045ddabe5cee2d12468ac179759559064e4c61af695396372973138611a6ee27

Analysis

user interaction
yes
max time kernel
165s
max time network
169s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 27.0MB
Sample261030-tc7hcaz13q
SHA256 045ddabe5cee2d12468ac179759559064e4c61af695396372973138611a6ee27
MD5 d6f96ce56f29c0753e3cfb1efa3e427d
SHA1 b35dc6ac222628e228a4d7a5df60fc49eb95869c
SHA512 571a6f5bc61a6b073197d4cba173de6761f330e92f2cb67b46a40179679022b259a23acb8184767bc4ff636d6af760ec928c4d0fa8230d930c020bbfc2c8c5d2
SSDEEP 196608:vcD9kVhaSQfqvpZZoTOKHBB30vVUkP0KJNTTH1/kapldwfS8ZBDPwdtiyB0nfIZC:3haSQIpZZkOKhOfMKfTyV6wDwdDB5C
TLSH
T1C1574A257A5A996CD05BC474838B4A738A7130CB0B35B9FF549492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3508	Potassium.exe

Loads dropped DLL 3 IoCs

pid	Process
3508	Potassium.exe
3508	Potassium.exe
3508	Potassium.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3684	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1103459855\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2008204531\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1103459855\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2008204531\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2008204531\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-sl.hyb	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1244	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6016	msedgewebview2.exe
6016	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4556	msedgewebview2.exe
3200	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5924	Potassium.exe
3508	Potassium.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 4556	5924	Potassium.exe	89
PID 4556 wrote to memory of 2976	4556	msedgewebview2.exe	90
PID 4556 wrote to memory of 4956	4556	msedgewebview2.exe	91
PID 4556 wrote to memory of 4956	4556	msedgewebview2.exe	91
PID 4556 wrote to memory of 4956	4556	msedgewebview2.exe	91
PID 4556 wrote to memory of 4956	4556	msedgewebview2.exe	91
PID 4556 wrote to memory of 944	4556	msedgewebview2.exe	92
PID 4556 wrote to memory of 6108	4556	msedgewebview2.exe	93
PID 4556 wrote to memory of 6108	4556	msedgewebview2.exe	93
PID 4556 wrote to memory of 6108	4556	msedgewebview2.exe	93
PID 4556 wrote to memory of 5836	4556	msedgewebview2.exe	94
PID 4556 wrote to memory of 5836	4556	msedgewebview2.exe	94
PID 4556 wrote to memory of 5836	4556	msedgewebview2.exe	94
PID 4556 wrote to memory of 5836	4556	msedgewebview2.exe	94
PID 4556 wrote to memory of 5836	4556	msedgewebview2.exe	94
PID 5924 wrote to memory of 1244	5924	Potassium.exe	95
PID 1244 wrote to memory of 3684	1244	cmd.exe	97
PID 1244 wrote to memory of 2516	1244	cmd.exe	98
PID 1244 wrote to memory of 5580	1244	cmd.exe	100
PID 1244 wrote to memory of 3508	1244	cmd.exe	101
PID 3508 wrote to memory of 3200	3508	Potassium.exe	102
PID 3200 wrote to memory of 2700	3200	msedgewebview2.exe	103
PID 3200 wrote to memory of 6056	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 6056	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 6056	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 6056	3200	msedgewebview2.exe	104
PID 3200 wrote to memory of 1448	3200	msedgewebview2.exe	105
PID 3200 wrote to memory of 4448	3200	msedgewebview2.exe	106
PID 3200 wrote to memory of 4448	3200	msedgewebview2.exe	106
PID 3200 wrote to memory of 4448	3200	msedgewebview2.exe	106
PID 3200 wrote to memory of 3472	3200	msedgewebview2.exe	107
PID 3200 wrote to memory of 3472	3200	msedgewebview2.exe	107
PID 3200 wrote to memory of 3472	3200	msedgewebview2.exe	107
PID 3200 wrote to memory of 3472	3200	msedgewebview2.exe	107
PID 3200 wrote to memory of 3472	3200	msedgewebview2.exe	107
PID 3200 wrote to memory of 3316	3200	msedgewebview2.exe	111
PID 3200 wrote to memory of 3316	3200	msedgewebview2.exe	111
PID 3200 wrote to memory of 3316	3200	msedgewebview2.exe	111
PID 3200 wrote to memory of 1236	3200	msedgewebview2.exe	112
PID 3200 wrote to memory of 1236	3200	msedgewebview2.exe	112
PID 3200 wrote to memory of 1236	3200	msedgewebview2.exe	112
PID 3200 wrote to memory of 6016	3200	msedgewebview2.exe	113
PID 3200 wrote to memory of 916	3200	msedgewebview2.exe	114
PID 3200 wrote to memory of 916	3200	msedgewebview2.exe	114
PID 3200 wrote to memory of 916	3200	msedgewebview2.exe	114
PID 3200 wrote to memory of 5088	3200	msedgewebview2.exe	115
PID 3200 wrote to memory of 5088	3200	msedgewebview2.exe	115
PID 3200 wrote to memory of 5088	3200	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5924.4592.5125366983372370209 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9cea25fd8,0x7ff9cea25fe4,0x7ff9cea25ff0
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1812 --field-trial-handle=1816,i,1997391004649068862,412644569440885193,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1816,i,1997391004649068862,412644569440885193,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1816,i,1997391004649068862,412644569440885193,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.3.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3448 --field-trial-handle=1816,i,1997391004649068862,412644569440885193,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\potassium_update_5924.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 5924" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\system32\find.exe
    find "5924"
    3⤵
    PID:2516
- - C:\Windows\system32\xcopy.exe
    xcopy /E /Y /I "C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\*" "C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Potassium.exe
    "C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3508.2880.8196639097765478805 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ff9cea25fd8,0x7ff9cea25fe4,0x7ff9cea25ff0
        5⤵
        
        PID:2700
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:1448
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
        5⤵
        
        PID:3472
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4648 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=832 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:1236
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4616 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4612 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:916
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=1760,i,11381353440891243513,4268864434103093635,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

potassium_update_5924.bat

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924.bat
Size 693B
SHA256 0356954d951af2138051d5b150e2e8538c0383c4aa38f795768f2b3f4476eac1
MD5 747656cafacdbdc01341b1cfee32f25e
SHA1 a330da7206f660af0bfdc1597fb5786cb99057c1
SHA512 3cf8405bfbe0de34fbd090fa11b007709e33b576413d0984160db1398cb0ad18b9ea77da6b338256c7ac7fc0ae763ce9616066dded0ee610365f783e20bc5bda
TLSH
T1DE01473D5049CD2B14391842CABE400CB0BEC96F1F0B3FC4831AD47AA11290BBFAD686
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\Potassium.exe
Size 27.0MB
SHA256 37bdaed6adbca3edc70e57d644537c6c8c0c5e6ea1fd2e99aa396680f4165166
MD5 56e55b1e276a6dd57f1bc10f20db0904
SHA1 92b75e0d8ae7c1593de2d6dfaf1ae5a10657604b
SHA512 9673f4daf6ac0f670afb7db84e1049c21bd6cf2e8e4443cce6c93beb010ebb3fb5d2dac832ec290a230c2c99b04afcfe66ebfed5ca8a21b28cf0ac0521493534
SSDEEP 393216:FlbkOme1W/Z63OoyfzL0F5nKfTq6wDwdv+nj5s:F5kOmBh6by3Rbqx0dvMt
TLSH
T177574A257B5A996CC09BC474838B4A734A3130CB0B35B9FF459496782F7EAF42F38658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autoexec.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\autoexec.lnk
Size 1KB
SHA256 006d6168d27c62c347d1b5c3c493f9d9f47d4f24998cd1ed4e6af55386d2a745
MD5 a2f6abf50bc9a739d90905aa42153343
SHA1 4bb0b291fd763628bc10770ed2ca015bae3d2380
SHA512 d898517c1e201b2b32c2765aa4486bea8190275f12cefa2a93eb44658d693507ecc81f7e27450507e3b392c2f9640d63d3d341d5b1b20677d62ff68d8b172a3e
TLSH
T17B311F1D5ED51720CBB988B617AF2306E76324527BAA4D2606448A4E1A22542BE58F1F
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scripts.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\scripts.lnk
Size 1KB
SHA256 00ee5ac203f530c285231a8d1055764ae6bc6056812b2ff6b2b400c13eedb4e1
MD5 368718555cd69e85c33ab66442815cdb
SHA1 8e2eda2fe3c0a6c853cd471e17a271883f87c42f
SHA512 3e235efa55411fcb8aee573ea8a81298302ebb0003ba20a42e81cf2cb79d7969cd684e009ca2d4e03610225705c9f28e70933dc33c2be16a2683e2d92a536359
TLSH
T18131325D9DC80F31C5F58C7757AF2706DB6054627F9E9D260E94828D1E22A02EC54F1E
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workspace.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_5924\unpacked\workspace.lnk
Size 1KB
SHA256 24ab09465ffc09f89917a776325062f23b679456a0d36799b4cab65242f7dbd4
MD5 4cf25c84d3e866e83709df8a6601df61
SHA1 89258dd5f24a2d681702e950f491f200fe4d0941
SHA512 760096b6983d8b9276398e216211b858835e016e7e348838cc59af4f1d3927652cc61d2fa96ca3847dc00b820888516ea76d4dfa7612cc426e14ff26f1e1fc83
TLSH
T1C231351E59C95E35C6F6C83527DF370AE73450A5BF894D01419081491D329C2F854F1F
MD5 SHA1 SHA512 TLSH

Submit Download

2e857488-6987-45be-a183-77c6b81d0bca.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\2e857488-6987-45be-a183-77c6b81d0bca.tmp
Size 16KB
SHA256 9e17bcc950caed2e720d8c475b5445402ad04cf28e11e2f0e1289b6d1e365a45
MD5 aafc170ddf716b080b9464aba2a2e7e4
SHA1 44faa75d9bfe399d10658618f13df4c9ee58f1ba
SHA512 2154fca0b070e5cdc6782767a3f8b7f1daaf90d1bed837895814647ba14672a848ef4942c15c29900f55dbd4f1ca9669b92f4641c9dec58dfe388016f0718dc1
SSDEEP 384:U+OBqImmJvGBLx3NaFMJF03NBSgBV7JSg6rc:lcvGtlN0N1J0A
TLSH
T146729E762CA56E372CFBC509BA8A670BCB746263C4847BD4DDEC9F0F016B5541352826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ffffcb4-b341-4178-ba8b-fcae787948e8.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\6ffffcb4-b341-4178-ba8b-fcae787948e8.tmp
Size 3KB
SHA256 457e7254ff482917aa04c0da71dcce74482f67524f2cf97cb54201871b834127
MD5 4b299db4863d58290cc35e84c055f63d
SHA1 062d194253afe04ce2cc6f8e34abac076d75f472
SHA512 93a56d58e8e687ecfd4a7ddc27372a780fcec5a6fff1e86a910a9ea952a0c7c060eb18e0952422e74c8b0f28d648bf05c85e736b2598db7bbfecf59ff02adc75
TLSH
T16C6196366DB4A9374DF7D605B8963B16E6B89037E9813F64DAEC0F0C01D76981352C27
MD5 SHA1 SHA512 TLSH

Submit Download

9c146996-ef74-4248-88b8-4880f6bf7c8a.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\9c146996-ef74-4248-88b8-4880f6bf7c8a.tmp
Size 2KB
SHA256 c939df7727e2e03a003f8bb50ae71101ca429526a81aa9aece4ea7fcadd09615
MD5 ce497193729bf3a6c7887b075e70e91f
SHA1 ea5231bc1e7cabc35c9e02c3b13b9b2366d604df
SHA512 9c6e5d88b03bff131e171cbc9ee2161b7ab5f14515c00f1dfaeaf2b59bcc446479a10bed9a6bf40d23b4751184408ae1b614345f4db1396f965b5e4cdfc38b61
TLSH
T13B5151326DA4AA3799FBD604795A3F27DA7990B7EA522F209ADC0B0800D795C5312C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d489e35e1d931b2757bbfc6dba0db0236b7f28dc3a2d7733caed41a0a5fe91d6
MD5 6f6364a6faa698a595d90833d6390fb8
SHA1 2ec1d11d3fe3a608297793d7d450536dc32f119f
SHA512 91d73a6628db53e9fcf1641aa1bfa9870ff3cc5f187cc0db9e4d8e82d741d9c57736aa1aa64fef30a072970951e2fcf85c1c1de4f391d9e808edfdc8d9876baf
TLSH
T12DD0122233D3453CC4202833014275080A42E20F80454000642AC51D1E4406A0906841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1ea9e6549a21e376ecd2d74e40d1d0f8ee34471756994df7113120b889eafff4
MD5 9896d302b0e9df5b85d94efab5cdb021
SHA1 90e093d96b5efeb893e115a9106c1ae54d49d1b5
SHA512 d6c7310e55c0dbea135f68b123a5f77caf336f1c879f7d2d753979304dde540a63fe84b06d76702fe4f4d4b886a549dff880bdb51c4fb3c7c185ba3472e4ae97
TLSH
T1ACD0122237D3513CC4202932010175080B42E10E81454100642AC52D1E4406A0906841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 af324c1686d694d09d99626ad9150512ce562c273f871d8311e53b152aecf462
MD5 7f3e7d03b55e214e70fdeaacde5c0797
SHA1 078187dbaf7e89419b8cedbc6ebd3a46a007cec3
SHA512 d73891222973baf759e57158d029a0bb2d7a42ac26bb0b4dd494d21b086e3913f28530680bf79f6be4a8ff4ef3ce4cd21a4a59615330ea27bafd2e407454044f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

275d483b-2bf9-4d03-9ab6-9d6b98094138.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\275d483b-2bf9-4d03-9ab6-9d6b98094138.tmp
Size 6KB
SHA256 01c15298569a73504ddcebe61f9ffaa1ca9a3a3c603c6be91e35519fced76fe0
MD5 9400cdadff9c2da895a157af1fb5b406
SHA1 c45de00be1f933ca88bbbdb44f7b22e4c8d497f5
SHA512 edb178d4b4d93361e3034952dbe1a3bb5e2e8e7261ee337a68d629d0f9a6814ef28e71883d4beb7c0cbeb4949fc6d1c4f950947eeb430f6b88148f982016e0e5
SSDEEP 96:stJ/dbzIxvqbDbk+Odo5h16Z0msLF8/x+6MhmuecJ5uErje+K+gv8nH28XM1C7K:sttNovW8onmsL8+Fd5uqjasHG6K
TLSH
T1F2E1A4015E64793B4CDBE519BA25BB16E2F9607365D12E48EBFC4A2C04DBADC621380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ff9e6a2-82fd-42e0-986f-5a1271d21ccd.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\8ff9e6a2-82fd-42e0-986f-5a1271d21ccd.tmp
Size 6KB
SHA256 189559aeb3005b1c1bc48a019a2e907f5bbca3e122a50ea92a4376d76269148c
MD5 ba58b78273285f5c403ebc8e58144fba
SHA1 ba718e36584cf937496253a8b010559f5d2e1cb3
SHA512 bf4191dddfdada559b9188109698ee967ec9087f9ba0b254f534fc6390807e59e70fd96be08dfb84d30cd4636d9686f53cb8bb71b3a2483a1e60a98f73a34596
SSDEEP 96:stJ/dbz/GxvqbDbk+Odo5h16Z0msLF8/x+6MhmuecJ5uErje+K+gvoH28XM1C7K:sttNCvW8onmsL8+Fd5uqjayHG6K
TLSH
T187E1B4015E64793B4CDBE119BA25BB17E2F9607365D12F48EBFC4A2C04DBACC621380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d5ff1583a45dc0a5b9f473159a29b1441c8f848ced14ad16748d8ea78b646f40
MD5 508108530cb6b4e8c4745b05f0371422
SHA1 7ba941b92f75512ebdf7b34d67c444e6320a2513
SHA512 343f966d1d8523f7e8c00ddbb3f88ca64b883a6e74439ba828357bf3c3a71709b8e5f087827f97653e7a5e3360f5e94c328874be22de2218e32632ea45d54090
SSDEEP 3:LstlNllkll/l5Gn/:LsX3lEtA/
MD5 SHA1 SHA512 SSDEEP

Submit Download

9bfdde6204035f00_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\9bfdde6204035f00_0
Size 258B
SHA256 f9436fd90a7e61836d3421bab63b357f75247ec3e9396ab21c52488d0faff2bf
MD5 3c41764ff8be19663899c486b4141028
SHA1 6a141f93be9c785967be45c1c01f34227cf49884
SHA512 fc3fba2acad6dbefd0c3c6cbc773cdeeeab35595f0e0694c5076137d8c12db3dea5fdc919698a73fa6d8905698342dad69787d6f1ccd3ad39bc96b8690fb528f
TLSH
T152D0978F4AA1178CC62C9DF0CFFE2EB8870281F1044C4A816020A52702C0B3D3A29B20
MD5 SHA1 SHA512 TLSH

Submit Download

c790f9fc7de6ea9c_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\c790f9fc7de6ea9c_0
Size 256B
SHA256 b290f2fcbb2c638b3ffd0778063a23e9f93567edc7db5d97e2d232a579dd245d
MD5 f5d262fcea393f8d7339d714079e1897
SHA1 365279f7a34f26c424160ff1aecff1c09588b3c4
SHA512 bd23c9235446c593ec063f33504f9eec6aa746294c1b5a99aa056fa06b938434ede397cd7ba6472363c4cfe74c9f55ecf54a152a16c7f7f177583e561728a17e
TLSH
T16CD05E8F4E2926A4D256D8F18FEEAA5BC75601A0885C992280B7A8A33090529A51D718
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 efd9717cc3ed2096ee4ec4253ada961e2e109722c041007bf4b6b2213f3f6bf2
MD5 d01c948277234760ab02bfdc1e031895
SHA1 1b35a6898a4f242e02d378a8776cfd60cd89545c
SHA512 2997aee81ed00d0ce97934d366ce31f8a59c31662ac71bcf6b534102109899f8e70e23d07193dcdde477d0d3c90470db06a959b1913cf1914f6ad5e7e3245dff
TLSH
T19AB0012AA1069111E208527661D2189231A46CAA9E835D02919B22B9A4A12A485A21C6
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 b3925c66c05506918b6722ca917178ce95a926d08bca7de0f3dea07597aa349d
MD5 499ccf75bb26570156286c591b3e35f1
SHA1 efa75c6ceac946ec6113cbbd856d675020056d1c
SHA512 a867e42636373645ce76d4f390e2e9ab571cdbd00fa7927063b926c80b4e869b7ad815c74ad16b95b88ee7b26f21f69e56439b95c55777a163902a8eb3305a93
TLSH
T180C09225A4115221F32823B0A2CA0055307008210E83AD0181473379D0E034489D64C6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 97905a2d1543b605bedc02a8ef3aadcb9a1ff8666b5de7fc311f5247cb7484d9
MD5 5674cb9f6bbf5d780b6387db4cc8bbcd
SHA1 43c7552c6f7617ce751f33b9c6e1c2cdbead7208
SHA512 f6212812ca0fac148fe7eb2fe6ffc27db32234ff3250a9b7c5edb19e117bdd951f35d08e321f5732b21a5d7c2eafea226f23822d699f0501dfbb6064465ff97b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 93ba467277c70d2d5be2d66c53180e1ba38e8330f8a82947495ea123c7ae3ab1
MD5 86d98d4bbebe2fe5653e7f225dd739e0
SHA1 273bbc25f4d1c94aff46cdb1dea54a32f82f639e
SHA512 bbe923a16be969fc69814954c041e9e39776d96a32179223a98d729e5e97da14a848abeb4f351d553bac88a7ac4025ab630c6eb83e631e88c54e2503477e6047
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Favicons
Size 24KB
SHA256 92ab4de6e595a9c74fb317dd3da4fe34336d884f4f7bfb7b66c4f98dcafb465e
MD5 88e8ced97663384b7c5f86c26253079c
SHA1 508a6a6e353cd908d2c13c6105b2d8a35deb7434
SHA512 06faacea289cb6ba82125cc3e1ca2e4197396a9361015b482bab7e88129b9fb810b128fc5a58dbe75b260a4f103454531a6f47bb0afec6c27695973d6eed2215
SSDEEP 48:QBmw6fU1zBuzVR9q8pj8ZUHaZDmSo0C8dtupPzjv0PcrRmlBSTkikUe51nbC:QBCyuzVimdaJmSoJeGzz0SRNTtMo
TLSH
T1B4B2F80F5F387006CBD11E7E2A7A5C3A8D3FC35CAEA54C293C2894604CB458585355BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\History
Size 164KB
SHA256 5ccbe525ed3e9c3e233a06f56c9c892ce6567da92941a64c5bc6163c40997a10
MD5 771a90b86c8d2d29c85ee7c821c8a62b
SHA1 62b3c290ba57e03752437f627f0dcb38a8406f4c
SHA512 0e86b68793bdcd52fa041fb8fcee75701576eec065f8d57115d3aab886ca8e4c3fb93a0c970b21adc33e4b09cdff172085858a56b203fa2d1fb4e00384cc683b
SSDEEP 96:8BW125LqL/uejzH+bF+UIYysX0fxQp97AXEHt/DfLVVVN6zRk/E0eEV:8BZ5qL/tH+bF+UI3iWGVAXWNVVV638V
TLSH
T1B3F3FB5E5F243312CDBD923769E749B3597CF03F87236A856C6204B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 80621e9b0553a5b0e6d6b2a3cf091061ecb9c78939b70f57e37824dd652c6f0d
MD5 3813ff773e90de5fd777b006284f40f0
SHA1 5e955b8490d4a7f8f6f5ab7c9de4c6fa5d21d293
SHA512 c449a5f713702a2ce8dbce73033179cc630a595e2e6c52fd5b91aa96ba4a42260f3b7cd125da78a6c93040f2bcd6fae845fde6e431dcf1c9c37e54db64fe01f3
SSDEEP 96:rJ/dbzIib9bk+Odo5h16Z06s7/x+6MhmuecJJ31eje+K+gX8CCI8XM1C7K:rtNL8on6sV+FdJ3QjaFCg6K
TLSH
T1CED194015E64B97B4C9AE519BA35BA17E2F9603275912E48EBFC452C04DBACC621780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 49563671437e5ae998e6f956d52a9164a6506900642c3db9edd5ad9c9def6729
MD5 5b2fab09c5009a3e795d653a8208eb49
SHA1 ebb94d9965100c6db2617086512d6340ca97b31a
SHA512 974a957154c107e2c6198d78acc2eef7d1493e9a964e90d7141956d3c746851fb8c747b87b4322b8e5ff1726e9ffcdb6a07d54741672c44945d684ce600fc83e
SSDEEP 96:vCiqPlf/ROo1pkF5d1Civ7VaTEv9V5h5pg5+e0ECqOZiwds3hqJmiq:H2vip9lpqOZiwdQ
TLSH
T17EC1A8A3092DC575AF448BEBDD387ECE99A6019F9DC54D1A92E2C04C06C1FFC21EA485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 fc6dfaa70c0f35784b74fb47b07105388f074cbdfc227e541843b98bcc001836
MD5 2cc1a8619cd5c0c8026fe1bc0d161c7e
SHA1 78d43e639406d8b516c96b48ca4f96a1d602b52e
SHA512 18a1e2f5e3ef80e6360d01e1e6a21bf172f24de0e5e60cf741b213a15351da1f2d0df62895c9b63c292a1a629de58eab384222bf010009575aadfb050fd62a18
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 72a1502b455b22f73e0aef51559bdf71d4940804f7feefd373fe8e5eeaeedad4
MD5 c8f35930be162ab5a980acd6560c788f
SHA1 638123f28813147a697e728d407f6c4cf44e461b
SHA512 822c210df6be26d8a214d02e6a3e4ff05eb90d78246d58014e4a1d3637ff3208230fe75c51d7d7d69a7c3cd539a0b00e7bd4a65069c7b8ffe652ca86a277f15e
TLSH
T18CB092846B00A127C0980E7D06948FA063A0E2426901190248458F214EA66A82E20894
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\LOG
Size 325B
SHA256 50ad0dc83f1729a3d7e0599777bbebd73090f61bc1e777f4a013fe0c6bc3c65d
MD5 e8420cfea140ecafeffb888054e2d5b8
SHA1 1df1d6f0505f71167537326b81f8440ef36ebb60
SHA512 0ce2c566af539534b7c7dd800d1563f869464b9b6e6d29ed41ca2050999d9ebf6de89e56266b9b15f5d75e173b5cbeddf2aace1ef071bfa3757e31aec7c9ee5e
TLSH
T17FE0DF7069CD8377528908EB2239A70CC6266814E7CD162A2F29FB48618B489B282382
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\LOG
Size 301B
SHA256 697e2037a406536d11558a21269503bd7c235a4bd1ac96d89ae8bbcba75bd1a9
MD5 3605e84564b488558cfc3f6ade048189
SHA1 6df4397ae417f326c71e637da72cab50b13a23ad
SHA512 81ea0bebfbbe1c1cc66b057bfe9ba523342054c0979976d6e47e2d754246864db47444ee4105a5915aad5ff88e3e9d7c1f910df2c98287eb8fa5b66896a1a8c7
TLSH
T1A4E026B0A8C8837A48C888D612785B2DC7756C14A389374E4B08EB88A48704EA2E0382
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Visited Links
Size 128KB
SHA256 f58274f796a1756df82fc8f535f2f5eb4b884e30496142400b3346bd7a00ab76
MD5 28935606b2a28ea231be6a887c67e231
SHA1 1f0d7c0da1e9a52a4bf8a37f8625c9f99ab68a1f
SHA512 78e9002a61a673e734c983655ea50a6730045170b2b0b5a016e837da4c55b6ef9e275b98eddec578ed80ff4973eef0410390acc58491bf5184f4aec2efc69fd4
SSDEEP 3:ImtVuP1Qe1o/VV:IiVuNQeq/
TLSH
T185D3043507C1440CCD750034545445151433C004003105174734C5434DC10431537C3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af8a77dd-495a-4972-96fe-843e2a08281d.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\af8a77dd-495a-4972-96fe-843e2a08281d.tmp
Size 6KB
SHA256 89fa3377190575d13fec52ee8560a4cea3da7f3de76c38db5499593b59b711dd
MD5 c8a055ce4b9e1f07db370737c915bd95
SHA1 65e4cea52986a49a40cd32922afc789b1c2e0288
SHA512 3b1d7dabd665fc794438c724fb20be69a0be3239c15de59df92355b664ccf5bc9efe71f6a029fe42e8ef8b81eecf6d99bf70b0e1ffb84dfb279a0ede04510a45
SSDEEP 96:stJ/dbzIxvqbDbk+Odo5h16Z0ms7/x+6MhmuecJcDMkkje+K+gy8CH28XM1C7K:sttNovW8onmsV+FdcDwjaOHG6K
TLSH
T16AD1A4059E64B93B4CDAE119BA35BA06D2F9603378D12F58E7FC492C04DBACC631390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 ac473ac1900f1cafddab803bc06691440a3ff72975b739cf30ffde805a3bef7e
MD5 74d49f2503dba39efac3190c9048a34f
SHA1 f7764f7bc9b8f0de67356a72848bbfd95ef1cda8
SHA512 ee47d0d08b6553853892fc54ddf1637305c26cfad17a40c50a441df87ab314802385d619898bb76bd5296a0e4776feeef9577855c717bf0e73e0d5e13e5c61e8
TLSH
T1B3214072E9F45F32ACAAA2463166BB1BDD7490B7A6014F002ACD4A1901D395D922A832
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ShaderCache\index
Size 256KB
SHA256 4950fe815c457223f21fc235a080319787fdef3d983c2f655e48f96eac039d31
MD5 0e95851e3cc0c913c2b310ce491e6fe3
SHA1 de89513dbd1e91fc3808866422f04fc0718c7151
SHA512 5c978740648d23a79ca9175a7ab6d7c3474c2b4b38523f67a280aee98d4da5edef951bd3fcc4b86b1db8daea8e06b69e964e594980a721bcca9d4ea667edb9af
SSDEEP 3:LsOllllklkXlfu:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a779d84d-678c-4ec9-8946-febcb7458888.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\a779d84d-678c-4ec9-8946-febcb7458888.tmp
Size 3KB
SHA256 eaf6b5ae278d9980f42d4ca565d3a9d4c5c94798ac0bf04f1f0e509f823a6d2d
MD5 9d925ea202f8a141a349792ea808d6cb
SHA1 01b5cccf8a48f48ef1b27933e4b16482ff1231ec
SHA512 08493161b06f134d26d973ea65ad3029936222f4bbf35b3af4cbb568f7cd2995093cdb99197b3c3d0a9ccc8426fe5da522bdfb4bf5ee45efa129284fe9b460aa
TLSH
T1D68172226DB4A93759FBC605B9563F06E6B89033EA853F98DAEC0F0D01D76991342827
MD5 SHA1 SHA512 TLSH

Submit Download

f2f3cca2-543c-46a9-9433-de96838a9f42.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\f2f3cca2-543c-46a9-9433-de96838a9f42.tmp
Size 3KB
SHA256 cfa962d9efe460f0794e333b82da548823de38b0d50118506a86acc03b803e3e
MD5 f88a8c624ede075cc6cb8893635c4dc9
SHA1 1bfcd7d0bc0f15602636c767cec51914c74d70ca
SHA512 a5f82065df22b98241bb596691ad345f0f5e7cbc2641e9ebe006d9b760103c4ea90487c0887884240be823f8a48bcda91b8c3f543b7fed0a063bf5112714f8d4
TLSH
T1048183226DB4A93759FBD605B9563F07E6B89033EA853F98DAEC0F0D01C769C1342827
MD5 SHA1 SHA512 TLSH

Submit Download

ff430783-4fca-4825-8db9-ec49e7fa597b.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ff430783-4fca-4825-8db9-ec49e7fa597b.tmp
Size 17KB
SHA256 8987074808e9620ae36126be44907630b8f52f4a6c2abb8e39afe6c49ec64aa5
MD5 ede60b96ba80a8ff4eea01d1a86e4500
SHA1 412b89e07f950a397465da1df747f5be43eccf5f
SHA512 20631bb4a0eb4804b4c21d17d54c356e15b284b4ce8969d179a2e5d096936c4a61c4c8f21b475c729b41e5b5ca7ff88a8907ec91ec4f505bfef128efdbe126f0
SSDEEP 384:4+OBqImmJvGBLx3NaFMJF/3NBSgBV40qxJSg6rc:hcvGtlN/NFyJ0A
TLSH
T1FD82AD36ACA1AE372CFBC2497A8A774BCBB0635385C46BD4CCDC6F0E015799D1312816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_1103459855\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2008204531\manifest.json
Size 102B
SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
MD5 329ad25b265a82c711c72c02a553a353
SHA1 a9a666d4182caad82edd399fdab141473670c5a7
SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
TLSH
T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_2076318470\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3200_290619396\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3316-499-0x00007FF9ED520000-0x00007FF9ED521000-memory.dmp

Download

memory/3316-498-0x00007FF9ED000000-0x00007FF9ED001000-memory.dmp

Download

memory/4956-27-0x00007FF9ED6C0000-0x00007FF9ED6C1000-memory.dmp

Download

memory/5836-107-0x00007FF9ED6C0000-0x00007FF9ED6C1000-memory.dmp

Download

memory/6016-785-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-782-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-784-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-787-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-786-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-783-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-778-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download

memory/6016-776-0x00000143A21E0000-0x00000143A21E1000-memory.dmp

Download