0d60c970c4cf736838be31608aa854372f3ff0cf28e91f448bf5749af5f5f68a

Resubmissions

26/10/2026, 19:09

261026-xtv3esvy5m7

25/10/2026, 22:11

261025-133qeabx9k3

Analysis

user interaction
yes
max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OpXOyuApWKTlFzrV.zip
Size 13.1MB
Sample261026-xtv3esvy5m
SHA256 0d60c970c4cf736838be31608aa854372f3ff0cf28e91f448bf5749af5f5f68a
MD5 2e7bef70df66fb543d915db31a3387f0
SHA1 d6215a6e0463e876a13e397925d070d03f5c89c5
SHA512 15f51ea7896dddc828f26bffb9188cec721fe1103d2d0f17042ea05b0d3a4a04bd41bd413291a82bf8aafc61e257c431758c95599cf85a3292cb44856387046a
SSDEEP 393216:qmPpdxy3xU+YQt0FM23pHvSXjipZ+z2uvej13XmjGn:qmPpdxyfYQWKKPSmbKrGj13XYo
TLSH
T1A1D633C014C6EC58EB579F252E2D7D7BD882A90802E3F567741CA2F78E168A06FB547C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5068	Potassium.exe

Loads dropped DLL 4 IoCs

pid	Process
5068	Potassium.exe
5068	Potassium.exe
5068	Potassium.exe
5068	Potassium.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3032	tasklist.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1340	msedgewebview2.exe
3896	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6084	Potassium.exe
5068	Potassium.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 1340	6084	Potassium.exe	94
PID 1340 wrote to memory of 5324	1340	msedgewebview2.exe	95
PID 1340 wrote to memory of 3204	1340	msedgewebview2.exe	96
PID 1340 wrote to memory of 3204	1340	msedgewebview2.exe	96
PID 1340 wrote to memory of 3204	1340	msedgewebview2.exe	96
PID 1340 wrote to memory of 3204	1340	msedgewebview2.exe	96
PID 1340 wrote to memory of 4604	1340	msedgewebview2.exe	97
PID 1340 wrote to memory of 2020	1340	msedgewebview2.exe	98
PID 1340 wrote to memory of 2020	1340	msedgewebview2.exe	98
PID 1340 wrote to memory of 2020	1340	msedgewebview2.exe	98
PID 1340 wrote to memory of 920	1340	msedgewebview2.exe	99
PID 1340 wrote to memory of 920	1340	msedgewebview2.exe	99
PID 1340 wrote to memory of 920	1340	msedgewebview2.exe	99
PID 1340 wrote to memory of 920	1340	msedgewebview2.exe	99
PID 1340 wrote to memory of 920	1340	msedgewebview2.exe	99
PID 6084 wrote to memory of 3864	6084	Potassium.exe	100
PID 3864 wrote to memory of 3032	3864	cmd.exe	102
PID 3864 wrote to memory of 4928	3864	cmd.exe	103
PID 3864 wrote to memory of 4040	3864	cmd.exe	105
PID 3864 wrote to memory of 5068	3864	cmd.exe	106
PID 5068 wrote to memory of 3896	5068	Potassium.exe	107
PID 3896 wrote to memory of 3744	3896	msedgewebview2.exe	108
PID 3896 wrote to memory of 2896	3896	msedgewebview2.exe	109
PID 3896 wrote to memory of 2896	3896	msedgewebview2.exe	109
PID 3896 wrote to memory of 2896	3896	msedgewebview2.exe	109
PID 3896 wrote to memory of 2896	3896	msedgewebview2.exe	109
PID 3896 wrote to memory of 5728	3896	msedgewebview2.exe	110
PID 3896 wrote to memory of 4304	3896	msedgewebview2.exe	111
PID 3896 wrote to memory of 4304	3896	msedgewebview2.exe	111
PID 3896 wrote to memory of 4304	3896	msedgewebview2.exe	111
PID 3896 wrote to memory of 3340	3896	msedgewebview2.exe	112
PID 3896 wrote to memory of 3340	3896	msedgewebview2.exe	112
PID 3896 wrote to memory of 3340	3896	msedgewebview2.exe	112
PID 3896 wrote to memory of 3340	3896	msedgewebview2.exe	112
PID 3896 wrote to memory of 3340	3896	msedgewebview2.exe	112

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\OpXOyuApWKTlFzrV.zip
1⤵
PID:3764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:3248

C:\Users\Admin\Desktop\OpXOyuApWKTlFzrV\Potassium.exe
"C:\Users\Admin\Desktop\OpXOyuApWKTlFzrV\Potassium.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6084.5100.5878558831308706335 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffb4a0e5fd8,0x7ffb4a0e5fe4,0x7ffb4a0e5ff0
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,14453765040755889446,3366504810466071000,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2108 --field-trial-handle=1760,i,14453765040755889446,3366504810466071000,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=1760,i,14453765040755889446,3366504810466071000,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3488 --field-trial-handle=1760,i,14453765040755889446,3366504810466071000,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
    3⤵
    PID:920
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\potassium_update_6084.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 6084" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- - C:\Windows\system32\find.exe
    find "6084"
    3⤵
    PID:4928
- - C:\Windows\system32\xcopy.exe
    xcopy /E /Y /I "C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\*" "C:\Users\Admin\Desktop\OpXOyuApWKTlFzrV\"
    3⤵
    PID:4040
- - C:\Users\Admin\Desktop\OpXOyuApWKTlFzrV\Potassium.exe
    "C:\Users\Admin\Desktop\OpXOyuApWKTlFzrV\Potassium.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5068.2468.8198840358526255842 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffb4a0e5fd8,0x7ffb4a0e5fe4,0x7ffb4a0e5ff0
        5⤵
        
        PID:3744
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1832,i,6704634857085767047,16543402851931706533,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:2896
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1888 --field-trial-handle=1832,i,6704634857085767047,16543402851931706533,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5728
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2456 --field-trial-handle=1832,i,6704634857085767047,16543402851931706533,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3476 --field-trial-handle=1832,i,6704634857085767047,16543402851931706533,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
        5⤵
        
        PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

potassium_update_6084.bat

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084.bat
Size 705B
SHA256 4ad4435b945b0832bbad9f34b4bf459c293a3825841abec27bfd69f51b90d11b
MD5 4e2148a431fda615e1243dcd0ba7aad1
SHA1 5aba82c80aa3694303ea0212c77336bb4a238921
SHA512 77d4cd87f339678bfb0b77b191151de584bc033e04da53921b2cbc1c8e902f853c6f6dbd201081be9f64c50a80824c112d0ea0baa05021fc076ecbf428906824
TLSH
T11A01247E108C8D1705369846C6BE800DF0BECD6B1F063EC4421A947BA162827FE6D986
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\Potassium.exe
Size 27.0MB
SHA256 c16fc7327138a291d9a2667dbd4b76ea007faf795f8b08aab31a7f1c3d6e3ce7
MD5 81774287f7669a607c9951dc0db7a134
SHA1 1d4323b770074068d7cfca2e62d8c63985edff43
SHA512 657a2bf80046a0306fdd773d40471f073b811f6d691a21712c8255fe2fec2ea6291c39280dae863889e85e15c2a821bbe995fe76c5e91928073a51611143daa1
SSDEEP 393216:KDcUZnw+6kxMdwMCfxu6wDwd1KfTB/r8z:wcU6+aq4x0dIbB
TLSH
T11C574A217A5A996CC05BC474C38B4A735A7130CB0B35B9FF449492792F7EAF86F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autoexec.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\autoexec.lnk
Size 1KB
SHA256 006d6168d27c62c347d1b5c3c493f9d9f47d4f24998cd1ed4e6af55386d2a745
MD5 a2f6abf50bc9a739d90905aa42153343
SHA1 4bb0b291fd763628bc10770ed2ca015bae3d2380
SHA512 d898517c1e201b2b32c2765aa4486bea8190275f12cefa2a93eb44658d693507ecc81f7e27450507e3b392c2f9640d63d3d341d5b1b20677d62ff68d8b172a3e
TLSH
T17B311F1D5ED51720CBB988B617AF2306E76324527BAA4D2606448A4E1A22542BE58F1F
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scripts.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\scripts.lnk
Size 1KB
SHA256 00ee5ac203f530c285231a8d1055764ae6bc6056812b2ff6b2b400c13eedb4e1
MD5 368718555cd69e85c33ab66442815cdb
SHA1 8e2eda2fe3c0a6c853cd471e17a271883f87c42f
SHA512 3e235efa55411fcb8aee573ea8a81298302ebb0003ba20a42e81cf2cb79d7969cd684e009ca2d4e03610225705c9f28e70933dc33c2be16a2683e2d92a536359
TLSH
T18131325D9DC80F31C5F58C7757AF2706DB6054627F9E9D260E94828D1E22A02EC54F1E
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workspace.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6084\unpacked\workspace.lnk
Size 1KB
SHA256 24ab09465ffc09f89917a776325062f23b679456a0d36799b4cab65242f7dbd4
MD5 4cf25c84d3e866e83709df8a6601df61
SHA1 89258dd5f24a2d681702e950f491f200fe4d0941
SHA512 760096b6983d8b9276398e216211b858835e016e7e348838cc59af4f1d3927652cc61d2fa96ca3847dc00b820888516ea76d4dfa7612cc426e14ff26f1e1fc83
TLSH
T1C231351E59C95E35C6F6C83527DF370AE73450A5BF894D01419081491D329C2F854F1F
MD5 SHA1 SHA512 TLSH

Submit Download

4f81bb3c-967e-451b-8738-25dfc0b24958.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\4f81bb3c-967e-451b-8738-25dfc0b24958.tmp
Size 3KB
SHA256 44e71874daac82afe43f610c6f9705dac1fac09168bd10eff50154cc9431de2b
MD5 2b6a5e55fa2ed8c80fd9a84919edb931
SHA1 895637d288c3c638909fae1d8c212ca896372e18
SHA512 efb8c27065f2891b4f15f4116c76d43393704749e0e0826fc5d7f8c1920135ef6fb7b137f86bbcfa811b9d8e1dfee57e7a4f11277fba08f40af8275fbbee0dc2
TLSH
T197819422A9B4A9379DF6CA0979463F07E678A023D5853F95C6ED0F1C01A77CC1386827
MD5 SHA1 SHA512 TLSH

Submit Download

589e9504-2507-4daf-9cbf-af16ffead105.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\589e9504-2507-4daf-9cbf-af16ffead105.tmp
Size 3KB
SHA256 c96f7ace178e5fa79bb9f227c769ca70335b79af271c1426a05e1e93a914d932
MD5 93cc61af328660b843253a73e9f86382
SHA1 c864e57e3996309ceda845a0892b6a4188c2ca04
SHA512 6f947a9142750ec0415475684963be8ed5654ddd8779218e3217fcfe9d07775c46a7f1656b80492339b6967d8f29f0303ec9c260f682dec468256f4205c3da11
TLSH
T1BD619333A974AA378EE6DE15B9863B06E6B59023E9823F95C6ED0F1C01D77981341C27
MD5 SHA1 SHA512 TLSH

Submit Download

6dc8e747-1183-4531-a091-6a767d75ee30.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\6dc8e747-1183-4531-a091-6a767d75ee30.tmp
Size 2KB
SHA256 97320cc8a3aa4fdc824fe7efdf886f50539bb660a3f6570ac3629ba8b18b6899
MD5 270a9f9c1502a334b0c3135ecba25df6
SHA1 d55a85ae8a88906c1be2d609d74cd4e3c82b76be
SHA512 c46d9dea13a0d90148855daa82a26a3f2172b97a128a8d9d2040c318948088ed48c5323ef641ef170186bc480ce1bffd127483c1d0f0dba4c6b676bf87a7ef46
TLSH
T182519233A924AF37D9E68F69790A3F13DA399061DA922F5096DE0B2C0197B9C1345C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 245d9ecfdcac288834f0bbfd4ce94100eb358d2024ab98edd97d00022bdd4d58
MD5 cb724e0824fa677067e4871d9cf5b95c
SHA1 2419d876bec3f8e6ab41a03d54f305a068076b31
SHA512 4871e057a31e82cd2de87bad34926c497d3890485529254dfa18f45b7e6380b9da5f48aecb3ec81f3a38de0cc5e34fc8050fba657ffea8970620d8362f885fe3
TLSH
T17DD0122233074134C0102433044261480E40D61F81854100543885ED3A084F01D42483
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bcf685423277a2b0c1f66b525131826a3d480a2ec6c1b6d795726d8c9c6167b3
MD5 ee701eca923329e3a3e14e96ca361439
SHA1 397e1bcae7fc2aae294f730d414c3801be9e339f
SHA512 678a024fd958bc96338b20489cd710c01f4fe70e0c0cf8f4463d7d0d0bef2d1a18904ddd75eba1e05885af0023c313d357dddc4a8647598e3a630b80216c41b5
TLSH
T173D0122237074134C0102533040161480F40D51F82854200543885FD3E084F05D82483
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d3f52e3abbdcb5a5c22497785a6461c4e71d2dc0a7807f74d71355fd6f785d43
MD5 113742569ebfb91cda79cc39548440ad
SHA1 1d42b30000b0211fee8d869dd3e9aed06c36f9a8
SHA512 753c4bbd8254f7448839c22e9da76a2e9a213a6936103542bf98b5f7717333eba84dd725c65322be13f07d68582c1a34774c629c5397236c6a00e89ed1514a99
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

876ecf68-4a0a-4812-8903-47f628cf06b2.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\876ecf68-4a0a-4812-8903-47f628cf06b2.tmp
Size 6KB
SHA256 4e864563c0b8b6a532337ed83142e46c5b4b4ed38ee40d622bb9757dff16a56a
MD5 00a5228d0696b64c301f340f31113a54
SHA1 8ec0e586e8c8f303ae6801bb2a5351ba35d19c52
SHA512 2546709b4d7b89e8eb6c2f0cbaa1b8d85455c1cd33747440352595a1dff7c8d60d8f32e67d68d324024fc59920e64c1472c58694a7f0239ed0a16730fffffcc1
SSDEEP 96:stY/dbiGGbDZk+5do5h16Z0ksLn8/x+6MhmuecJ6wMkkjeDK+ggt28XM1C7K:st8NW/onksLG+Fd6wwjNsG6K
TLSH
T1ADD1B6069E24797B4CCAE909BA35BB17D2F99022B5D51E49E7FC492C04D7BCC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 2e8a9e6383ae06a4245d8665fac769cb2eec9149fccb64d1e456ad2ddcdc4e3e
MD5 63d75ca726ccc77c734c8e172aa9551c
SHA1 c65d4e94a4fcc190b957be0f64b9fd4b59a8ac88
SHA512 57d3087275eacf8d01a2ba785591c93204900764cb31d4217ae26c046ba9b288044175238d97751c8f1f4760f8e92b30cd35531d4023f056bd3333deaa979d4f
SSDEEP 3:LstlNllklkXlMX:LsX3lP0
MD5 SHA1 SHA512 SSDEEP

Submit Download

9bfdde6204035f00_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\9bfdde6204035f00_0
Size 258B
SHA256 4cd38d8c17235e3a63dc41660a614b5a966023e393a7fae4ca7c3eaf5334aad9
MD5 88e241ab67987ebfa29198733d1adc04
SHA1 c601f775c5cca90b526fffb1001d18eb06e5cf8d
SHA512 54b047b7f0186bbd3fe9336b8de222bdc40ade83a129aefd368e821835e6bfdedb72170ab23d901910a1b7ccdb3c293318923b3c5cd335be4fe10362e828506f
TLSH
T146D0974F4B911B8CC52CADF0CFFE29A98B4291F1004D8A819034E82203C0E2D7628B20
MD5 SHA1 SHA512 TLSH

Submit Download

c790f9fc7de6ea9c_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\c790f9fc7de6ea9c_0
Size 256B
SHA256 4bb2ba0d95bb1b34cb1202caaf1e42f9a848e2d4e4038050be4c6ebdf387b251
MD5 3fd710bae49e8dc4004f223411e23ab7
SHA1 0cf0ab31b4321c0d7aaa680671a37ef4a17d0718
SHA512 a6869f9491b43ea7dfd9299d95301faf9d3fd3a0e07a03674dbf95732891888b22d2f87b4e418798ddac3f3848650d49ff00cd6b65888e7b9a11a1d953184d81
TLSH
T158D05E8F4F6926A5C255C8F09F9AAA578A9681B0046C9922A0B7E8623090629A51C618
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 d5f0c452fd1999e2200a8a8106ea9ce035a6561231799d4c44b8648d8b891329
MD5 93706f304675e6c21841bf5c5cfa14bf
SHA1 0f7d8ee1ca0b20b7e05f942c58373345bef5e5c1
SHA512 48e7270ae021dbca7302b63d246de0615a05b53ee02813e97bbb8a439430bc8c00b7a471ee5b9a9ce6708f31d828ac73785e70992f93454fd0099f9d225a5f58
TLSH
T17BC092248082C004D31C427223D240D87030E4602A836D08F1A8C0BCA9163C0A6C7AA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 643db10fd4fac2228fdea42334e565a6ad9c7eb407d0c5dc7008e310437cb400
MD5 d9af730c89a2414c13eddd3c3a3bd87b
SHA1 5b7158f23b475096dbe6896c84af5be4fbedf752
SHA512 8b14b2d700a2018fdc1e139aa1f687e54347f00bde2506997610c79a28209fad7de615095fafbbf9c7b5fda2fde693719cb78b2e918961d545019314d06aaaba
TLSH
T190B00228C20A1621C60843F163FB41817538DC901FD76901F2AEE1BCF5213D8D993841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 079d9dbbfbf05d7a5c9436f4bce0d91fa973b84e11e026f9eb668513e19b5572
MD5 7e781cc3a16ccc1c0ec95cf980f0c6e1
SHA1 d98fbd2d0703676c95644c1e3745621a3e790f06
SHA512 19e16f0728856b98fa7c04bf385c8cd0f223bfa3629507227114514119aa756d3bb9102b8f418dc1fc775e1c8a0b218b782dbe153a46bd8764add814614584ac
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension State\LOG
Size 299B
SHA256 2eb6b4867f0566611cae47ae243162c423888b919a5bb4695afa863c3ab8d59c
MD5 0523bde2e7163dfdd6b0befb0c9bff99
SHA1 9cdd60b26de2ac8a39457ca6936f618c8cc5196d
SHA512 9080b7d0c068557a7c2250b7b6c5f69afe0f2801d1e0692bd2ceecd74690ee7ac472fd5b067f0c82e24c09437c3a6740ec13ec15301f6e9bc71b12dadb706bd8
TLSH
T156E08645388DC26695D88CE7467E1B4CCF5528D877883A4E0B1DDB1420C748EA350741
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\History
Size 164KB
SHA256 922838bb44415fb0b670166c797ca8625c37d64c8433566bceca4a29011b4dfd
MD5 546934993512fd1871ca541fd8701e65
SHA1 a69b45c51686ff044180d20040d0b72b93b120a2
SHA512 01c8a29989bb1a19329b4e6bf8ff299c53c9bf03d36da91cbd1d245942aecd6d7df1549caa608b134a05e065255ed53b5b2b5d578adcd59e5657a3b46fd83b67
SSDEEP 96:8B8l25LqL/uejzH+bF+UIYysX0fxQp97YEHt/DfLVVVN6zRk/E0LEV:8Bb5qL/tH+bF+UI3iWGVYWNVVV63LV
TLSH
T194F3FA5E5F243312CDBD923768E745B3597DF03F87236A866C6204B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 a4a6011aacc056ee8736e1835c8fd892a046d5060c01c97f5cc7aa9b63e33b45
MD5 e4e80509b27231d204958c8de70ca937
SHA1 ddaaaffad1b6a8545fd07d33ee568b73a88158dd
SHA512 6eb860a2f44e2ca62e883051ebff22045ece53cbdc6a8c3a491fb46906e8d2160e9f742ab81e80414cf7b2c7a1f9f00850eb7b5cf1bb10950da8af403245a5cc
SSDEEP 96:rY/dbiGAb9Zk+5do5h16Z0ds7/x+6MhmuecJxe1ejeDK+gMXI8XM1C7K:r8N+/ondsV+FdxeQjNyg6K
TLSH
T1F4D19506AE24A97B4CCAE908BA35B617E2F9902275D51E48EBFD456C04D7BDC2307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 bb43150ce4aa8afd0de981179c91956b8bdbc41679ac603bed12b6ec56481355
MD5 7c4bef5ac1c6bd005957b0efd57b4200
SHA1 b9b9064caf2ba7977736572d529811f996f2af31
SHA512 9508ba048d85d7a34bf83c3299813e69cc98367160008948ed8b4ebdf6e88018d715a700b88262124e13eeb17e2e7e62b3f6a9f7d24aec17266fc8689a823fe8
SSDEEP 96:v3iNPlf/ROo1pkF5d13iA7VaTEv9V5h5pg5+e0DbBjDmWv1P1U:KtvDs9ljdfPu
TLSH
T112C1B6A3062DC174BF444BEBEC397ACAD9A600CF98D94C0A96E2C44806C1FFD21DE495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 9794129acf2d1b8ef229508233437205828adc74e905cc9d72e150855c765d47
MD5 70a1afd7503808646cc520fc2456a81f
SHA1 8e945a088d5e75ac3ab601c7e37812f56d6f72fe
SHA512 c421269c1656474dd4f695cda357b4b1fd8d19c295969bd627420d0560cebdf9792560b241c3fe81fb02fbbb46662425e874f3ded7d1de9ee1f5accedf41ef93
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 3739a76195f48a2a12ae87a1ac74f4c4376984ab5a440a49bd98a765ec84c1a7
MD5 74884838c06b1019cd6c6e25ce8a6b8d
SHA1 0f0ce00aa6676359263b6c7ca5632263bb9df435
SHA512 34def264a458455b8f5ea089b3e85057b8091fbda4f2dda0d061dc2a369fae93674cc7a6c9a806f5695706ee86a0743b30d1bf0181315cd6354e8072bbdc7cdc
TLSH
T19AB012817B019127C2ED0F3D0284C7F07320E2036501240388648F314FBA3E46E008DC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\LOG
Size 327B
SHA256 746b06b55dca152d642cd1d7bb8d31cc244920c293e77089698540d03e609413
MD5 a795e41bd071366b0df8b05deee0f0db
SHA1 3d2156d16283be185354636a0621fa57fac1bfcd
SHA512 ceb4ce4e0ae7841d5e4f4d948ccf9dc318dede6ce1d6cdb92762492e45003f0cdd425b4a4dcf9dadadcc2685c33c05ca2ae8e9cd1ba670bb1a91b7ab4ae0bda9
TLSH
T17AE0D82039CDC36B21C548DB123AAF4CCB156490A6C95A1F1E29F744118B4887242741
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\LOG
Size 301B
SHA256 8b3e0cf63e98d41ab3805de61bf2791def4d5a8647bd771a81fa71c2a3d8dc52
MD5 79cfef4bcf8843feb0348a09bb282d7c
SHA1 1e98bd15f571d13d1708eb8aaec181c73ce380f0
SHA512 1c982fb0bad0841f6a180ea06ba9d0db36d1922dadba338367599b3e80a15b513fcf66808e57bd5c7ad61cfb7be0bbe90f6f5b923d1e585ef2d6cab6ea6b0114
TLSH
T1AFE0867178CDC37A54C488D6067E5B5DCA746C9457C93A4E4B18E70824CB44DA671781
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Visited Links
Size 128KB
SHA256 0d992e450b51ff91907b56aa4abd6402418e3b4c98456e88b176879e71a0aa7a
MD5 5e12a9c1fdb720ba505117be41eeb2b6
SHA1 a334b353b9d5fa8b2f56ec9d32c038295f1ec89e
SHA512 057e452d06512b6283a66da5ee4b14dc60a983af59a6af81baf6949e9dcbd10ae57ea14d2a7784bf016b801a43204b324e4cad29fdd3865723bda46381f677f6
SSDEEP 3:ImtVuXR1t4:IiVuB
TLSH
T1DAD3040473151C51C40D1135C40D1D174175C14000F5044117FC1C71D44130D450F741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 16KB
SHA256 99daddfb70004f8b45cc7363339db5103facb480cfcd72669698f91895d4c246
MD5 e07370e26d93b30f2346ead95107a597
SHA1 50ea49e3f8c411a26058d22244e1c326f058cfc0
SHA512 903b3b2c89313bad2a22e17c41784a123b41b56e89cfd9420f0552050e6e41994aea3cdc4583475bedb60db47870388a343e1e5c8f89422e2edd300f7ca8228d
SSDEEP 384:x+OBqImmJvGBLx3NaFMJFR3NBSzgX+tFZg6rr:8cvGtlNRf8F7v
TLSH
T17E729D762C656A332CEBCA0ABA8D3747CB71A253C4C57FD5D9EC9F0F016B6940342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 0e576a4c94f4b35028734e6d54e4cacdb3cb0e3552035013580d7d0b9e382bd3
MD5 527822c7b94da95be99e930021a81651
SHA1 7083bcd4c7e4547d13ce42cce7b8a358cab1931e
SHA512 063f81a65dfc0524893980da8193823204353fbb8c58f0dc6ad9be91386d5c226634db88e8fc4ee63f0b48289b6378bfe04fc9368893e49e5c0608dd14d91dd0
TLSH
T1DD216873D5645F33ED966FA621063F17AD314066C1514F4452DF4F2C02A339D461E833
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ShaderCache\index
Size 256KB
SHA256 f544dcd0a8957f223e820a2682a92ccb4504172c19d36c5124d682760e97b21b
MD5 3c08572771ecdb2071843dc35143e37a
SHA1 624f1b73cd29d8393585ca6bfa2d3405c02cc284
SHA512 ffacbff66c092ed624878f2f2fd79a1a243c643dd0450778d88cf4e497a3abd6e55d7206c15b9b11507153e06aeb31bffd2b466dcf7860af91fbf45f9e2c4038
SSDEEP 3:LsOllllklkXl51+l/:LsUlP6t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

ca844793-ce70-4d83-863a-098f479808e0.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ca844793-ce70-4d83-863a-098f479808e0.tmp
Size 16KB
SHA256 8cc50c62d684556434ef561248ba7e3cf830070c16c0b782130ec6aea59abdd3
MD5 2c671bb159757b85f360cf7e5111d237
SHA1 39137110e134e4520a290081f50170a4f29d311d
SHA512 dd70334c92e3085c77a95717d0a2e2d9452270f0ffbe3a6dc0670a82765b71b13991890433a5f2a8687616b08c44555be9a47677624b952114b12c3a04b2be44
SSDEEP 384:v+OBqImmJvGBLx3NaFMJFB3NBSzgX+tFZg6rr:ucvGtlNBf8F7v
TLSH
T111729D362C656A232CFBCA0ABA897707CB71A253C4C47FD5D9EC9F0F012B6940342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da42b88c-42a7-4a12-8323-bc4e7904ece9.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\da42b88c-42a7-4a12-8323-bc4e7904ece9.tmp
Size 3KB
SHA256 71911a295f26fde50496a67eafea4774e9a80d2d64951d48db6f7ac374342f2f
MD5 960d9ad26b4feda3b196d48dd46a7531
SHA1 6e3d1ab28a3af072abe068d6e1448954f2fc8a85
SHA512 1b891b71c7707f861f1672433033793cfa7638c9fcd1400ee6f57e25171f200df039bb392d8c1fce64e4873be7dda389463f0ebc38db8342b4d85f07262a616d
TLSH
T19B81B422A974A9379DF7CA49B9463F07E6B8A023D5852F95C6EC0F1C01D37CC1386823
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-100-0x00007FFB6F170000-0x00007FFB6F171000-memory.dmp

Download

memory/3204-20-0x00007FFB6F170000-0x00007FFB6F171000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads