749e451e08647f18aeac9e3802a603910006ab6d3b8ee
TLSH
T1DAD0A78F44555048D1AD98F4AFEE0A4EC359D1E0356EE9513C24FC024A946257935726
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 05dd7c103ddb2629678b3df5fbfaa8d4e0239cfd6ef1c71163a4f6489a1d6a0c
MD5 efe6a0eb16c2c1760e47cf6bf026e8d9
SHA1 f30b5ff64da6451289ba892d0de3418d60a2ce17
SHA512 8445ee40638a0c7c6b44c2281c927c3389edfb482dfb08aea60989673aa8d0c915948c19f2002f042e09a3f64ec5817267c3e43e882e6dd9ca15b3be38352c81
TLSH
T174B00218E80005D9E2FDA6B0ABDA6E8675F95D9243331B1585F673B4D814345F131810
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 89d594f7865b2ad125586f14158e50ed371a830b5714a63b22c8b5bf5544bdb2
MD5 499137c38dc61d59d4b9532447b8f792
SHA1 36c1e2743700bffc58bb89e14a03ef8473274f4d
SHA512 ae240801a9c703133d1ff2159d40f4ced5fb52eda81c51d384a8553b948467ba63b5f1efcfa5d8c699dc81b5df866e054ba3b021eefe7435dce29881b2d66674
TLSH
T11DC01208A41002CDD3AC7370B7DA276D397C49E301E30F0C0596F278D428350FA71470
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 35274857c5c4f3692d62bbc4edcf26caf86fbab28375dfa1631017aeb6fc33a5
MD5 b20296abe3a03f74b32c081594a70282
SHA1 329331a12773a94758607019b740b946c692a999
SHA512 0ca8c8bd08eeed6fba049cf0ec7c0d5bfa1aa19337a1ed7656d26d80883d7dfe63acd70fd153e86f69f0980522eacbcdb59030268ad05b95edaa94ed5f37f447
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Favicons
Size 24KB
SHA256 4771de81604a1aa8c602bc1e17e90519be8c78b7f56451b417f100ec44fd0ea1
MD5 4f4e0f63dfccc689831e4ae065e201a7
SHA1 aa4f3f7a0b0f17db1c2615ee0c920e951888f776
SHA512 fe10402d5e3fd3e49ded68d02d5ede3b9179e51ed2931c1ebc5a6e1b1fe1d8108881c14d6813d42b5257f2e31a062ed52062995eb18c182703e3396f06bbd1de
SSDEEP 48:QBmw6fU1zBuzgR9q8pj8ZUHa+DmSo0C8dtupPzjv0PcrRmlBSTkikUe51nbC:QBCyuzgimdaKmSoJeGzz0SRNTtMo
TLSH
T105B2E80F5F387006CBD15E7E2B6A5C3A8D3FC35DAEA50C287C2884605CB4585853557E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\History
Size 164KB
SHA256 79d4d5fe4084f1ab4b1248049d93ca52df1ea4bc937b776d984dfb29cb5d526e
MD5 baf3c02f527bceba344de5ed3aacfb15
SHA1 dfd7be2f389fb0506d716bc578719c7372f89f1a
SHA512 0a935bd91d86009ba796f966675cd416119331f1faa0d50f8a2fbecd6b5700aaae01048f9e8d93ae6f765a4c583078e730c6a31dd7aa66a2a6e4c84fa111c0b0
SSDEEP 96:8Bx525LqL/uejzH+bF+UIYysX0fxQp97aEHt/DfLVVVN6zRk/E0EEV:8B65qL/tH+bF+UI3iWGVaWNVVV63CV
TLSH
T1B3F3EA5E5F243212CDBD923B68E745B3597CF03F872366866C6214B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 91963cdd826982f766cf25ea1aef5527752a4c90dd1dd6d70968d68384ddec48
MD5 8aa52d2df3d03282bb319c01f1360427
SHA1 6010fd5343a297e40fafedb52b85e8738bf026a2
SHA512 943c5cea7534ef95d47ee3887eecf915a45be78404961b2fd92afb975f5d158a914bab06e06503bf07f05d66f06a30a01735252e2393555a7845cc8f85178811
TLSH
T1EFC022A108A9E07620680922088CBD406E3AA0718141A4EC82C30A3AA0800AF6103523
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa996f84-1993-4eb5-b271-2f131cd90052.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\aa996f84-1993-4eb5-b271-2f131cd90052.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c03905e5-d9fa-44ee-8f90-43f5653ef649.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\c03905e5-d9fa-44ee-8f90-43f5653ef649.tmp
Size 188B
SHA256 123d69896c4b0d6f7e09f8b9621ffd6cc0369d08271d72fbcaa4a51efd1d4b57
MD5 501238eb65d6a1dd41b29b45f97e8a8f
SHA1 8dd259cde8c3d59ed29bb3f430b8c056305be80c
SHA512 d7c4689e697d0fa069245522f12614efb69a2eabe16252b6a694737faf3e223d4e57110fff21372c6daef25d3ce199741ac18f8ffd02f3d1e457c42da2fd4ba1
TLSH
T1B2C012A14469B476A0B905626A84BD497E3FA138018165FCD5924A79619117A5103512
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 e5d66932d4177f18249d10590defb0a64c7d654835281b00d489c06caa1c83da
MD5 394cec95ca31f855a3530d77298c9f60
SHA1 77f548a8dfc135af26440d25f7a7b5b6c105d687
SHA512 5bbae000d9bc27a3aed348bec3aab48c3eba98047df828b166fae29327d41dcabcee57a5660ee9a7fe38241e93f7ff92b7ecfa518aeacfdb485f759cbcf24684
SSDEEP 96:rY/dbf6sLb9uk+mefdo5h16Z0Xs7/x+6MhmuecJ841ejeKQK+gJqII8XM1C7K:r8NsLonXsV+Fd84QjVxg6K
TLSH
T1A2D1B4026E24B97B4CC7E109BB39BA53E2F9503231952E49EBF84A2C04D76CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 fd879cf59d2ef16af618289829a0a22db460b050b0a5f7dcb6bdb66f87811472
MD5 966ee4159a41265020ed27c232d65930
SHA1 41f7f9d7d1e34956be53c3eee0919bbb862dd100
SHA512 8b7686c4a22bfaa250916e0fae3e1e207ad5f8fd694be1898be92489ee038c14a93c44ba3bfae354b1e7f1822fe23842e2b73e162851abf4883b9b336caa476b
SSDEEP 96:vMicPlf/ROo1pkF5d1MiJ7VaTEv9V5h5pg5+e0D1EBjDmWv1P16:1Iv4v9ljcfPM
TLSH
T140C1A6A7052DC274BF404BFBED393ACBA9A601DF99DA4806A6D2C44807C1EFD21DA4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 388eacb02518bae884193837981788038186f4b64c0084d7f8738a4e5c70c666
MD5 049b025f591b16b66e9deb0fa1fe1169
SHA1 b1379cbb01f73c7a8ad9019a102ad46900703333
SHA512 61fad0d69309fee366e6d35985ad76ac5b56034eb3006ea595e19896c8d81880269ed6297e336e9193212bcc15f1770b507ab40669c0454fd70cb183b80736e4
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\LOG
Size 325B
SHA256 804d4d5ebe979df0eb011a254f5a5f0db526332e9d7bcf3a88a22f0b06140eb5
MD5 a7faf264429f9815d016390b1781f2b6
SHA1 85cda464d7e506b31202deaf0a8ccebc12637c45
SHA512 8fdf1e1b96cfcd491d77c9d1b4ad05b663a10153b85d45c90fc346bb8eaa0dbbdbf3a9eb9ad3d279f20e8d3e751e662925f8c0e7dd497f859035598b8876b607
TLSH
T153E0206029CDC32B15C604DF1639EB0DCB366414F7CD1A960F74F704158F44DB162341
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\LOG
Size 301B
SHA256 594be0c0e866a0a9a2a7561038570b4b85f27cb6cfc67c8cb7b009e312a058ea
MD5 d612401587347676a72525f734025b06
SHA1 34bdb1d1a1db95bb16b85ae71aba9dcb207f5e97
SHA512 484117c9ccc61d6cb455ec79e2f6a5a8b42759af44d14c2870e53439bf334e411681020306b190a537b304544c3432d683f500cf9e225bde9e42f9b3eef11b55
TLSH
T1C2E086B468CDC37719C488D606799F1ECB746C64A789378A4B18F708298B54DB270381
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Visited Links
Size 128KB
SHA256 77892a6449f3357b1167f3fde66bd249cd006fc85cd04b929c8a47af7994a19b
MD5 4b0876fe5aa7bca0a3548f805948c185
SHA1 ddfe271080ca5639ca09c35aa178e994ed0e1c9e
SHA512 77d4aceb56bdde0272fc66761deb8997652d6c4eee155c62a9db83ecf000222f9b87a34d5414e4dd3a8cd7b90e125d24a0806a0047da617b94fe0a3695f0ef66
SSDEEP 3:ImtVuDrrpl/t+F/l/:IiVu3dl/sN
TLSH
T138D3040555414413D04401355C00053F0111C13013373D01477C0407C44110145C7C50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b42fb03d-b7f4-4573-9d97-80190ba7cd37.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\b42fb03d-b7f4-4573-9d97-80190ba7cd37.tmp
Size 6KB
SHA256 3526e4a9a3087d573ce802ced1bf6812282cf3deeab1154a73962c6dcd413bc5
MD5 ee656d763da93933cffb9a2a3bcde08f
SHA1 72a41e5276ca4ab76240efd1df36d90a4f3ccd61
SHA512 cf33295df11dd4faa5cac7175f6b912650d01a02de50bb0d90178018cee225d53fc5c8d4cf2f13c4a88a0ccee62b771b60fc09de105f28b4653395601635e3dd
SSDEEP 96:stY/dbf6jGcbDuk+mefdo5h16Z0dPs7/x+6MhmuecJd751MkkjeKQK+gduxGzD2z:st8N7Lon9sV+FdRXwjVjDG6K
TLSH
T1A7E1A5066E24B97B4CC7E51DBB75BB53E2F9603275952E09E7F84A2C14D76CC220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 abcb7d639e6470446a666b0e254fca480df9824e703ee2a4675a5a906f9bc60b
MD5 137c669c2a64601dbd25ffa7a09926f7
SHA1 4d70ca34ad8891cbfa1e56fa106fef248b4de7e0
SHA512 e8c79e19796033f815b00730a79f0517582d72b85a8a89e75dab088d63f1f4e2c96a0b5462db55c2702b1e1912bff508d966919c935f3e15886375d272bbfe56
TLSH
T18C216532A9B44F32BD91B20632562B976D215077E0554E0076DE4F1C02E728CA62AE37
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ShaderCache\index
Size 256KB
SHA256 4b87db4dfa490165bafc2c6aeea13e03d710302b24cc33a9bd91844c6901fc4f
MD5 ff798ee665c7632d3464bcbd45de1047
SHA1 a630e41711057d0ff042c8bde59456c5b92a9f7d
SHA512 d5cf9fcbb9823cab79ac0dcc03d45c77149b17bbf7a74f0b2356e1b822a7d2a94b51666921c076883fcbe16e0690f8f0e072d87b85d3310495dbf7fb9cf4f137
SSDEEP 3:LsOllllklkXlP:LsUlPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_1197131847\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_393773887\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6004_42430999\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1728-505-0x00007FFBA8410000-0x00007FFBA8411000-memory.dmp

Download

memory/1728-506-0x000002753FCE0000-0x000002753FCE1000-memory.dmp

Download

memory/1728-517-0x000002753FCB0000-0x000002753FCDA000-memory.dmp

Download

memory/2336-552-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-557-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-550-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-558-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-560-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-561-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-559-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/2336-556-0x000001D28BA10000-0x000001D28BA11000-memory.dmp

Download

memory/4660-572-0x0000025043D10000-0x0000025043D11000-memory.dmp

Download

memory/4660-646-0x0000025043CE0000-0x0000025043D0A000-memory.dmp

Download

memory/4928-106-0x00007FFBA97C0000-0x00007FFBA97C1000-memory.dmp

Download

memory/5280-541-0x000001FE93FB0000-0x000001FE93FDA000-memory.dmp

Download

memory/5280-530-0x000001FE93FE0000-0x000001FE93FE1000-memory.dmp

Download

memory/5692-27-0x00007FFBA97C0000-0x00007FFBA97C1000-memory.dmp

Download