ratonrat | 3e6489b8dbdbc0ae83a9eb5261cc963dec5752787db3647006dbde3de3634ddd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium.exe
Size 29.6MB
Sample261112-2ws33adv6p
SHA256 3e6489b8dbdbc0ae83a9eb5261cc963dec5752787db3647006dbde3de3634ddd
MD5 2a67ca000424eebbc09ff75a3b0d51aa
SHA1 d5d1ed0a4df56827722c6c3866fbb4b879cafaf7
SHA512 7344768606e5856a9c2db088a8bd59546cce9f46139e2fd19e9c5de3f74afb8e24e2a4e14065f6601928f1d79eb4071f59c2e0e202a38eec33d7291c44e77dfa
SSDEEP 393216:Xa9Iny9G03rWxzefF6wDwdnKfTyxbxypdXIHL1JF:Xa9Iny9GwrW8tx0dKbeiRIJ
TLSH
T14B675B257B5A996CC05BC074838B8A724A7134DB0B35B9FF549492782F7EBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer trojan

Malware Config

Extracted

Family

ratonrat

Version

Free

bn5xpur0pk.localto.net:3788

Mutex

vA9QEtdJdEANOirTKkm3NCG

Attributes

assist
true
box
false
box_icon
No icon
box_msg
Hello, i'm the description of your raton client message box
box_title
Hello, im a title for your message box
defender
true
delay
0
hide_file
false
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
true
vm
false
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/1500-2-0x0000000000B70000-0x0000000002916000-memory.dmp	family_ratonrat
behavioral2/files/0x001000000001c57a-11.dat	family_ratonrat
behavioral2/memory/3204-12-0x00000201C2E10000-0x00000201C3084000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4636	powershell.exe
4636	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2288	Potassium.exe
3204	Potassium_Cracked.exe
4560	Potassium_Cracked.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_721843115\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_721843115\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_721843115\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\manifest.fingerprint	msedgewebview2.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium_Cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium_Cracked.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
4636	powershell.exe
4636	powershell.exe
4636	powershell.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3716	msedgewebview2.exe
3716	msedgewebview2.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe
3204	Potassium_Cracked.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4724	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	Potassium_Cracked.exe
Token: SeDebugPrivilege	3204	Potassium_Cracked.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeIncreaseQuotaPrivilege	4636	powershell.exe
Token: SeSecurityPrivilege	4636	powershell.exe
Token: SeTakeOwnershipPrivilege	4636	powershell.exe
Token: SeLoadDriverPrivilege	4636	powershell.exe
Token: SeSystemProfilePrivilege	4636	powershell.exe
Token: SeSystemtimePrivilege	4636	powershell.exe
Token: SeProfSingleProcessPrivilege	4636	powershell.exe
Token: SeIncBasePriorityPrivilege	4636	powershell.exe
Token: SeCreatePagefilePrivilege	4636	powershell.exe
Token: SeBackupPrivilege	4636	powershell.exe
Token: SeRestorePrivilege	4636	powershell.exe
Token: SeShutdownPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeSystemEnvironmentPrivilege	4636	powershell.exe
Token: SeRemoteShutdownPrivilege	4636	powershell.exe
Token: SeUndockPrivilege	4636	powershell.exe
Token: SeManageVolumePrivilege	4636	powershell.exe
Token: 33	4636	powershell.exe
Token: 34	4636	powershell.exe
Token: 35	4636	powershell.exe
Token: 36	4636	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	Potassium.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2288	1500	Potassium.exe	90
PID 1500 wrote to memory of 3204	1500	Potassium.exe	91
PID 2288 wrote to memory of 4724	2288	Potassium.exe	92
PID 4724 wrote to memory of 4640	4724	msedgewebview2.exe	93
PID 3204 wrote to memory of 4636	3204	Potassium_Cracked.exe	94
PID 4724 wrote to memory of 3856	4724	msedgewebview2.exe	96
PID 4724 wrote to memory of 3856	4724	msedgewebview2.exe	96
PID 4724 wrote to memory of 3856	4724	msedgewebview2.exe	96
PID 4724 wrote to memory of 3856	4724	msedgewebview2.exe	96
PID 4724 wrote to memory of 5824	4724	msedgewebview2.exe	97
PID 4724 wrote to memory of 4828	4724	msedgewebview2.exe	98
PID 4724 wrote to memory of 4828	4724	msedgewebview2.exe	98
PID 4724 wrote to memory of 4828	4724	msedgewebview2.exe	98
PID 4724 wrote to memory of 5168	4724	msedgewebview2.exe	99
PID 4724 wrote to memory of 5168	4724	msedgewebview2.exe	99
PID 4724 wrote to memory of 5168	4724	msedgewebview2.exe	99
PID 4724 wrote to memory of 5168	4724	msedgewebview2.exe	99
PID 4724 wrote to memory of 5168	4724	msedgewebview2.exe	99
PID 3204 wrote to memory of 5260	3204	Potassium_Cracked.exe	102
PID 4724 wrote to memory of 5656	4724	msedgewebview2.exe	109
PID 4724 wrote to memory of 5656	4724	msedgewebview2.exe	109
PID 4724 wrote to memory of 5656	4724	msedgewebview2.exe	109
PID 4724 wrote to memory of 4600	4724	msedgewebview2.exe	110
PID 4724 wrote to memory of 4600	4724	msedgewebview2.exe	110
PID 4724 wrote to memory of 4600	4724	msedgewebview2.exe	110
PID 4724 wrote to memory of 2804	4724	msedgewebview2.exe	111
PID 4724 wrote to memory of 2804	4724	msedgewebview2.exe	111
PID 4724 wrote to memory of 2804	4724	msedgewebview2.exe	111
PID 4724 wrote to memory of 3716	4724	msedgewebview2.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2288.2488.12603896346134635277 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa92a95fd8,0x7ffa92a95fe4,0x7ffa92a95ff0
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1712 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4520 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4644 --field-trial-handle=1768,i,1903109543183734596,15562359908960435242,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3716
- C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Potassium_Cracked" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe\"" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5260

C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe
"C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe"
1⤵
- Executes dropped EXE
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aforge.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.dll
Size 17KB
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.directshow.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
Size 60KB
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aforge.video.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.dll
Size 20KB
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

costura.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\costura.dll
Size 5KB
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft.win32.registry.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\microsoft.win32.registry.dll
Size 22KB
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.asio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.asio.dll
Size 33KB
SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
MD5 01a76191d31b3d6042484e452bd66ce0
SHA1 c84ecf4875c17d9cc91c911feabca640c7ffc661
SHA512 09fa738e43b1a4272a9e16045bcc0fd00858f4367d41b1f9fe3cf97589379b5fcd1fcbd1a24bca74a08187f080941cb575332d3725f620f93fd0b414dea0a9bd
SSDEEP 768:EehRrWpB5henH0HTYdpVCYKo9coe6ttHjBR/:EehRr68U47QGtHFx
TLSH
T10BF22B71EBD84A27C92E2779A0F2040407B5F191F623EB4F9A4C94A96FE73594790373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.core.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
Size 183KB
SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
MD5 4e4302ce791e48f985a3a221a19a272b
SHA1 d2b0fd622daf57a012c3cf5bdf4b187f27d5d080
SHA512 1685a17be6d64c222ec606488e3f8e9707a8b7709054e9e99cb53c7b438f5b993820e2e9773e02455525ee06e18aa65ae150420224311f6c69d795c3d129e312
SSDEEP 3072:6lnWpdQWUY6GwfIGsnlLieRT0TWsPtt3RBntgqK2QlVEOPkk6uSYsM+S70I:FpdQJY6GwfIGOLi7tt3RBntgn2QlVEEO
TLSH
T151045B2563E48266E66F9BB5F0F204178BF0F4463437DB4E5E806AE92A07B01C592F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.dll
Size 7KB
SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 e90ac3063409ef6876e26422dc61d0eb
SHA1 3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SHA512 a04dc95e234652c8f4a8ddec88ee3ebd87e68d826eac008625f994323e569d3a3026c7cd7ce2d790ae2ac3018fadf10e600e7ba13cab9bbcc49192263a32fe6a
SSDEEP 96:QDBFskeJHnqvjZkcLqED5Iyr2T7AVUhkon1MrtrRGc5pkQrESd2uYO:QD7kHnqNkcLWyr2T7zSon1MRlwQoStY
TLSH
T1FDF1D724A398CA77CE6347B1A86706401379FA80A917CB2E0D8CA18FBD537594BB27D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.midi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.midi.dll
Size 45KB
SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 f6940019dad6c782bcb645c2f7d52db5
SHA1 1bbe492757bf99840d923fdd44c6a3f34b336cf7
SHA512 1da566cd9f7b0a81f9d858b48306111b0791991f867e77d24f87f26badf93ca6e6414b12669d83b4d3f0b96959c48172f4a77119dbd12e6d8b9e0d0b48caa006
SSDEEP 768:xwuDUaOqgwjYpA2knmsbS+O/RXgQPODHM0Mx7hlEmmyFyaetiWvmYRMUQ6LUOu5r:xwuDU7fwT2kmsbRMZgQP6HM0Mx7DP3eT
TLSH
T15C232A15A3F8861AE2BF3779FC7056110BB2B9867A32D74F0AD468AD1D237844C61773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.wasapi.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
Size 176KB
SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
MD5 bb660a4efbf5c0fdaeeddd4cc9ab9600
SHA1 6dbd30a9216590d012a7feb802831f538345756e
SHA512 7452a8e8c7b3183fcdf2d8546a3d154ce1ae0b7756281bcf5b454b10292356615f70593a73be36095e9eec7f78cf8ec46f14aa52d2b3ed7aa9a59505fd2ca725
SSDEEP 3072:6S40MR31DisfSmJyuhrkf3Pr/duoSIlKjaBIWbiFyryvpwAk:6SWZiUBhrkf31bIgQvp
TLSH
T16D047B223AAC9D76C5AF43B9F8F30D03CBB1D4463A17AF495AC15B255D13B924808B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winforms.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
Size 33KB
SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 115137414b41a26d6e73738cd94c036c
SHA1 e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SHA512 d30fd0043bb483e67700de48283d632811d45e89564ea6d9454b6a38dc3fee5440719224ec4085c70d21c665222f27dbb482ac5f578326a7698ecb7b46599b4c
SSDEEP 768:qNMJ4j7TupqLC+VHDvtiT8dMRrvCPRtbQDmZ1RnT+Geh:8uiCP8dIvMzbQDmcV
TLSH
T188E228195398CBBBC77E0E7944A211060376EA81B501FBED5EC8B1DD8D937520B60BE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naudio.winmm.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
Size 56KB
SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 c1b78af3d6402be8f259dbbe9250e7fb
SHA1 98e2c38597c50390852801d46ff342889c7351ae
SHA512 776d15d506798eb4a66d5cb5b45591e1767f4030f14aa91198fdf0bcad2e689835418629a1cd3f2af36add4809adb04dd3a850d9d8f2594b0737e72cecc437cf
SSDEEP 768:jpQFu52mn7eYuo4OzgyA90g01OcjDHvgxLMgGd8GbIDrXa8Rcer+7bE:lQ8hexo4QguNHvgxLufIDudE
TLSH
T1BA433B017BDD427AD2FE1B3DA0F30A524734A892756BFB4F1998F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newtonsoft.json.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
Size 704KB
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stuff.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
Size 12KB
SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 f8d5274e3368aa40cc0fd5798d19c783
SHA1 87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SHA512 fa3f106d4ab31c0d516b4623f3108b29c05993a6e65e6e1f1a49e7d101860f78c63843743c3e560c2891fccade27e6024e7b1566d4b99dd0fa90480c1d1a45bc
SSDEEP 192:cl/e0xEXKl04vygxTppSYgDnWgdCpZ8u8u8u8u8u8u8u8u2JHqW6LvEX6KSf5V00:cl/nxEXKl04vygkJ9dddddddBAW6AX6d
TLSH
T15D42192DB784866FD96C0B3EB86622541772EA30AE63DF8F1CC4B03E7D6735885505B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.buffers.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.memory.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.numerics.vectors.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.numerics.vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.resources.extensions.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.resources.extensions.dll
Size 78KB
SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
MD5 058062075dae2f0db660018d899358da
SHA1 4489f30223d4f80ad7c220615be2047afa82f085
SHA512 d2a568d19a0dfe06f9d9916c335fa1d752ed7ca78844124079e41b34c2342cbe3486f1d77a68c6cdd576d30fe84d03b12a7c7a5aabd09ee98174b0a167af01c7
SSDEEP 1536:PElSh0fXNlYQRZLj2O5xEMXfy6lNQYjLTb+G8uNsHQEispJnuFvTbp6wy/ei+zq9:PlLQCpuh6wMs+9
TLSH
T12973B51173FC5319F6FB2FB865F151118A3ABDA2A931D62D198160DE1AB2BC08D70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.runtime.compilerservices.unsafe.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.runtime.compilerservices.unsafe.dll
Size 16KB
SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
MD5 b78649f583f2b905c1cbf79ab90cc108
SHA1 847ec2fefaddbd2420e20065193497fa1ef2b489
SHA512 e9e99c5e60388956ac7cc8c2ae963364ad74a89432c5fae514648a68e24c13a684577313056ac9b6a264729f5c99de68bc809c14482d4f9dd12835f3cd13522d
SSDEEP 192:9Y4tIhywFXXbxfxdPWg9hWMW65FdQHnhWgN7aJeWPLyFqnajRRuvp7:9Y8ItFXXb/dPWg9hWOQHRN7WrolVRuvF
TLSH
T178723B999BA81103EE631F3096A5C943FE3CB3D61902D31D3985F7785C9E7D4AE20638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.accesscontrol.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.accesscontrol.dll
Size 30KB
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.security.principal.windows.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.security.principal.windows.dll
Size 14KB
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c32gre05.zz4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c32gre05.zz4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

594bd3bf-7e63-4b12-a386-4d0d98f2ab31.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\594bd3bf-7e63-4b12-a386-4d0d98f2ab31.tmp
Size 15KB
SHA256 1490e6a875389bba5d4cbb68ddfe28cead8930c65d57cd8e9a8c1ce67f2c62c1
MD5 1a1823de78f91a0d45468b527d95e6de
SHA1 ed617ef80166f2e63216ef59f281ec97fc682ea0
SHA512 8f8f52a1d6201dd846916fca7f8515e696211c5c753d9d689a155983411ca90503f1e349522bdf024fd7e7a4848ff17a5b5c00cf1b3ab7caef1f87dc057a4982
SSDEEP 384:a+OBqImmJvGBLx3NaFMJFNNBSlFyiCV9mg6rN:vcvGtlN3B9wh
TLSH
T1B972AD3A2C795F332CB78549BA8E7B47CBA162A3C0D57BE8D9EC5F0F116E0442352912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66b1787d-9826-4ba0-aca7-a0899e427599.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\66b1787d-9826-4ba0-aca7-a0899e427599.tmp
Size 2KB
SHA256 ee694ce7ee6e741ddce97d347aa641f81077298fe6a0f7a5638553a2aafa3b09
MD5 a08dff7ddbd38976872c9db259afbac3
SHA1 1283e883f5966a43eb09cf8a7986ca73475d34d7
SHA512 b0023b0e3c2ceb3460dcde35cd21d9196a4baa40856efa6ed219e3daefd4c5302831d385f2689041f5f46d84515ff037e9bfbe1474782a32a20d278f1a5f9967
TLSH
T18C515033AD249B3789B24644B94A7F23CF75A0A2AA562E509ADC0F0C01DF15C3756C37
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 308dc88a5f042616f441c6f0a61ab40f3cae938d79184e46d2f3911911ecccfc
MD5 4f8a36048bc85ef59a507650f892e5df
SHA1 0a67d5ff4c2363f6f03c6242afcdd661e661d50d
SHA512 8fbc3052f077c6c5614ac8f9d03ce30ef9d466e2325096a478644dd785805b5b9b453a861856387327f9ae9567a98549a3d6edbca4792da823f7eaf1a3234461
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e1486dc7261bf3171985db565484aefb333e00365fd1fde29411b7da64b2c10
MD5 08d5ae67d62712b7e72e4bb76cb48a82
SHA1 fbc808243a649cb12937999a58043a4982378ebe
SHA512 bd9b57a27d3f00832871c3480217cf180aa03956de62a7467c555b34debc0a88c4c3e5de849feb033b4536a958a35862b9d4d729e454f79c9e0632ba876bf03d
TLSH
T1BDD0122232010574C01420331102A1480440CA1B430942086528C51D3A540540D02452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0401a919-5622-4df4-b3f3-9daf2297b377.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\0401a919-5622-4df4-b3f3-9daf2297b377.tmp
Size 6KB
SHA256 2ec5a467a4b2db123830d6343556de701f807351f05779ae894a14bfd5fd1151
MD5 ebf61e9896a17cad58ba87c58468e12a
SHA1 ed2c9d7f9375861e0e024e7651faaf0696526a3d
SHA512 626ab576e096dd285e0a2ca2c822f12509a23e2358b2b961a145799207a78b8aab04279d392bb799c0294c17480f3ff5c2eff98a3b49f2f31bc9db9c9c439e99
SSDEEP 96:stb/dbNDjG5Kb93kyHo5h16Z0ks7/x+6MhmuecJ6Z1eje4K+gq628XM1C7K:stjNh5onksV+Fd6ZQjojG6K
TLSH
T106D194065E64797B4CC7E108BB29BF13E3F5707265E51E58EBF84A2C08DA6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9088fe11-2027-4487-8391-39b82e5cd486.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\9088fe11-2027-4487-8391-39b82e5cd486.tmp
Size 6KB
SHA256 fff62fc5e79bfe3548ef189f127310433e30fb36732b10f1f8a5f23893a94881
MD5 b1a65b5794c0eb354930badf7eb7fb04
SHA1 4c3fac587b26f19d8cff0e502346b28e4125ae1c
SHA512 b1036c94fcd5a8953d1d258e5b3711595bc4a62a7f56ae6a0cbc4f942de521c1e89543545232f4fcf144a5561a6d0f602cc31161abf1042a9dd0cf3b9d123860
SSDEEP 96:stb/dbNDs5Kb93kyHo5h16Z0ks7/x+6MhmuecJ6Z1eje4K+gCj28XM1C7K:stjNr5onksV+Fd6ZQjoyG6K
TLSH
T132D193065E64797B4CC7E108BA29BF03E3F5707275D51E58EBF84A2C08DA6DC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 396b378e359aae92454d38adf04bd0fabee7b4207f064d723ab0cfefcbe38455
MD5 5fdcefd8535e50cb9d4fab0451e32ba1
SHA1 7e6164419c65e8f57c2d8e0fbfeff3205a26f935
SHA512 ba2de8bc5d49b49a5cda183f0d95b0a90d338ed88a09a1621b258e1b6dffd040c0024de397f9c530020e02dd63f32cd0ca40fe435a8ccbeab41096336115ef6b
TLSH
T197B01180C20B880EC22003B220C22288B2302F0083238FA2A0A80038F8E230A2EA2880
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5e69ef20f19ff1990ea0bf69ba8f01293996d78a9e904a902bc6b5fd4366b750
MD5 f3cb5d8e0bd1d464d4bf4b1b098024a0
SHA1 773146647a1f65462c13576b5a677a020b27c08e
SHA512 7f187d67741a6516862a8a04b0caa5da5067bd29fd273e9eb4d9162cf97d66355b46c2244407c152b46f8542407d3755f7a4f9ff09ad35746758f73cee84ddc9
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

738a02c4-0d59-47ae-9430-626aa835968e.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\738a02c4-0d59-47ae-9430-626aa835968e.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 06bfb7549c6f1ceddba2f91b571db16380efe32b2fc9d97636739bc2ccd0f848
MD5 c1ccb258fcda2ae0e1890d30bd4c9790
SHA1 452c17e2f1074a81889f067e57c26924dfccbcb6
SHA512 a02262094b08725aed5e5b43e51da18dccb5a34ae0a733c662d9b4ba754f8495c1593dd1916c14fc182ee6ac267a8a21997cfbb2ec25c00050a0eb8a7cc55996
TLSH
T198216572DDB54B33ECA22205B549FF6B9F7160B782528D40A1CD4F1D12DB05C757A932
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\PKIMetadata\73.0.0.0\manifest.json
Size 102B
SHA256 250baee11fd47f6176ab1bdeb439fbbe69f21d0d7e913056718f8113c431dd31
MD5 82b21129f91e37ea156bea40add3fcdc
SHA1 5903ffc6265ca6296e88b93cae207d8d9de8e0c9
SHA512 e0259648133388d9d289cc464fadcae7cfe7592b60bd3149a3859d7a4e7bcfc733ca65c4ba28ae5ee57ebeec8859d2b2c0ca2efc14f4d189ef7f175f73ff2a41
TLSH
T11EB01220EC10B4B30004036C0C6CC3C463272F032C4079184DE5DF84E80D9DBE0B152D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ZxcvbnData\3.2.0.0\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

a665e58f-2904-450b-aebc-84b3f09f0cf4.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\a665e58f-2904-450b-aebc-84b3f09f0cf4.tmp
Size 3KB
SHA256 dae1f7de0bd2e573511f9f410bcf9b74960a19ba85653ebed123fe0e721f9207
MD5 4bce5eaf63de306e7060da9d0fbae089
SHA1 6ef4b529eef66fc8feeea3e5d62fec6b70411d39
SHA512 f1f81486d3a00bcc8ac2c3e5cc889643d99aa87b1eb685d683e059ac4685ecc628d753890cebfee78deec65b6716250afb935cb62bb065ae4286550907f37f72
TLSH
T155617237AD749A378DF29604B9863F17ABA56033E9863F95D5EC0F0D01DB2982352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium.exe
Size 27.1MB
SHA256 5de156fa4bd3f9efe88783a4eef055068e0a581b4903a26691cfd7c50affa3b7
MD5 0b67ba1a328f1a6d33f4b98a2adfe2e4
SHA1 6fe91d434656e6ec8769e24f17a82e73e7bbb276
SHA512 7f415f19a34c8e152a9c794a5f476080bf9bf7c3f0a7214aec19ea7dc8c194d0b5acd605b3d6615c7a2cdf8b5d2acfc55b1ed9468462fcefe9270e2f36485dc8
SSDEEP 393216:Ya9Iny9G03rWxzefF6wDwdnKfTyxbxypd:Ya9Iny9GwrW8tx0dKbei
TLSH
T194574A257A5A996CC05BC074838B8A735A7130DB0B35B9FF549492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Potassium_Cracked.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeCache\f5bc673d\Potassium_Cracked.exe
Size 2.4MB
SHA256 c9004d73eac0349cfb19953e052d2e27cc893cac1e3f107df702e58328d6fee9
MD5 a1163d86ae572b60024cc9dd82e7dbf2
SHA1 35ecde4b703c339ec3aadf8ffedfb84320f1bfcd
SHA512 6b330eff5bbd32ad60082e2d988f06203873fbd0b305a1a03efc5dfbc265a62fffe939cd4906de9730b9910c3ebd46f621beab3a6b20d3ba47fa17d92cec9990
SSDEEP 49152:OgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4xAn4j:OgVUuHjkDGjYQDGuRxzew
TLSH
T1F0C5011C33F9C618F1AF4BF4A57189664731FD179C62DBAC58E139AE04B6F44AA10B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\crs.pb
Size 284KB
SHA256 aa6cf08c23a14a8cc5e960584a2fb4938395009d54b44e930ce3298aaa8a81d0
MD5 8b74a064b3ffdb0f11122f64e312a912
SHA1 561df73d2148abc55f724c5b14738cd19db29b0a
SHA512 2c2d2cec5e27d7084cd8fb761cb48f76f8b46d19224f263a8c49e46b8a86674f5178ccc1b95c32b81d7db7fdf36288a24857b918cff4de7cd834bc72831f451b
SSDEEP 6144:KKqggR3NpUvYpVW+J2a4g66k8G1nT+uuBa1hhd0piFlXGq9V9s:KWsNpUvC27lYRsTGG6
TLSH
T14554CF960F383D12BFD2DEE466CCE9373E79B6E06A6928162111C4F159927E07D8C42F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\ct_config.pb
Size 25KB
SHA256 9a0afd7c11ddb7fafe6abdf83f10dc4050f3be5863664b9fcaa563573c7cdd22
MD5 d820c3c9dbacc79e14fb4201bafd94bf
SHA1 e25694e77d261d5f18574d405e25fde0fda12352
SHA512 5a592b6147c0ff898cf5cfea99a69b88a5514db62b2fdbc7b243d05f763e5ab84e3e2a178b23287c8156e6e56d5154442af4af22d907fe89050b45bf4dabcf53
SSDEEP 768:CoIO1NNHA5uAbuOCri7Gf2Z7gl3u6ksYCjMPI:W+OuAbXGfohsYCQQ
TLSH
T125C2A7BF62159F001753D50896F52BBAE133A3D6C8F3697DB1E28008F1872E961E467B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\kp_pinslist.pb
Size 7KB
SHA256 4b11f7955880e17ea480b33dbdb44162e6fd84ab8dfa1ee5235f805c00e3b6d4
MD5 1108e93332c50b58ff30b31baa256dbd
SHA1 c087208fcbfcd821ef2a5d1a255c450f4f980ce9
SHA512 cdfa41d56688750c912e3fa6bfdc4340f8358c14fb313f14246ed6f1524c4f7110f59108c0916378e1b9636dde77137acb31c6d30969b0667245c339da4cfa15
SSDEEP 96:FxleRkDB0rBnfAa5+wMacFwnFXh6g/gYyn:9/DCrBnIeMacFwnFc9f
TLSH
T190F1BC737905F89390E3E1BE1052B099E93383A540BDF999524C0A767AF5F0B197B0EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_2004088613\manifest.fingerprint
Size 66B
SHA256 a0cf2536e60657de18e2ef45822ccf45dbb88f4d7894f2423b87532d79f36272
MD5 4ea532d5565a40994fc489438f807775
SHA1 8f79880f33bf3d0e5530441ec77dedf0657c8baf
SHA512 ef4e4455086776c0d98340ee4970483318c26b5b1d46554d35632a838dfb31a1244c42da7ee9ad12fa0f2fb124f0c9a9968d0f6dcbcf5738546213a7e7601447
TLSH
T1D1A02288E233F0082B0B8A0B2C88B0800238000B882882B3A0B08C32800FB202B0C80C
MD5 SHA1 SHA512 TLSH

Submit Download

english_wikipedia.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\english_wikipedia.txt
Size 269KB
SHA256 ff105c5b6e65386cd0af95272607eca296c5b8b786c2f0bb4a9ffef20b4cd4f1
MD5 c5b5e739e99f368b294af5d6341d79ab
SHA1 ac32ffdb158540338cee54b3e1c1bcd883b97e99
SHA512 93887a641de44647a191cacdd4b720b4091e4bb5463c0f1ff81bc53b361173b577dcc3717ee9281cf77d27d24576582f89a4008edfd6904e92df32dc8081cc0a
SSDEEP 6144:Uarig5YkFuhe6bke9u8avUdUhWn5dXbcsHqkFnghZwKTZ+oP8:nrd5YkKe+BNavUdUhWn3I+qYngnzx8
TLSH
T14F440A70EA54353BDB9B139F88942F824568D5321F2574A4F69D068A040BFCE877EF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

female_names.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\female_names.txt
Size 26KB
SHA256 a15bb2c5f362b00b74eb4a25c538f3862cf76ba235e6ab84c32722e0d06235f8
MD5 65c6b77a97ccdb4f09402295c75cd151
SHA1 48d9de4e0c6ef8f29db7e3b69008d1e25423f333
SHA512 59608916ece278c8d6b518b9ac19f38b071acac1e8698be851a5e357b97a2e4c4dea4d122321f61e937fd2480e6041e78e97e01648098da194890895d7ea0dc4
SSDEEP 768:QLAlqUDcjeadVlvbnevUtIaBY30lzpoTTC:Jlq4Ceahn2HQqC
TLSH
T150C2EAF7EAA8097F748F890DC5893B604C58FA332C3658A59E698FDD42056D0DDA4F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

male_names.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\male_names.txt
Size 6KB
SHA256 95b2b51e4d30946e0e3873663a9e191503f4b7926eac98639c65ae06c383be0f
MD5 ed2a7be8d1007adf88defbba6a30fb18
SHA1 f00e2d8892ff2808a81f50d360edc960bd8d51ef
SHA512 1577919e4654086ae6d673ecbb5e436ca2fdcefb30bb4f839fdcb545f3b3b102bb47e78ce6c4ba451bfd9cf6099eba35c765dcbdadbac80aeac3083dc095017d
SSDEEP 192:+qi/Dd0Ms6tPdSiuDvtnNdqfkKY1kqPgxC4Hb64:+vbLu5Nc8UqPu1b64
TLSH
T14BD1E8BAD2E43975AC9F058588CF2F41994C36337F321676E6B90AC94252A805ED0D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\manifest.fingerprint
Size 66B
SHA256 6a5e20bbc41a5ac347d7b85b0e3709431710357526e4661387597225d49dbfd7
MD5 a346573314757c677ba7b22bf474c77a
SHA1 aec9bbc033bc1c11aa690a8c5ceab69324ec42e5
SHA512 8bfad9d06097a6571bf855b189d645a3f4913798fd6ff66fba00c90673f891901d03571ab57dddab2982591b60a8e6c27fc47f05a69f33da0e92ec49ef5fa43e
TLSH
T17DA022B02C230A0000C802002BF08C3308F8C2008C30232302CC38C0003C0C0F88CCC0
MD5 SHA1 SHA512 TLSH

Submit Download

model.markov

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\model.markov
Size 44KB
SHA256 8882d44cf3dff2e2ca5ec1af749460040e41b8d1f20b3da2308c4f976d321754
MD5 2bb4fc702c8b59a0b518482f60a082c1
SHA1 ffdc0a063cdd51e4913df4e4917495abf7e486c9
SHA512 f6b113084bd43a1f1844102ca860efd8bcd363de3eebc8acf23f5744d74b191fdc92a601630eb8e602e93005a63b73a9cb3bf5de115e157a2b72eab4dd891c5f
SSDEEP 768:aRuG/TuKUqwxhRH6t9O4v2uoDO+L1kO5qNlFpIpJmfaLtk+Yg6qFw11/aeMgE3Uf:aRuG/SKoLH4vC9L1kO5qLAbJkE2/aeMy
TLSH
T15923F1B3D385DE3992E317B0E67D22A74BD21AA47ACEBB23492BDC4215F1C504254DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passwords.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\passwords.txt
Size 233KB
SHA256 8b58407da38fc0edac67ad09487ee195cc171960f4a72ab756c912f46a052468
MD5 13c1efee289d7ecc8a7e7bcc7ce47df8
SHA1 c2864b21ab8130e8cae66f1f19ac38723a7cf42b
SHA512 08df4c520a896ee26ef9b8f093b2e14b6e4af67f910f12d70270917df2d78a4666458386fc6e83258d84d24b03e517e39d7799225b41a6687278dbe9610ae537
SSDEEP 6144:EY19QF6DI5luckZEjoQKe8rbbIptoWfEYixiRG+GpAcBN:EY19QKI3HkZ1QKe8rYf3fEp0RDIAsN
TLSH
T164348EB5F6A03176E6CF464E580A3F058A9D37335D11589FE7B80788120BBD885BBE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

surnames.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\surnames.txt
Size 74KB
SHA256 9c57664a651bed87b046ed8bceebd0aad634538a917a75de0a8ecffef06ac641
MD5 64ffd4d0d29a84dbf99bddf1afe7e068
SHA1 f1c3703c60fa8ceb538a851acbeb2cc48e78243c
SHA512 d447a251bbc6b5da76b9327dca62d3a40d6e2ae5c59c35f9e7615be15e1e5eedcb7ec6d20ec48df33904851002c823501f9f3347dcd0e279f3fa86b00d050d28
SSDEEP 1536:HZQFhD0AAQnaaq6NE1f+oNh2MGfAoocKAPvY02+dhQ:5y5/LaZmoCJeoxbdK
TLSH
T169731A76E2B4383AE95F1B8D48953FC1C904D6338D10A1A5F7B906CAA047BC58DB5F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\test.txt
Size 15B
SHA256 92b772380a3f8e27a93e57e6deeca6c01da07f5aadce78bb2fbb20de10a66925
MD5 29b933a8d9a0fcef0af75f1713f4940e
SHA1 9fbc3fafddca353898269a2f4069e4653083bcdb
SHA512 9751ea443fd632e147831566ccb822482220188993cd1269edbe98d2e2d69beb5fb4b631c5001f47491dfe7550cb68035267fae518f1ff119e465b54379389fb
MD5 SHA1 SHA512

Submit Download

us_tv_and_film.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_451854933\us_tv_and_film.txt
Size 159KB
SHA256 49185c0fb29f08237602dadd236d919e4372fb1f0f5baad2936ec6f51586bb24
MD5 206a438724efc16dc8afa5a8984f05d1
SHA1 57225b5fb5cb51333fa9d79865f2393ec4445e42
SHA512 6a653e259d4f15c88145c820d1e3062194370459da34cb2cc49fbdc681e1bf3176501129640fdc1b635ea805c03ab85c8bc5169e23ef099975fe559bf284bbab
SSDEEP 3072:CwawB3H2+8PW7D0Nr45Wn9TkOijxjTBUCbws5d0hKS4D/ODGRtenXpMFU2c92C7/:fawBXbD0NEc9yxjt3bws5d9S4D2CnKXn
TLSH
T1FEF31930DB64353ED79B2BCEC8642F52415445321E3570B9FAAE0149180BF9E8B7AE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_721843115\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4724_721843115\manifest.fingerprint
Size 66B
SHA256 7ad6d17bd7b1bf49425f7efe322f4a9065446eca71d3ea1ebe0a838efcb08e95
MD5 fa32cf839f99432676ca9acccd8a0550
SHA1 9a869d2475f9840495188509e12ce9ca5a9e7189
SHA512 b1e901d92adecc46f96f52ac38954688f0a2514710041109785656ffe694766448cdbafcda397e9edb196763997d952537ebfefb4e5d128954576024f8856c04
TLSH
T1C5A00216AEA0E812F29486DEC4254B6A14372BF9AE76008979E8E4819C87260815B8D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1500-2-0x0000000000B70000-0x0000000002916000-memory.dmp

Download

memory/1500-29-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp

Download

memory/1500-1-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp

Download

memory/1500-0-0x00007FFA94E8F000-0x00007FFA94E90000-memory.dmp

Download

memory/1500-4-0x00007FFA94D00000-0x00007FFA956A4000-memory.dmp

Download

memory/3204-69-0x00000201DD810000-0x00000201DD81A000-memory.dmp

Download

memory/3204-12-0x00000201C2E10000-0x00000201C3084000-memory.dmp

Download

memory/3716-479-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-484-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-480-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-481-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-482-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-483-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-475-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3716-473-0x0000025F3AF30000-0x0000025F3AF31000-memory.dmp

Download

memory/3856-97-0x00007FFAB77F0000-0x00007FFAB77F1000-memory.dmp

Download

memory/4636-246-0x000001FD5EBD0000-0x000001FD5EBDA000-memory.dmp

Download

memory/4636-80-0x000001FD5E630000-0x000001FD5E652000-memory.dmp

Download

memory/4636-245-0x000001FD5EA10000-0x000001FD5EAC2000-memory.dmp

Download

memory/4636-244-0x000001FD5E9F0000-0x000001FD5EA0E000-memory.dmp

Download

memory/5168-181-0x00007FFAB77F0000-0x00007FFAB77F1000-memory.dmp

Download

memory/5656-357-0x00007FFAB6090000-0x00007FFAB6091000-memory.dmp

Download

memory/5656-358-0x00007FFAB5D10000-0x00007FFAB5D11000-memory.dmp

Download