437eaaf3dcd64b8ca2eb80a8d90a573364b6d12e8d913a632bde88b6cd931960

Analysis

max time kernel
150s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium-Portable/app/Potassium.exe
Size 27.1MB
Sample261113-mx91msax4m
SHA256 437eaaf3dcd64b8ca2eb80a8d90a573364b6d12e8d913a632bde88b6cd931960
MD5 a276fdb529df1f1b09a81d6c9621453f
SHA1 f1e0f75b7054a1f29eba79b6fd701cbf476d0717
SHA512 cf57507eaf10593a6392ffec6e355021f72c27282e3d1c62999190ea54c914c739d1495dc34c2ab1c6f18b78e6ff751b8b8ca25f993988368a9769b61ab446fb
SSDEEP 393216:27qQ/kdQbtx5fqTNsPo6wDwdAdfIKfTVTDwTZ9TCp:27f/kQDoTTx0d8/bKT
TLSH
T1B1574A257A5A996CC09BC474838B4A734A7130CB0B35B9FF449492792F7EAF42F38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5776	Potassium.exe

Loads dropped DLL 3 IoCs

pid	Process
5776	Potassium.exe
5776	Potassium.exe
5776	Potassium.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2916	tasklist.exe
4520	tasklist.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1162236489\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1162236489\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\LICENSE	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1660	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3060	PING.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3060	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
236	msedgewebview2.exe
236	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1620	msedgewebview2.exe
2208	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	2916	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6104	Potassium.exe
5776	Potassium.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 1620	6104	Potassium.exe	88
PID 1620 wrote to memory of 2360	1620	msedgewebview2.exe	89
PID 1620 wrote to memory of 4796	1620	msedgewebview2.exe	90
PID 1620 wrote to memory of 4796	1620	msedgewebview2.exe	90
PID 1620 wrote to memory of 4796	1620	msedgewebview2.exe	90
PID 1620 wrote to memory of 4796	1620	msedgewebview2.exe	90
PID 1620 wrote to memory of 5716	1620	msedgewebview2.exe	91
PID 1620 wrote to memory of 1036	1620	msedgewebview2.exe	92
PID 1620 wrote to memory of 1036	1620	msedgewebview2.exe	92
PID 1620 wrote to memory of 1036	1620	msedgewebview2.exe	92
PID 1620 wrote to memory of 3516	1620	msedgewebview2.exe	93
PID 1620 wrote to memory of 3516	1620	msedgewebview2.exe	93
PID 1620 wrote to memory of 3516	1620	msedgewebview2.exe	93
PID 1620 wrote to memory of 3516	1620	msedgewebview2.exe	93
PID 1620 wrote to memory of 3516	1620	msedgewebview2.exe	93
PID 6104 wrote to memory of 1660	6104	Potassium.exe	94
PID 1660 wrote to memory of 4520	1660	cmd.exe	96
PID 1660 wrote to memory of 1384	1660	cmd.exe	97
PID 1660 wrote to memory of 3060	1660	cmd.exe	99
PID 1660 wrote to memory of 2916	1660	cmd.exe	100
PID 1660 wrote to memory of 5908	1660	cmd.exe	101
PID 1660 wrote to memory of 5524	1660	cmd.exe	102
PID 1660 wrote to memory of 5776	1660	cmd.exe	103
PID 5776 wrote to memory of 2208	5776	Potassium.exe	104
PID 2208 wrote to memory of 5688	2208	msedgewebview2.exe	105
PID 2208 wrote to memory of 4492	2208	msedgewebview2.exe	106
PID 2208 wrote to memory of 4492	2208	msedgewebview2.exe	106
PID 2208 wrote to memory of 4492	2208	msedgewebview2.exe	106
PID 2208 wrote to memory of 4492	2208	msedgewebview2.exe	106
PID 2208 wrote to memory of 5200	2208	msedgewebview2.exe	107
PID 2208 wrote to memory of 5788	2208	msedgewebview2.exe	108
PID 2208 wrote to memory of 5788	2208	msedgewebview2.exe	108
PID 2208 wrote to memory of 5788	2208	msedgewebview2.exe	108
PID 2208 wrote to memory of 5772	2208	msedgewebview2.exe	109
PID 2208 wrote to memory of 5772	2208	msedgewebview2.exe	109
PID 2208 wrote to memory of 5772	2208	msedgewebview2.exe	109
PID 2208 wrote to memory of 5772	2208	msedgewebview2.exe	109
PID 2208 wrote to memory of 5772	2208	msedgewebview2.exe	109
PID 2208 wrote to memory of 3244	2208	msedgewebview2.exe	113
PID 2208 wrote to memory of 3244	2208	msedgewebview2.exe	113
PID 2208 wrote to memory of 3244	2208	msedgewebview2.exe	113
PID 2208 wrote to memory of 3544	2208	msedgewebview2.exe	114
PID 2208 wrote to memory of 3544	2208	msedgewebview2.exe	114
PID 2208 wrote to memory of 3544	2208	msedgewebview2.exe	114
PID 2208 wrote to memory of 3456	2208	msedgewebview2.exe	115
PID 2208 wrote to memory of 3456	2208	msedgewebview2.exe	115
PID 2208 wrote to memory of 3456	2208	msedgewebview2.exe	115
PID 2208 wrote to memory of 236	2208	msedgewebview2.exe	116

C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6104.4276.13696256806575520692 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffcc9fa5fd8,0x7ffcc9fa5fe4,0x7ffcc9fa5ff0
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,3841488881938950532,12063792839891334291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2156 --field-trial-handle=1752,i,3841488881938950532,12063792839891334291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1752,i,3841488881938950532,12063792839891334291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3372 --field-trial-handle=1752,i,3841488881938950532,12063792839891334291,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
    3⤵
    PID:3516
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\potassium_update_6104.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 6104" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\system32\find.exe
    find "6104"
    3⤵
    PID:1384
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3060
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 6104" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- - C:\Windows\system32\find.exe
    find "6104"
    3⤵
    PID:5908
- - C:\Windows\system32\xcopy.exe
    xcopy /E /Y /I "C:\Users\Admin\AppData\Local\Temp\potassium_update_6104\unpacked\*" "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\"
    3⤵
    PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe
    "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5776.2076.10177181333275025492 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffcc9fa5fd8,0x7ffcc9fa5fe4,0x7ffcc9fa5ff0
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1860 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
        5⤵
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:3244
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:3544
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4540 --field-trial-handle=1728,i,15836802365570476874,6327978390551380472,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Decompiler.exe

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
Size 2.7MB
SHA256 eb9cdc2394b3a807de2edb19d7dc1b8115227e4bc5686a93cd9f712de5b4952f
MD5 e476312539e698d78c5b0fa9713f8381
SHA1 675182e23693b055e82fd0205f0013ea543fbc1f
SHA512 b3faef488521668c3ceec0f7f8e113cfa9a7cb19529370c37d1d6811d1e3f6185d65f5ac8aca55dfaaf347c1e3d9ce14e235df3a0478c05aced0fe287ee130ec
SSDEEP 49152:/XbEjh1OsKMKLNWAs7TRcVtHdlxaad5FV2U7x56:2haMQxV1
TLSH
T125D519657B5A98BCC59AC43083068A735A3534DB1B75BDFF048982392F6EEF45F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Potassium.dll

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Potassium.dll
Size 9.7MB
SHA256 f6a741268c398529758f68e8aebd5671bc2646f62fcb293c8a0a273575a042b2
MD5 c3162b9339b44183865f63beabe82084
SHA1 040ba52c8ea587b7b5d50883b6668d876b48308d
SHA512 0758acd97e5b0e23a2dc7cc37fa8d979568b8128895c1eb78a944d2ccb1bbaf8272269d4e8c6898c0a58d88184adc9f3eadf88a59adfedbb9d9c8d2973b5f027
SSDEEP 49152:vpi9olwtOJUZrHJEWu1JOLSimiVPsWpB9ntU7KpfdjZo4e9iQMtoMLe98KwfemwX:OrHWWl/H23dDaQqP0OKbROpeal
TLSH
T158A68E6651F405E8C3BFC079E64A9E13FA71780D4320B6EB8DA54B521BA3BE0677E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Potassium.exe
Size 16.0MB
SHA256 79b428b2dc2695b47aaa4b5f1fbdb30d609e36d726e4a0a99310aa2f29267559
MD5 7ae6b8e1cc5f9e0388c1e022e388d2c3
SHA1 914b4932ead19db65975851660de2978de7ddcb6
SHA512 7218271eedb9d61b88af0fce014ddf8608053f38363a5d465c5d03d39be144aa32c9e8e8f2fb177317654a648128214c0238b9d292b03b4b63722ebe32909c88
SSDEEP 393216:S6mRLJTqG/MyT4AgVQpVmfebtlxweJj8:S6mRLJTqsMg4Agc/pwa8
TLSH
T18D0723C27EC5A2E8C0E74F1467CA178E60F1B7DA88FA5A1E3AC55C035E70F971D09692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scripts.lnk

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\scripts.lnk
Size 1KB
SHA256 00ee5ac203f530c285231a8d1055764ae6bc6056812b2ff6b2b400c13eedb4e1
MD5 368718555cd69e85c33ab66442815cdb
SHA1 8e2eda2fe3c0a6c853cd471e17a271883f87c42f
SHA512 3e235efa55411fcb8aee573ea8a81298302ebb0003ba20a42e81cf2cb79d7969cd684e009ca2d4e03610225705c9f28e70933dc33c2be16a2683e2d92a536359
TLSH
T18131325D9DC80F31C5F58C7757AF2706DB6054627F9E9D260E94828D1E22A02EC54F1E
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workspace.lnk

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\workspace.lnk
Size 1KB
SHA256 24ab09465ffc09f89917a776325062f23b679456a0d36799b4cab65242f7dbd4
MD5 4cf25c84d3e866e83709df8a6601df61
SHA1 89258dd5f24a2d681702e950f491f200fe4d0941
SHA512 760096b6983d8b9276398e216211b858835e016e7e348838cc59af4f1d3927652cc61d2fa96ca3847dc00b820888516ea76d4dfa7612cc426e14ff26f1e1fc83
TLSH
T1C231351E59C95E35C6F6C83527DF370AE73450A5BF894D01419081491D329C2F854F1F
MD5 SHA1 SHA512 TLSH

Submit Download

potassium_update_6104.bat

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6104.bat
Size 739B
SHA256 857511496ea810c70fc8262f6090e265d0b6bbc32e84dc1d59231cd51c39e5b5
MD5 b4fd95c3879fca696f141f97f00a9022
SHA1 e99f6994af1a77eccf200e16d391ec43dfbde16c
SHA512 2355a87233714c42cd23d5a20584a00a1f9029f7f7051b7e4a9e35f1024d0ae567c930e83642e00b14cdc9b6355336aa9e61210ae386959baf273a9e13dde7ed
TLSH
T1E301457D414CCE5B18696842C9FD400CB07EC9AF1F0A7EC0422AC47BA152817BFAC6CA
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6104\unpacked\Potassium.exe
Size 27.1MB
SHA256 5de156fa4bd3f9efe88783a4eef055068e0a581b4903a26691cfd7c50affa3b7
MD5 0b67ba1a328f1a6d33f4b98a2adfe2e4
SHA1 6fe91d434656e6ec8769e24f17a82e73e7bbb276
SHA512 7f415f19a34c8e152a9c794a5f476080bf9bf7c3f0a7214aec19ea7dc8c194d0b5acd605b3d6615c7a2cdf8b5d2acfc55b1ed9468462fcefe9270e2f36485dc8
SSDEEP 393216:Ya9Iny9G03rWxzefF6wDwdnKfTyxbxypd:Ya9Iny9GwrW8tx0dKbei
TLSH
T194574A257A5A996CC05BC074838B8A735A7130DB0B35B9FF549492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autoexec.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6104\unpacked\autoexec.lnk
Size 1KB
SHA256 006d6168d27c62c347d1b5c3c493f9d9f47d4f24998cd1ed4e6af55386d2a745
MD5 a2f6abf50bc9a739d90905aa42153343
SHA1 4bb0b291fd763628bc10770ed2ca015bae3d2380
SHA512 d898517c1e201b2b32c2765aa4486bea8190275f12cefa2a93eb44658d693507ecc81f7e27450507e3b392c2f9640d63d3d341d5b1b20677d62ff68d8b172a3e
TLSH
T17B311F1D5ED51720CBB988B617AF2306E76324527BAA4D2606448A4E1A22542BE58F1F
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_6104\unpacked\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

028738cf-801a-49db-a1bd-08ced18fdb2f.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\028738cf-801a-49db-a1bd-08ced18fdb2f.tmp
Size 3KB
SHA256 9759ccbfae2bd4ffa617256cc6abc2573ad647b40e4d701b153d0f667c36ed5b
MD5 52a278eb18918c8be06244a8a11a82ed
SHA1 da3144e7ed26ec77a0ce919a2c07d0def81d4691
SHA512 979b497acf0c863422a9a6d0286cb43a29b4382f9b48217714de2f9c3de4ea4380ff8f981cc624c42a23caed35f9b2579acdcf95f1a928e4ffa14bde482ac147
TLSH
T1E161A73BA974A93B4EF2DE04BA863F17ABA55127E4923F54C6EC0F0C02D72981351C17
MD5 SHA1 SHA512 TLSH

Submit Download

0ede86a9-d67e-4419-96ea-f18cd42110c8.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\0ede86a9-d67e-4419-96ea-f18cd42110c8.tmp
Size 4KB
SHA256 518c6d20bb1bb83608f15bcbd8b88c63609103f96a445486cb51f1c2d08a2f63
MD5 3a33b23085a557de00a90fa7d0f1b353
SHA1 d58f544fc5e065c582c1badf24beffe648a161d7
SHA512 94fafbc5576fe758c1c81f0304b859f47fbb68a2889ccd898b1887b4a65a844ae7f35d44aaff2870506caae26837b755ab99b112a12a50564b692fd930e91a67
SSDEEP 96:/gB3NkGSCgfHaK978kh/cI9URoDotoN5B1Bfgi6LBZKHZRT9JFa:M3NBSlaGeoDUaBfgetg
TLSH
T1B081A337A874AD375EF2D908BA823F07ABA45023E5967F94C6EC0F0C02D72891352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13308f14-2ce1-4896-bc9c-35c838d81c04.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\13308f14-2ce1-4896-bc9c-35c838d81c04.tmp
Size 2KB
SHA256 92dbb23f0dab420fe5e7fd1818c999d5a0af7dd246bdfe5f9c157fb1724963ec
MD5 c4c3e6a10a78e4d9e53b94384cc0acdd
SHA1 ad31963026b2acc0a4c3ee5c16b6b3666300892a
SHA512 841659777e25a65541a823934584d1358707bed20570a01924b79eb2235189d0671e5af3fd1a7b90bce35e54999c2570d57957f676e0cde4c28a6b7c7a8a401a
TLSH
T167518333A824AE379AE29A487B467F278F7551569A622F10CADC0F0C02D755C2352C37
MD5 SHA1 SHA512 TLSH

Submit Download

781c3c36-6e0d-4523-9b03-da919f08d015.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\781c3c36-6e0d-4523-9b03-da919f08d015.tmp
Size 4KB
SHA256 611b7672e301ab0796119a5b6e4438ce3aafb76b7f66c934bb29229bd6eef23d
MD5 3356f83e834875b030e1932c5cfbfb80
SHA1 d3e11ad96cddb252d10e8309b1719709ffdb74e7
SHA512 bcf65e800e377e6d438c613bf936140ca6c096a314ddd6f6293cd82b9a4a14ea35d193da1c11dc22e29fc8b67f5b5ff469ff51a4a6d3d58070be20ef5507bb4f
SSDEEP 96:/gB3NkGSCgfHaK978kh/cI9URLl8DotoN5BmBfgi6LBZKHZRiZJFa:M3NBSlaGeiDUaYfgesM
TLSH
T1CD81A53BA874AD375DF3D944BA823F07ABA4502395863F98CAEC0F0C02D72981352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a17fb34d8079ee8e72b023bc27dac515ad1912a09693d401381b61030c3835bf
MD5 fd891ad9b3fcf58248f60c2904a19f6e
SHA1 7d365e243d58fb0fbcc2358603562d6a9de9157c
SHA512 5407165b874699021df245b4a0d471ad01d014058fce64faae14693827cb2baccd13d76bcef119027af4d54b2ad7da0615d8e40091c21b82bb8cf4de51d4a0f5
TLSH
T103D01213B3014634C01020B34512E10D1400CA1B40454100A528992D1A144590906482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ca2682be7c96fcb2a533d3e181de28babd663f26c3607452f3c63e5a6a7352dc
MD5 819005982926eeadb039f813fd6d389a
SHA1 1bf34a80642e042886a2984bb55d466bc8d2389c
SHA512 8d317d58517953f345c29008b7146935d5fd2b4eaff6cccf13e1d69dd1c9dc81e75eef4e14f88f6f0bf1684b996b76db181e3cfbc431aec0c74b4a9c9347ee65
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 159f8ee8ed711daea6d3c711e4119fe7b60a82df43f058a46d19661e92397664
MD5 96e1abf3ebcf4c489de1f087163da49f
SHA1 65d2f7c9dc3abe5b84d27a4dbbe0d74547ee6246
SHA512 2f54f056f6422d99b07666a89cdb59b706dfb26bfc7903e877f148189acd9f148913ea418de155bc7e2755ef897b8ef77ba70bd0c995b57a4449fa1b67859399
TLSH
T1C0D01213B7015234C01021B34511E10D1500C91A41454200A528893D1E144594906482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

936dd4ed-263c-4bec-b9fd-b3a83c824e9e.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\936dd4ed-263c-4bec-b9fd-b3a83c824e9e.tmp
Size 6KB
SHA256 dc9780ffbeff196c94f77740ccf6192a153c3917ce7e7663ba5cc85533ec26fe
MD5 44da70e02653530aea60efcb1bb5a74b
SHA1 a63434ddc631ec81712fbc2ded184fb115a19611
SHA512 43d03719b6375827207060fb36cc9cf90e59552989a7aab1e0acfbb32787d9d5ec0d697549a4e4583e22b0a410806b6d35091bbd6774f9045844d25624be9174
SSDEEP 96:st6/dbSumkbD7k+sdo5h16Z0es7/x+6MhmuecJxiMkkjes8K+g6d28XM1C7K:stiNssuonesV+FdxiwjRqG6K
TLSH
T1EFD185069E34B97B4CC6E518BB65BA17D3F9502270962E48EBF84A2C05DB6CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 31c2929abd34ea808e13991fa591f204385e44bdb29b6cc1960a7ce38a795f1d
MD5 52cb557df375daca6e5b173b3999185f
SHA1 d65dc3cdd863bcaa31bd258a5579a33126f1c525
SHA512 d26e1d1fe426d8cae2e231afb6b6c01bbc9818bfcdf6ec44b0c8790b6c6796dda008f900d4958c3db0213e0ba873caf4ec89074658ce270def88f042536c8be8
SSDEEP 3:LstlNllkll/lcqe:LsX3lEtcT
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 ac273d687ee175f19c2a5a7b4a7d4cf5857ae9bcb6105bb4be3a099eda323f93
MD5 43a8a07884c31a68c9d5b5338ed95dad
SHA1 1a00c143654055b5348b60becf34cb2df56a9999
SHA512 5f72bc4c69bc1d0a465e87d6af72e84b98d765db5e176cb11de57d4208cfe79f5f9b0ccb6e6602d5b30d4643c28d79b4a786af4d57ee6a45cba7dca29c1e6559
TLSH
T117B002618DBC9507DB5422F562C326F579301C1825377B519991D0FEE4B77D4C53390E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 63625d3d05282fda895b06bea6e3b8ed5e2eaed77116c61f279ff233ad222b3d
MD5 ed43c23149051b0a1f0a38dbd0c7493a
SHA1 26ee0cbd80290f8d54262b9d24f7dca484769306
SHA512 80869cd9e2a742eacdad51ebd82b45ab04cdf6af7a32c33ea51a7d4934a691a4108b9fbf25d610a18be209a7729f084d5519dfe3a1272139a32864334ae8bfc4
TLSH
T111C0921289ECC00BD32021F203C73DA1323009C41537BF8AE266C0BA60B7FC0A272A86
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b8add33c260dcacc9409d5623dfafc6ece16a8d5d91426bac07f835e86bc3571
MD5 6bbbdb194008d178baff98044deb7c0d
SHA1 ff3b41c74c3863953bf19fa2272734ccb0383449
SHA512 8c9d06a7c62aeb95699f04634a4e029ffdfd9881e9e39aba5b5164d8b8e6e9a97e6cab5a1a2e54ff4e0a8a1de1304ef4d0b7ce695a3d015b5a808d00a2d6c1ad
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Favicons
Size 24KB
SHA256 3d3d86631d57db67d88cf762d8c72b402d9f47b22e893c396079ef42d765e7bb
MD5 fdd7675070ce7b76b81fa143f8033f46
SHA1 8f8b5581bb7c4b56a6e98c22e1133a1853a206ab
SHA512 9913d2721768d86d7ae6cd554e1efa3f6217528a1fcd4643215f2cfd57eff08987934b856e079114c5beb33ee8d3b58b6f162aa202b326faf01c97317f6f0b37
SSDEEP 48:QBmw6fU1zBuzZR9q8pj8ZUHaJDmSo0C8dtupPzjv0PcrRmlBSTkikUe51nbC:QBCyuzZimdaZmSoJeGzz0SRNTtMo
TLSH
T169B2E81F5F387006CBD15E7E2BAA5C3A8D3FC35DAEA60C287C2884605CB5585C5395BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\History
Size 164KB
SHA256 467e39b84d2c1a4900241d5e44145795a8e98b189f1593bae75305bfed5708ce
MD5 1061fc5400c1c684789b71f991a5bebe
SHA1 3b68ed966849a1b922a400a952f0819e692a024b
SHA512 09f801c4f454a9a685915619a41096bbe173a5fcf2a9f06f9ef3754417a00a6b5a3300e06ff06cff63e76ef8d11a97e0b39898093056b35effb6dae2960f5d6d
SSDEEP 96:8BvN25LqL/uejzH+bF+UIYysX0fxQp97zXEHt/DfLVVVN6zRk/E0zEV:8B85qL/tH+bF+UI3iWGVzXWNVVV637V
TLSH
T1D3F3FA5E5F243212CDBD923769E645B3597CF03F87236AC66C6204B1CEE2656B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28fc3acd-d119-4134-99cb-4d2c8da1fd30.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\28fc3acd-d119-4134-99cb-4d2c8da1fd30.tmp
Size 188B
SHA256 cdc405976d20e4185721dd4a5a6b9d74e2e247b845c048695ac5de1932cba96a
MD5 4cc616ca7f2016926168724036eb2c76
SHA1 c959b8a3639b7114a10d2fa573c5ea1501d6bd57
SHA512 6be953d442ba996332f374fd9a6b20e08e30ed6c5f4fa94a38f1be78fb51a681daf04b6a39095d163f01bab91dd10ce2fa991b5a3af8ef3753dbca05b4d4899e
TLSH
T16DC02271807EB132103805210A90AD409E3AB039008250F885A30A3C608086A5203412
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 a095c1a39ee883406d22e2b1288a13386a393450c1604f216a4f6b67272bb1ac
MD5 0d19b73f5dbaa919dcb13ba72f68e81e
SHA1 3d990da13107c3ebc740ad41d673d09143f9b756
SHA512 098496bcbbd51f9b37a75ed0224a07b537792a2ae76d57211883ab940807149b1877ae27b658bb211ead310501952bec595c0c30c5c5de051884d61b204d0419
TLSH
T13BC0227184ADA032203805F10A80AD80AE37B131008298E891E2022C62A0467D207003
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 e01f8b9400a28086024627a8f43ab17273838be152d16e2e52aa6406b8307fc3
MD5 2f41b1d82b57f1c71dad1394edb775ae
SHA1 7490277c534c0e652f50df34269789593a1f89cd
SHA512 592f6f66cbe68424bb8f50f91accf3c3935db503eddeb158d9d4b6897963d1b029f38a71efe3e59909371f4de9bb6ab84f55231d871c30d6c1b2d1a25b7b5c49
SSDEEP 96:r6/dbSujb97k+sdo5h16Z0ds7/x+6MhmuecJxW1ejes8K+gO3MI8XM1C7K:riNzuondsV+FdxWQjRDg6K
TLSH
T160D1A4069E34A97F4CC6E118BB35BA07D3F9502270962E48EBFC4A2C15DA6CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 2deddad5dd9d200c206c963976cc6ac66421e8ea562b79e2a04111e8843d3b45
MD5 0602a0b4707af016c92275b8b08d5dfe
SHA1 b6ed45dd356e0e19399296c080bee273a19711f8
SHA512 8857391088adbed1effdceb6ef0f50618cb998486229a19d59f41e18fa907c60b897db25b4d6a9ca762c303ef5dc04da88b22caba13726ad2c748bb93b8e2c0c
SSDEEP 96:v7iFPlf/ROo1pkF5d15iK7VaTEv9V5h5pg5+e0yNGPr1FFOA7am/tqF:OFvpC9lXrsTF
TLSH
T127C1C6E7492CD5B8AF444BEBE8397ECB99AA009F99D58809D6D2C08807C1EFC20D9495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 d287611c1af2fe6bca97057f81f8b9cf063e538b92da2cd8127b1223cfed6558
MD5 c60b195d8087e36c55041cfa3a92d503
SHA1 38829b4719c159a2cacb64ac0be6b658074f3a87
SHA512 0b51abfb0bf0a814b217703d229ef02bb02a1b7562a8e55776f32b4f30032f8930185e458cb7c6131ed92ba768ffc8fecb00627bf1e31f765ffb8552cfcfa9aa
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\LOG
Size 325B
SHA256 5dacdfd6f51b181526f34e63c4412674ccf1a1522d250c5d40f3e6c9733d39b3
MD5 5cd1b122a40cb8488b13e710b34d6e25
SHA1 9dde97f1933d39ae19beceb4b87c39e987755fbf
SHA512 e8a5bf2b1312aa2c90cf9db8fe09e4202f38cb70be953620f3f1bc30653907ff0298e12ecba96332f0dceb1d4c342fd40c8b387b98dee9d3233412b7dfb579ce
TLSH
T1BAE0202035CD872713C504DF237DB70CC6256410F7D9161A0F38F7C0118B48C7541341
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\LOG
Size 301B
SHA256 dcbe7b33bafd25bcc718c2edf23d446983090b2b5ba07e5cf9aa24de9c342715
MD5 70f17a2a17e16063064e9b2b04f77594
SHA1 9edb96afa6c2982d00caf954d4c68a9adaadabe6
SHA512 4f23b46041884230b29ae85d4c1bb2eb443f50c1fda0798b48b18cdf3f9b8ea1bc8f2132d640008faf8a98e06aaad0c08e49a70bad9d7de1bccedb47c10cd72a
TLSH
T1E7E08670B8CC877716C489D643BD6B1DCA785C5467C93A4D4F58EE84298748DA661381
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Visited Links
Size 128KB
SHA256 7b8cb820fd367211e05c07a7885c99489e845d6684b2d39a310cc7ad1c26cf42
MD5 64ec9f8d5d53a96bf683f0e95741e657
SHA1 cee153cce7f5324736a0e1a8c33bd5327e37918b
SHA512 4026a3e3fb12a39d69c214217e9b24d866f2c18ff34749a09629cf046cd5bc1fd78ebf7ca56f7a765321619ec63d19e71287f0a47f7ca22501e5108e6b4778ea
SSDEEP 3:ImtVuEw9IslX:IiVuEwlX
TLSH
T1B3D304573F051441F1C50030DC5D05054450C01705F1401103750DD354C50434307400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9980a76-3321-4845-a8fc-9be8aa57ac98.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\b9980a76-3321-4845-a8fc-9be8aa57ac98.tmp
Size 6KB
SHA256 2310963e015f635b9b9afc49c74d76f6c674f5cdc15f42ac33c102c177f2b738
MD5 b03cc576154f0e24c7a4fa1208bb220d
SHA1 54f5387eacb56a4fa30d4de985f8e24d898c50b7
SHA512 9282920b2088fbf68e628e146a650779cc00acf9636da98241b78acf4ea4a459ddb29d6f9ad1c306ab64dc2ef29e5c46083ec2dc2b879e77ebc7176140d77d9e
SSDEEP 96:st6/dbS1GmkbD7k+sdo5h16Z0es7/x+6MhmuecJxiMkkjes8K+gpG28XM1C7K:stiNKsuonesV+FdxiwjR+G6K
TLSH
T147E185069E34B97B4CC7E518BB25BA13E3F5602270912E48EBFC4A2C05DB6CC2213D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 19f82767f1cdff0620613bda435ed2d59820d67b8d00630b4e8a2637e2eff645
MD5 508d95f5df96b9b9343d70eb1a56b06b
SHA1 655a9ca8b3fbf11f0eebea25c4c818641d648237
SHA512 8a0bbd958a745b989bd3599ba7d6170c6a5a5872de787fbf72f023e5253255aacb1b2949f240b7441c84c221643073c06d6f23c530841486f047391b01ff1639
TLSH
T1F6214073E4785F33B9D2AE992342BF9F5F60516B81615E0491DD4B0C03E209C662AD33
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ShaderCache\index
Size 256KB
SHA256 06a178dae8925285049493152401d19017387e1840e13363d8c282326ece7d50
MD5 b829f863e22b5170a86f565e80ab63cf
SHA1 b922409db613a6a07abb538947fe5aea06c8d369
SHA512 07aaa51f9f377a2e684c12ae124247c644040047fa0eb2e4d975d9fb49cfb5bc20a5aa3a163faeb0a1401062613e36c2e63e00392077c80ee2e56dabca6bc9df
SSDEEP 3:LsOllllklkXlm0lX:LsUlPmc
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\WidevineCdm\4.10.3112.0\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

bc0ba799-1591-4857-99b9-50bfa9436017.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\bc0ba799-1591-4857-99b9-50bfa9436017.tmp
Size 16KB
SHA256 d50b65348199aaff795657ef9a76443507e0c691a6272b0f8746d5fa28b20f30
MD5 c158d3f2959d647c774798187858ef4e
SHA1 18358ed00c251235b13971dba7b451f2c7ce56f2
SHA512 c548b20af2480ddc964ed3a9db2491f23509135004d9f9998304cc1eab3faa18970ccccba8d3e2208a77201a313d6c24d76534eec2c7d1fb3881546984fa58f2
SSDEEP 384:W+OBqImmJvGBLx3NaFMJF83NBSYoSI1Jg6r1:DcvGtlN8RNkLB
TLSH
T13072AE7B2C396E372CF78949BB8A774B8B646253C0D53BD8C9EC9F0E026B4841352D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 e1f9ad648017e2cb0f0cd798d815dc51012b279ba32571e7b6eb5120b0ed2c05
MD5 046fdd0c07bbac0c160b03a2cea5ad4b
SHA1 fbe9107b962ff2c77070579a8769ce7188c4b473
SHA512 0a3e385a3d27883e6495e4cb4fd20bd5dd0c61176e04df2762fca9d13847c9ae88de7ac57648732ce6d6cce27f2eb9da4dbf9c54d1953504de784c4cb35c8fd2
SSDEEP 393216:DKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHk:MWCmz0dwJIkpqCw
TLSH
T15A37E14AE35350E9E81ECDF0866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 868171d91275d1e180a452621f66428afec0a9288ab96344ce92fc904ac1f70d
MD5 c7bf17a2f118fdb4a4344196706b6393
SHA1 d07695b35bf2f4bd746586fe56ce2ae9d7c99f69
SHA512 11abb5b2ea4120df63216ac38aa85c8deaa7d96b9e0a8867b8f281b0652211f4600bd4107d182f3ea0c657d8a1675ff56d0279837a7c33410a7968f2c5a9a754
TLSH
T1742108F4A215A94A7F50C142053DE827CF3E8AC12C6188B644BFC23628EE7C00F8457C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1107897025\manifest.fingerprint
Size 66B
SHA256 56d1fe98928ebd4be664fc103e35673a15c2dfa98ff241478bbd39beb15a0754
MD5 bef72178d2d9f61006676a8323ac4a20
SHA1 281541cc22aaab5d71703791192ef66ee2e831ba
SHA512 ee3664c72ee9a894249799b642ed8c1f10b7a7a422d1277d7097f43b4f892d7b267200d323f861bb90b0436262da13dd3c674c4425dfdc264c1cce3755a593a3
TLSH
T154A022CE0CC208BC30008300FC8C8B222000282823280022F8A023CA32EF30AB000C02
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1162236489\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
TLSH
T1F8A022A0C302202228A00E0A82E20223200EA80CE880002328AC8E2A080833B00A8200
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2208_1730417831\manifest.fingerprint
Size 66B
SHA256 9136f7c8a30419dc70fbe015784d1e8590a197ba88b564ca26b5a1e918e1b850
MD5 b740181eff7f7b568c83ad9d00213b13
SHA1 b3dcc9b0dc397aca84ca76c9fce3d0b37c7e37f8
SHA512 1d5c62a473a4e07c9e3d3d3900992eb6bf504b014763f7c9b7b0ce7e4b05648a9d69bb30a94b139eee88116767ed8d713f42ac49b8bfb4fcb9a1ffeff516397c
TLSH
T1F2A022C082A000F8C8080002C008008ACA00C00208003F00F080F200030CEA008FB800
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-649-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-652-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-647-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-648-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-650-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-641-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-643-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/236-651-0x000001C984600000-0x000001C984601000-memory.dmp

Download

memory/3244-537-0x00007FFCEB960000-0x00007FFCEB961000-memory.dmp

Download

memory/3244-538-0x00007FFCEAB60000-0x00007FFCEAB61000-memory.dmp

Download

memory/3516-89-0x00007FFCEAA80000-0x00007FFCEAA81000-memory.dmp

Download

memory/4492-509-0x000002B4C4AB0000-0x000002B4C4ADA000-memory.dmp

Download

memory/4796-27-0x00007FFCEAA80000-0x00007FFCEAA81000-memory.dmp

Download

memory/4796-336-0x00000207C1E10000-0x00000207C1E3A000-memory.dmp

Download