ratonrat | 3e6489b8dbdbc0ae83a9eb5261cc963dec5752787db3647006dbde3de3634ddd

Analysis

user interaction
yes
max time kernel
38s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/11/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 29.6MB
Sample261112-2ws33adv6p
SHA256 3e6489b8dbdbc0ae83a9eb5261cc963dec5752787db3647006dbde3de3634ddd
MD5 2a67ca000424eebbc09ff75a3b0d51aa
SHA1 d5d1ed0a4df56827722c6c3866fbb4b879cafaf7
SHA512 7344768606e5856a9c2db088a8bd59546cce9f46139e2fd19e9c5de3f74afb8e24e2a4e14065f6601928f1d79eb4071f59c2e0e202a38eec33d7291c44e77dfa
SSDEEP 393216:Xa9Iny9G03rWxzefF6wDwdnKfTyxbxypdXIHL1JF:Xa9Iny9GwrW8tx0dKbeiRIJ
TLSH
T14B675B257B5A996CC05BC074838B8A724A7134DB0B35B9FF549492782F7EBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer trojan

Malware Config

Extracted

Family

ratonrat

Version

Free

bn5xpur0pk.localto.net:3788

Mutex

vA9QEtdJdEANOirTKkm3NCG

Attributes

assist
true
box
false
box_icon
No icon
box_msg
Hello, i'm the description of your raton client message box
box_title
Hello, im a title for your message box
defender
true
delay
0
hide_file
false
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
true
vm
false
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 3 IoCs

resource	yara_rule
behavioral1/memory/3728-0-0x0000000000950000-0x00000000026F6000-memory.dmp	family_ratonrat
behavioral1/files/0x00080000000244a6-8.dat	family_ratonrat
behavioral1/memory/4400-10-0x0000028209910000-0x0000028209B84000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2512	powershell.exe
2512	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3960	Potassium.exe
4400	Potassium_Cracked.exe
3488	Potassium_Cracked.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium_Cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium_Cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4400	Potassium_Cracked.exe
2512	powershell.exe
2512	powershell.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe
4400	Potassium_Cracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3224	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	Potassium_Cracked.exe
Token: SeDebugPrivilege	4400	Potassium_Cracked.exe
Token: SeDebugPrivilege	2512	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3960	Potassium.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3960	3728	Potassium.exe	86
PID 3728 wrote to memory of 4400	3728	Potassium.exe	87
PID 3960 wrote to memory of 3224	3960	Potassium.exe	88
PID 4400 wrote to memory of 2512	4400	Potassium_Cracked.exe	89
PID 3224 wrote to memory of 3780	3224	msedgewebview2.exe	90
PID 3224 wrote to memory of 2340	3224	msedgewebview2.exe	92
PID 3224 wrote to memory of 2340	3224	msedgewebview2.exe	92
PID 3224 wrote to memory of 2340	3224	msedgewebview2.exe	92
PID 3224 wrote to memory of 5088	3224	msedgewebview2.exe	93
PID 3224 wrote to memory of 1916	3224	msedgewebview2.exe	94
PID 3224 wrote to memory of 1916	3224	msedgewebview2.exe	94
PID 3224 wrote to memory of 4012	3224	msedgewebview2.exe	95
PID 3224 wrote to memory of 4012	3224	msedgewebview2.exe	95
PID 3224 wrote to memory of 4012	3224	msedgewebview2.exe	95
PID 4400 wrote to memory of 5796	4400	Potassium_Cracked.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3960.2900.5257702088616954416
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0xfc,0x7fffe687b078,0x7fffe687b084,0x7fffe687b090
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,12478626587534548305,8329947711685198294,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,12478626587534548305,8329947711685198294,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,12478626587534548305,8329947711685198294,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,12478626587534548305,8329947711685198294,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4012
- C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Potassium_Cracked" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe\"" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5796

C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe
"C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe"
1⤵
- Executes dropped EXE
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qdd4wzty.bb3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qdd4wzty.bb3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2c75657e-d985-4946-af20-12c820aa54e7.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\2c75657e-d985-4946-af20-12c820aa54e7.tmp
Size 2KB
SHA256 4ac1c0e3a6d59a3977bd777818d4bd9cb8bc44b0a83f186196ad5b593d93f28e
MD5 7c7a0849084a04fefd95c00d5a3db373
SHA1 41fdc95232e2128a16abf245f34475e53e28204c
SHA512 20b765c524e8f0fa82022bce4f53cd7cb89a0d2d9e26afee16db3617e8791540a9e4b35da9fecc86e5fc525c6ffb61401cfef4a5986233dd7e3f4cb56a4c4c94
TLSH
T155519432A818BB738AE35544BA8A3F139B7A70799A561F9095ED0F0C01DB5583306C27
MD5 SHA1 SHA512 TLSH

Submit Download

4678e7c7-cd3b-4b21-8c05-fb5f642178eb.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\4678e7c7-cd3b-4b21-8c05-fb5f642178eb.tmp
Size 16KB
SHA256 80636c801a1770be1a310632e1e3e8f09180a9386e0a1af6ed2a7f574427395d
MD5 99cc87250920b357e44dfa2d8b06243b
SHA1 0edc20f598298201ea000f055130345e9c8ac5ba
SHA512 3817a6afe5d3147f7ae998bb7feba79fd4fd2e2ba2c3b966c0aee574b4416d8072ee0170ce0152a5e794b107b82cf5af2b97226b6f340f159503d3a2d3975258
SSDEEP 384:z2+OBqImmJvGBLx3NaFMJFs3NbO3ArgGiSWg6rz:XcvGtlNs8Qrvi7P
TLSH
T18472AD6A28656A232CE7C449BA8E2B07C77572A7C1E56FE4DDEC5F0F022B1842352D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79a1716c-0ec6-4de2-93d5-e3f2b702897c.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\79a1716c-0ec6-4de2-93d5-e3f2b702897c.tmp
Size 1KB
SHA256 e9f24b360fe591bef8c3aded9a6c7735120a07fce8a589dbc637fdb6bf76174c
MD5 1525e003eb8f669f8ad6ce6746e8062e
SHA1 b57d76fde4234853c2902bddd7d17299d7b0b363
SHA512 b38a3e62b62cd6f4d0bb65d9df9f157495ccae15d18cfe218b9dd579e4bc8c5e90765f118fa7050e731d56bcd42c8c1bc403e8383c5197524fb9109a01d950b0
TLSH
T1C031627295983B7299821085B6877F875F71307EC1154E4491EE0F1C02E799CB52ED32
MD5 SHA1 SHA512 TLSH

Submit Download

7f4db97e-4146-40b5-85d8-7a775cd25f77.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\7f4db97e-4146-40b5-85d8-7a775cd25f77.tmp
Size 16KB
SHA256 7cf6b958d98d46b4a0e5ccbfbf70005d583d10f811e88443a31666498916b339
MD5 e5e854aff742ea64f1b66b28a4a6171e
SHA1 b39c0bd5d40b0ead79e4bec2fba1c7071502cf17
SHA512 697e67c69a99ddcfbefef4d7f6e885494cca680539054c29e8a3a3a577011592efa8ccbe3a0c64d5d2d74050fb5561f9ee495d0c401d2642552c9c69b3748fe7
SSDEEP 384:zk+OBqImmJvGBLx3NaFMJFMNbr3LrgG0SWg6rz:BcvGtlNW7rv07P
TLSH
T1AC72AE7A28756A272CE38409BA8E2B07C77572A7C1D57FE4DDED5F0F122B1842352D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4aa0cb65ac53b30e3a42a2f1c98123d2cb8e9b8547fe6cf09d5aea4079252cad
MD5 bbf9066e44e168d5661fea5cd7617f96
SHA1 680110a681202e1693052cb1b460801cabbd44c4
SHA512 7ca709e4482a41190715701024ff2a655c7ae6277dee340a63d21871c5ebe333cec4908f9c872207725d2e47cf028c31a383ba89ad368b584f825ac49b470e7d
TLSH
T1FAD0123372011138C02021B70452E60D0400C10F404BD0005439ED3DDE044901922851
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5bd1eeabb47c70ba819d55efcb614c84de241e848db94596892a27e482960781
MD5 19aa610482b9bdaf113b06aa56310eff
SHA1 0dd3890b27d75111e1c99582e558c0f6462c2efd
SHA512 838ef3021e493685e5c0d86e39a1bf723f844c14899dd8f28ad248945a87ccf78b39b33832cfd6a5195c88ca6d7211438b2dfdd04fd1cde28e3dccd1eaeab60b
TLSH
T144D02B3223000A78C23119730282D60A1990F10F8007E018A429DC3C9D044D00E218D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e69aa0c2fcbfd68d4129b8230d6608a9c0f4bcf22dee2e60c36f64eda868258e
MD5 0ae9fbced37e922a9657ee4c3df75c07
SHA1 54926d71af725b20119d75e034329c81b5cad0ce
SHA512 38ac8c36a7f9b421114ab9716bfae1f43c134c51160dba88e76f261b1c395636c5439ff47c9b2e1fd1a4fc8f6639c77d1af27b7769bff32cb95f1ce76327cb54
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

85925319-a1a9-4bc8-8c22-e969912922ee.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\85925319-a1a9-4bc8-8c22-e969912922ee.tmp
Size 6KB
SHA256 9c291ef531a4b603e6a9de3c4379df7087962fe18153c2aa0375fcc58aaf4e7c
MD5 ba4e4521d4c867a27a60683782a3a8db
SHA1 1b45cc5544783ece2e7af54e6e14d97e7dc3c4b1
SHA512 2e23d6857d9fb72dce45047aea973298e0cea7f3bb0164ef999c9c035258569137342d7c1bc7d12b6c8f7e8d4eba13433cda241152fa4c331bb308512e4e1074
SSDEEP 96:stv05xS9YYb9tffqBZ8i0vhEjkt3m/7qx+WVHMSm+uecJ/qSMFHdQj/Y3+gVx8PG:stv0jZef2Z8paeW/S+WiT/NqdnKPoKC
TLSH
T170E1B9065E28797B4CC7E6197B35BF12E3F5302225C50E58EBFC8A1C05EA6CD620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 759cd94fd2bc80d0eb4cd8d8b2a0e23814ef0fae96bf8e3a77df8a4c3f67f6ea
MD5 0dee355181781f512fea480e173affd1
SHA1 0ddaf99ff6adb76eee9499b196c1242196626050
SHA512 b2f5b7605093f81a23bc8dfce70ed84c134e35ada29e01b9fd614fad903b1702c059914c0beb2f834175308f2428001d2c05e103df20da9fd6deff7640f9126b
TLSH
T1D5B0012AC60A5B02C22227B229C2224E76704B54CA638F965594ABBAE450BA16AA2151
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 5707f25187f6741e618e8f65e8f5f8986ba9ed4192147f44aef97d4d7012dd3e
MD5 992e66a1b0adf2e4f4671f3df01c7689
SHA1 92d0686d511ba5c6259081336090a93bb967a0e3
SHA512 ce707c3b0d4667da4c701263e8152b6ff2efb47d054e593c44e0668a3bbde270b227ad8eb5e304c04e4656107c5e3c14325cdf8ec0e0eab041b77092373be93f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 92fd8b1b402d49a26c78879571cdc2efd122c95b0dab58dd10b5e8ab0a6858ee
MD5 cfd9dc41201691fb12e2d5eb9d8145b0
SHA1 dbdb9153306b28ea08c91f2740b40aeb7e789819
SHA512 65ee04875d6d5eca649b7c301f0e6ff76dd67a541193a7d26150ebe9cbffb0364bf966cee7478eee2444d846fa00906195beff38b5a4f47177f8817e69dd98c6
SSDEEP 3:LstlNllkll/lS/:LsX3lEti
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
TLSH
T154819284F7C02420DA306EF7A5024BB85E62CA82A5124F93487002D0FCA78ECDC75AAA
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

6d3c2a73-cde7-4513-bffa-76fb6368531c.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\6d3c2a73-cde7-4513-bffa-76fb6368531c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 d6677c7382d798d1fcd71e8940d7f3ae48cc59b2f00ac761aa4ba49b852f6631
MD5 80f33fe7d766747c0aed5e71ebe39f0c
SHA1 421312ae11da3505f1a3a8bcbe219267d9ab5361
SHA512 d5c75f134eaad871f62e8bda30cf857fff694037aa03d123d1b81cc0b4193a4e88b09ea35596f676e9ca06c8b17056224c1ff27c5aec584f3ef71f14d818307d
SSDEEP 96:stv05xS9YYb9cffVZ8i0vhEjkt3m/7qx+WVHMSm+uecJCJS1idQj/Y3+gR8P+MEB:stv0jZbfdZ8paeW/S+WiTC4wdnQP+M8
TLSH
T1CCD177465E6879774CC7E619BB35BF02D3F6207265D50E58EBFC861C08EA6CC620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\index
Size 256KB
SHA256 5b928ee063bfad9164adf69d9821368a801772104fcfc6dcabd356e58f5ad5c4
MD5 108881f72ad0c16a30e29ac8c9e642c7
SHA1 ef21288cc20e93ac5ea6a309609071a3d8dbf94c
SHA512 f51d6aef5ad2f73acb87b753a15c93da94ed6037ba9bb901593cc9ba323077cf90c9c00e6b855b316823359b0a67d3e1c75da43cc6b07a32b9fdd8a6defa6dd1
SSDEEP 3:LstlNllkll/l4bcq//:LsX3lEt4bT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 911ad268d83e3bdc1a2d215ab4feb82a0a018f7f30850a0479e81a0897086b31
MD5 1072d89aaf8529d2b73eea161487f230
SHA1 a07444d4661e9a5a36515a9cb0ada3b739ecdfe9
SHA512 885cb031d82034fc603b2a09284cea6a98c5959e231490b723957dfa7cf891379c78e68bc51c34873ac642ccdfdf8420e64f591521e6607eafefaabaabdfedae
TLSH
T116216232C4983BB299820498B697BF871FB0707ED1154F0891DE0B1C12DB998AA3ED33
MD5 SHA1 SHA512 TLSH

Submit Download

fca02575-1b13-46c5-960b-dc79ff880d65.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\fca02575-1b13-46c5-960b-dc79ff880d65.tmp
Size 3KB
SHA256 0505f074fc9cdc3b3005070ee92eb06a51b5bdfa6bb6917209c09a8f43089eb1
MD5 14a9c90ac2c7f20ff33d2de157b4bde4
SHA1 3ddd516d2afe461d3d547d5e7cb96d214a6f8452
SHA512 596cd99c9c3c23c39e4d569d5ac18ed8130cbe85fd8b70b32e3949af58e72fc7751ffd6ca9a2db009dd1711b8d5658bc5db6e6d86ce63c902bf1768259e227d4
TLSH
T17F71B636A968BA378EE39944B9C63F03A7B62137D5853F94C5ED0F0C01DB6982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium.exe
Size 27.1MB
SHA256 5de156fa4bd3f9efe88783a4eef055068e0a581b4903a26691cfd7c50affa3b7
MD5 0b67ba1a328f1a6d33f4b98a2adfe2e4
SHA1 6fe91d434656e6ec8769e24f17a82e73e7bbb276
SHA512 7f415f19a34c8e152a9c794a5f476080bf9bf7c3f0a7214aec19ea7dc8c194d0b5acd605b3d6615c7a2cdf8b5d2acfc55b1ed9468462fcefe9270e2f36485dc8
SSDEEP 393216:Ya9Iny9G03rWxzefF6wDwdnKfTyxbxypd:Ya9Iny9GwrW8tx0dKbei
TLSH
T194574A257A5A996CC05BC074838B8A735A7130DB0B35B9FF549492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Potassium_Cracked.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\c19249e4\Potassium_Cracked.exe
Size 2.4MB
SHA256 c9004d73eac0349cfb19953e052d2e27cc893cac1e3f107df702e58328d6fee9
MD5 a1163d86ae572b60024cc9dd82e7dbf2
SHA1 35ecde4b703c339ec3aadf8ffedfb84320f1bfcd
SHA512 6b330eff5bbd32ad60082e2d988f06203873fbd0b305a1a03efc5dfbc265a62fffe939cd4906de9730b9910c3ebd46f621beab3a6b20d3ba47fa17d92cec9990
SSDEEP 49152:OgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4xAn4j:OgVUuHjkDGjYQDGuRxzew
TLSH
T1F0C5011C33F9C618F1AF4BF4A57189664731FD179C62DBAC58E139AE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1916-110-0x00007FF806050000-0x00007FF806051000-memory.dmp

Download

memory/1916-109-0x00007FF805140000-0x00007FF805141000-memory.dmp

Download

memory/2340-93-0x00007FF804E50000-0x00007FF804E51000-memory.dmp

Download

memory/2512-62-0x0000022D4F490000-0x0000022D4F4B2000-memory.dmp

Download

memory/3728-0-0x0000000000950000-0x00000000026F6000-memory.dmp

Download

memory/4012-225-0x00007FF804E50000-0x00007FF804E51000-memory.dmp

Download

memory/4400-54-0x0000028224270000-0x000002822427A000-memory.dmp

Download

memory/4400-10-0x0000028209910000-0x0000028209B84000-memory.dmp

Download