78f75e896b4b5ad719bc3c79182c5d5ba2dff071dce91cc160dcdf1308b5f6ea

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium-Portable/backup/Potassium.exe
Size 27.1MB
Sample261113-mx91msax4m
SHA256 78f75e896b4b5ad719bc3c79182c5d5ba2dff071dce91cc160dcdf1308b5f6ea
MD5 87cfd6ab9e26a5d11a9985734555f476
SHA1 ef75e6d76ca15cccb40f7a70f528aeebd23cfd1a
SHA512 fb904ffdb2e62121a6fda7e0407a9406e6b223bfffb1519de61237a0e184ff7c349e37de0fe6928189ffb5452a66712acec5b00ec8bd797a8fb70533edcc9b82
SSDEEP 393216:27hQ/kdQbtx5fqTNsko6wDwdAdfIKfTj5TZ9TCp:27a/kQDoTkx0d8/bj5T
TLSH
T1B9574A257A5A996CC09BC474838B4A734A7130CB0B35B9FF449492792F7EAF42F38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5984	Potassium.exe

Loads dropped DLL 3 IoCs

pid	Process
5984	Potassium.exe
5984	Potassium.exe
5984	Potassium.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3484	tasklist.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\keys.json	msedgewebview2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3692	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	msedgewebview2.exe
2992	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2504	msedgewebview2.exe
1392	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4356	Potassium.exe
5984	Potassium.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 2504	4356	Potassium.exe	89
PID 2504 wrote to memory of 4480	2504	msedgewebview2.exe	90
PID 2504 wrote to memory of 2528	2504	msedgewebview2.exe	91
PID 2504 wrote to memory of 2528	2504	msedgewebview2.exe	91
PID 2504 wrote to memory of 2528	2504	msedgewebview2.exe	91
PID 2504 wrote to memory of 2528	2504	msedgewebview2.exe	91
PID 2504 wrote to memory of 3212	2504	msedgewebview2.exe	92
PID 2504 wrote to memory of 4872	2504	msedgewebview2.exe	93
PID 2504 wrote to memory of 4872	2504	msedgewebview2.exe	93
PID 2504 wrote to memory of 4872	2504	msedgewebview2.exe	93
PID 2504 wrote to memory of 5972	2504	msedgewebview2.exe	94
PID 2504 wrote to memory of 5972	2504	msedgewebview2.exe	94
PID 2504 wrote to memory of 5972	2504	msedgewebview2.exe	94
PID 2504 wrote to memory of 5972	2504	msedgewebview2.exe	94
PID 2504 wrote to memory of 5972	2504	msedgewebview2.exe	94
PID 4356 wrote to memory of 3692	4356	Potassium.exe	95
PID 3692 wrote to memory of 3484	3692	cmd.exe	97
PID 3692 wrote to memory of 1396	3692	cmd.exe	98
PID 3692 wrote to memory of 5912	3692	cmd.exe	100
PID 3692 wrote to memory of 5984	3692	cmd.exe	101
PID 5984 wrote to memory of 1392	5984	Potassium.exe	102
PID 1392 wrote to memory of 2268	1392	msedgewebview2.exe	103
PID 1392 wrote to memory of 4768	1392	msedgewebview2.exe	104
PID 1392 wrote to memory of 4768	1392	msedgewebview2.exe	104
PID 1392 wrote to memory of 4768	1392	msedgewebview2.exe	104
PID 1392 wrote to memory of 4768	1392	msedgewebview2.exe	104
PID 1392 wrote to memory of 5320	1392	msedgewebview2.exe	105
PID 1392 wrote to memory of 1260	1392	msedgewebview2.exe	106
PID 1392 wrote to memory of 1260	1392	msedgewebview2.exe	106
PID 1392 wrote to memory of 1260	1392	msedgewebview2.exe	106
PID 1392 wrote to memory of 2808	1392	msedgewebview2.exe	107
PID 1392 wrote to memory of 2808	1392	msedgewebview2.exe	107
PID 1392 wrote to memory of 2808	1392	msedgewebview2.exe	107
PID 1392 wrote to memory of 2808	1392	msedgewebview2.exe	107
PID 1392 wrote to memory of 2808	1392	msedgewebview2.exe	107
PID 1392 wrote to memory of 6040	1392	msedgewebview2.exe	111
PID 1392 wrote to memory of 6040	1392	msedgewebview2.exe	111
PID 1392 wrote to memory of 6040	1392	msedgewebview2.exe	111
PID 1392 wrote to memory of 5332	1392	msedgewebview2.exe	112
PID 1392 wrote to memory of 5332	1392	msedgewebview2.exe	112
PID 1392 wrote to memory of 5332	1392	msedgewebview2.exe	112
PID 1392 wrote to memory of 2992	1392	msedgewebview2.exe	113

C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\Potassium.exe
"C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\Potassium.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4356.4104.831935042048243764 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0xa4,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1792,i,3787152791210508162,3660825969619082674,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:2528
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1792,i,3787152791210508162,3660825969619082674,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=1792,i,3787152791210508162,3660825969619082674,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1792,i,3787152791210508162,3660825969619082674,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  "cmd" /c C:\Users\Admin\AppData\Local\Temp\potassium_update_4356.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "PID eq 4356" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- - C:\Windows\system32\find.exe
    find "4356"
    3⤵
    PID:1396
- - C:\Windows\system32\xcopy.exe
    xcopy /E /Y /I "C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\*" "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\"
    3⤵
    PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\Potassium.exe
    "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\Potassium.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5984.1160.260054629626474913 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffb5f715fd8,0x7ffb5f715fe4,0x7ffb5f715ff0
        5⤵
        
        PID:2268
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1860 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:4768
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2424 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:1260
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3552 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363 /prefetch:1
        5⤵
        
        PID:2808
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1224 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4636 --field-trial-handle=1864,i,2496395398764166525,13260594399725943407,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a6f4c2cdda1a5636fd6c405112e0015bf2b17363
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Decompiler.exe

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\bin\Decompiler.exe
Size 2.7MB
SHA256 eb9cdc2394b3a807de2edb19d7dc1b8115227e4bc5686a93cd9f712de5b4952f
MD5 e476312539e698d78c5b0fa9713f8381
SHA1 675182e23693b055e82fd0205f0013ea543fbc1f
SHA512 b3faef488521668c3ceec0f7f8e113cfa9a7cb19529370c37d1d6811d1e3f6185d65f5ac8aca55dfaaf347c1e3d9ce14e235df3a0478c05aced0fe287ee130ec
SSDEEP 49152:/XbEjh1OsKMKLNWAs7TRcVtHdlxaad5FV2U7x56:2haMQxV1
TLSH
T125D519657B5A98BCC59AC43083068A735A3534DB1B75BDFF048982392F6EEF45F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\bin\Potassium.exe
Size 16.0MB
SHA256 79b428b2dc2695b47aaa4b5f1fbdb30d609e36d726e4a0a99310aa2f29267559
MD5 7ae6b8e1cc5f9e0388c1e022e388d2c3
SHA1 914b4932ead19db65975851660de2978de7ddcb6
SHA512 7218271eedb9d61b88af0fce014ddf8608053f38363a5d465c5d03d39be144aa32c9e8e8f2fb177317654a648128214c0238b9d292b03b4b63722ebe32909c88
SSDEEP 393216:S6mRLJTqG/MyT4AgVQpVmfebtlxweJj8:S6mRLJTqsMg4Agc/pwa8
TLSH
T18D0723C27EC5A2E8C0E74F1467CA178E60F1B7DA88FA5A1E3AC55C035E70F971D09692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workspace.lnk

Path C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\backup\workspace.lnk
Size 1KB
SHA256 24ab09465ffc09f89917a776325062f23b679456a0d36799b4cab65242f7dbd4
MD5 4cf25c84d3e866e83709df8a6601df61
SHA1 89258dd5f24a2d681702e950f491f200fe4d0941
SHA512 760096b6983d8b9276398e216211b858835e016e7e348838cc59af4f1d3927652cc61d2fa96ca3847dc00b820888516ea76d4dfa7612cc426e14ff26f1e1fc83
TLSH
T1C231351E59C95E35C6F6C83527DF370AE73450A5BF894D01419081491D329C2F854F1F
MD5 SHA1 SHA512 TLSH

Submit Download

potassium_update_4356.bat

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356.bat
Size 745B
SHA256 81ec2eda4a89af119e4f41f9f8c21e6c79aed47b5ee6453255ec6a1f6c350e2f
MD5 758f7302ebeb1236da8bee22bc6c171e
SHA1 59ebaf8dd88a302e8a3abd7bfa9ba17a1f2a0203
SHA512 77006d23957c6437dcefb8750cc908642481b945ef5f81881edbc25d449e172a71b1ae964bcf3f0458212e7111929d93baad3ad0ac0cb42869aef9ce191c3ac7
TLSH
T1D201687D4148CD1B147A6842C5BE410CF07EC86B5F267FC4832AD07BA15281ABFAD6CA
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.exe

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\Potassium.exe
Size 27.1MB
SHA256 5de156fa4bd3f9efe88783a4eef055068e0a581b4903a26691cfd7c50affa3b7
MD5 0b67ba1a328f1a6d33f4b98a2adfe2e4
SHA1 6fe91d434656e6ec8769e24f17a82e73e7bbb276
SHA512 7f415f19a34c8e152a9c794a5f476080bf9bf7c3f0a7214aec19ea7dc8c194d0b5acd605b3d6615c7a2cdf8b5d2acfc55b1ed9468462fcefe9270e2f36485dc8
SSDEEP 393216:Ya9Iny9G03rWxzefF6wDwdnKfTyxbxypd:Ya9Iny9GwrW8tx0dKbei
TLSH
T194574A257A5A996CC05BC074838B8A735A7130DB0B35B9FF549492782F7EAF42F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autoexec.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\autoexec.lnk
Size 1KB
SHA256 006d6168d27c62c347d1b5c3c493f9d9f47d4f24998cd1ed4e6af55386d2a745
MD5 a2f6abf50bc9a739d90905aa42153343
SHA1 4bb0b291fd763628bc10770ed2ca015bae3d2380
SHA512 d898517c1e201b2b32c2765aa4486bea8190275f12cefa2a93eb44658d693507ecc81f7e27450507e3b392c2f9640d63d3d341d5b1b20677d62ff68d8b172a3e
TLSH
T17B311F1D5ED51720CBB988B617AF2306E76324527BAA4D2606448A4E1A22542BE58F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Potassium.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\bin\Potassium.dll
Size 9.7MB
SHA256 f6a741268c398529758f68e8aebd5671bc2646f62fcb293c8a0a273575a042b2
MD5 c3162b9339b44183865f63beabe82084
SHA1 040ba52c8ea587b7b5d50883b6668d876b48308d
SHA512 0758acd97e5b0e23a2dc7cc37fa8d979568b8128895c1eb78a944d2ccb1bbaf8272269d4e8c6898c0a58d88184adc9f3eadf88a59adfedbb9d9c8d2973b5f027
SSDEEP 49152:vpi9olwtOJUZrHJEWu1JOLSimiVPsWpB9ntU7KpfdjZo4e9iQMtoMLe98KwfemwX:OrHWWl/H23dDaQqP0OKbROpeal
TLSH
T158A68E6651F405E8C3BFC079E64A9E13FA71780D4320B6EB8DA54B521BA3BE0677E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scripts.lnk

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\scripts.lnk
Size 1KB
SHA256 00ee5ac203f530c285231a8d1055764ae6bc6056812b2ff6b2b400c13eedb4e1
MD5 368718555cd69e85c33ab66442815cdb
SHA1 8e2eda2fe3c0a6c853cd471e17a271883f87c42f
SHA512 3e235efa55411fcb8aee573ea8a81298302ebb0003ba20a42e81cf2cb79d7969cd684e009ca2d4e03610225705c9f28e70933dc33c2be16a2683e2d92a536359
TLSH
T18131325D9DC80F31C5F58C7757AF2706DB6054627F9E9D260E94828D1E22A02EC54F1E
MD5 SHA1 SHA512 TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\potassium_update_4356\unpacked\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d0e41d7-91a8-45cd-bb8f-6d24e414546c.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\1d0e41d7-91a8-45cd-bb8f-6d24e414546c.tmp
Size 16KB
SHA256 78c08d98fee0b9b4275e323edd9a437b1d4a2a99b982e4e98aa0267c518fbe89
MD5 71534898f39666f798782bcfcdf61fcc
SHA1 7eade2333e70fde4aed98487c50e63f3e95994e5
SHA512 b78ad18052633a37d5dd728f71e5616e9a2b20511e9746c18bef237fa2a2b7c7a27805d4a689311ceb648930c77415f6306b9c234815c48069f32ae689554481
SSDEEP 384:pD+OBqImmJvGBLx3NaFMJFR3NBSv/PUZRrg6rO:pacvGtlNRYUnxK
TLSH
T10E72AD3B2C796E332CF78909BB8A774B8B61A253C0C57BD4D9EC9F1E026B5441351D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45c11010-f9ff-4527-912a-86c9a03f7928.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\45c11010-f9ff-4527-912a-86c9a03f7928.tmp
Size 2KB
SHA256 7c3f15596b64c08ca5f2dc4d505121383e06307abe14688e402b38d59e95da9e
MD5 d23d3686350454449d97e06d3c2bf753
SHA1 9d64f03007bc3854894af5a5264b6b93f4d96239
SHA512 5b17be16cf3ef422ea492ee46ea426585f1cc8495783ad2b9a518819f8bdb2b39c02958a05d29609fcbd8a9cfdc85bacc70bf25924bba14bc123d97a98d0fcee
TLSH
T1C1516333AD246E7B8AF25608BB0B7F138F36A162A6932F11D5DD0F2802D75181752C37
MD5 SHA1 SHA512 TLSH

Submit Download

9e3b0d33-61d1-4064-8ca6-b79aa546c8b1.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\9e3b0d33-61d1-4064-8ca6-b79aa546c8b1.tmp
Size 4KB
SHA256 e786f84761604b43da6a31c63da7fbcc5df22b582b6f9b7f10e579ecf92c0b4e
MD5 039026df8eb654a0241daa0e66e6d984
SHA1 4251196c6c12606bdf48ed252eed3e9befce47fd
SHA512 9e0c075476d794d57da209fb4ee2b39660cfb2b68bb59bba3ae6910e1debede64c149c1787255cae63b4926c82fee7d74045269644189356b216a055485c4ac0
SSDEEP 96:pGxB3NkGSC9hfHttd8kh/cI9URoDotoN5glB+gz6rewZK2ZZTKJ1a:pO3NBSQVtBeoDUa++gil1
TLSH
T113818337A974A97B8EF2D505BA463F07A775A023A5C67F95C6EC0F1C02D72891382C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8734cdfe8f8c9019176a42141e0292c3aa9fc7bb6edf6c5776f28226a337fbb8
MD5 0968d47c5db7123fbc9eed55c28b5e66
SHA1 ef4b73f65893c5b47abbee65ff1647d19bd3e798
SHA512 b2d9b9cc2fc4d170f9e9630f5f472229f4721c7987482e753b030f2d896f9172ee4bfa2c75e0e715da358b30fcad5f5a03be80aa11035bd70f4514a759e62271
TLSH
T143D0243337010534C01035334003734D1400C51F4047D10D5C3CDFDD1F14C500D13445
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0d30c38e7da8eaefc7c6ec3aa4e3f336205723355069713a162bef35a14fda1c
MD5 11b01294319550d016ee12ffddf51241
SHA1 3a3cbc80b1a2e95a060bef5d33ad29a9b6eb2740
SHA512 63659226f24ec48b5af83b299f501a5efa5fdf6485c34dda3a6f6e1e7299c6f9a7839f3b7972c443234d9e9cdcdc374b158239bb930760ef0be3abb772468b00
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6e4e08d769e3520a63c644e6a4034e060bc1b4ade68fdf96945038cadf68b8ea
MD5 d9464f67c2606901e7fa1ab1fd2eef1a
SHA1 3d1cb0a429747ce6bda0df7698f77638095f2b61
SHA512 c34ccb9755a32b3d248c9812d6a4e7c9f1fde64844d54e48024862e56dbb4b532af2d975617305235bf7830c6a1863f7c4afebe5e21b6c62a70fc0bf8cae3c61
TLSH
T19BD012233A010134C0102632400172491500C41F414792095828CEAD1E148504952445
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2704f3cf-b024-467e-bbab-99838854fa91.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\2704f3cf-b024-467e-bbab-99838854fa91.tmp
Size 6KB
SHA256 f5c3e120422f4faee543b4d4c7681cb95bb4cabd4f583771790fd267a369b3e9
MD5 16ecc65881bed1e059284fd2fa728dc4
SHA1 9322c7a8b26987a1673e3f00d4c0136ef2d32bde
SHA512 a35b0ea024bade2f5acd1fe76ae80513062c6d4526a83e9e566bc297a16e2a7478dcfb1549c4317518d135e7f896dc6b7f4a25d2247ce5439d9da755175f9643
SSDEEP 96:stw/db/++DbD/k+YTdo5h16Z0+s7/x+6MhmuecJ0B1MkkjeJK+gL1V28XM1C7K:stkNxoon+sV+Fd0jwjL9G6K
TLSH
T141D183066E24B97B4CC6E519BB25BA13E3F9502234D62E48E7FC4A2C05DB6CC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 e416092400b60873500e7ec42b180ec3a29b8396b06a8579fa3a5426108aa20a
MD5 85ed344532dc9d17cfe6db5e2b4f8e3d
SHA1 ad8259a8bfe60e4a28e6a4fe6bd147256d1dc990
SHA512 0e522443b78d00c238988588d13c073d0ad209a02822c25e27d87f15625c5204e8b8855682236abbb1e30759710b2a6f9fe50474a38ae5e653de7b7576329d87
SSDEEP 3:LstlNllkll/lzt:LsX3lEtzt
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 81b4b185f27d3c02fb05110ea19b3aae3592ac2539789c1f09f6d4a95f75d0af
MD5 e44d61e12255143678a7f163fbbee5c4
SHA1 2ead6805ce8e940dd8a7a5a4c9621fa98df626ab
SHA512 7e3f002ca20f82f1f2843c409b32eb666d750637a9bf187fecac655293022fb4a782905248c6e476fba859985f1a612c63424957df31a650516d214b736ad1d2
TLSH
T14CB001964868FAE6D64806799AC624B6B5714C18256A6FA29690CDA894BB6808215044
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 be797779747c6d7f566e1ff4b7c3f32a4b0c646dce1fc702d9a50092e7243723
MD5 8d1c1114b14136b8f212babd0161e5a8
SHA1 24891060d2bbca315777e7f30e8dae0349d71add
SHA512 42da12256e6a6e94202b40e8f93fe50948ffe1f8f3da636d76425850735bfdb742d26fc6ffbb8b3ab171aa1f2b8f77bd4ecdf6ea9dacc48f19ec44d76c4b3d49
TLSH
T191C092A84A9DDA59D3A0257043CB30A0753104C025277FBA4293C87960A7F8152D0489
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6344ee9f1db6edc6a8c97402598476a1ea6c0df5ede56a7a5db8aed4db6b73a0
MD5 88b28976643f211c2986f26340d41db7
SHA1 19b662af5432750468c9aa2e33d68de4b8e2d1e5
SHA512 a01f54eaaae27086dad6a5c398a201471f8f85f3785e3da0af158115ac566ded0cd11ce512499a619f738b8bac2c29ca101d99c26564f06c34498d275f71884e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\History
Size 164KB
SHA256 a72e9c75fd793581de0ddfefa91df0f4b418e08aeb09ca0cc5cdd6d27a26a2a0
MD5 356c51d5acf792e76e5adbdd08b321b1
SHA1 8543d4a78331c507ad1947945dd7625e9f48d5de
SHA512 464da61af171a0f5da5be8c0dd070086c7bded4a76a461b2116a09b6d87c0f475cd9d5311f041c1b3302dc0b18b5c0869522691b2a03d43c2b1f0fe387a4cc1e
SSDEEP 96:8Bf+25LqL/uejzH+bF+UIYysX0fxQp97zXEHt/DfLVVVN6zRk/E02EV:8B35qL/tH+bF+UI3iWGVzXWNVVV630V
TLSH
T13AF30B5E5F243312CDBD923769E745B3597CF03F872366866C6208B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 0d57392b0f14fe5a0dee98684d71d12242958ec308880e8554e2d0224044c0dd
MD5 b753519c76008c8052807fd8cb62775a
SHA1 975435ab2d19159579c2cc4b05f28c6ffa784824
SHA512 4d65b5942f481df23e31f8dbd07736591ffc515242525a062daa83bc7efbc6f3ab62b0a9fa02de4c7155b23e92671cc7f05665ea4e2878e39eb193a456c6e8b7
TLSH
T10FC01275506DA576107845A11BC46DC5AE37B63401C294F895E2467C61E416651034D2
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea14c4dd-5ffd-40aa-863a-f6c2ebd6a17a.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Network\ea14c4dd-5ffd-40aa-863a-f6c2ebd6a17a.tmp
Size 188B
SHA256 ceb92bcf4bd44d4a797e02a0eb3497926a0fc36216b5ac0b859e465266b50a44
MD5 74133e2b875d696c008dffba58b8921a
SHA1 77ed618d0b7a0733cb37564cd9511641caba7161
SHA512 965334492a03080e848b907714161f968c7e05bed660499cdfee46e9a5f916354a730d1b94ffd17de108f2aa61b1228074162aba2c8696f6641079c9b3fc8b49
TLSH
T177C01265407EE9F620780A721984AE46AF3BF134214254EC9AA2466D609057A5353552
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Preferences
Size 6KB
SHA256 e7e2ab032473ee60a58148db1a5038f772ac1313e4f5741e5f7e9f537caef01b
MD5 f05bbcb2d87f75eb7021c06e086a9e34
SHA1 e63f6adfaa6f956abbf5a3dc94fc3dcec3670ff3
SHA512 00eae004a3dd97ef7ce7014d7e4080af45935a29c2728dd645638f6fbc53d0ad490b0eee32253e9a4415e51eaf23d8f446e2dd3845069641d638e8730a79fcff
SSDEEP 96:rw/db/++jb9/k+YTdo5h16Z0iAs7/x+6MhmuecJF11ejeJK+gLkMI8XM1C7K:rkNDoonXsV+FdF1QjL5g6K
TLSH
T191D195065E24A97B4CC6E508BB35BB13E3F9502270D52E58EBFC4A2C05DA6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 fcda6d90f26cd15989fd4d3f4b3d73d68beb7a5c2f2e5dafba86baf80ffb48cf
MD5 07cb3d84e4c5e808eba96424f2717048
SHA1 c28a6bd7b5644da1525d0aa6ca771ea5ea0ad6a1
SHA512 617361079ec34163dc76dd9fc78b55ea2b63a896763d98be2301f0bfa8507b7dc1a40ff68389a3e5ad42f0442c25a411e97aabf45644657d2395813fa1a97d8e
SSDEEP 96:vbiJPlf/ROo1pkF5d1biM7VaTEv9V5h5pg5+e0yNGPr1FFOALcLm/tqZ:ORvvg9lXrs0chZ
TLSH
T1E6C1D6A74A6CC5B8AF445BEBE93D3ECA99A6009F89C54C09D2D6C44807C1FFC21DA895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 90e6deb75bf9c0804a61c83d504ebe1e7d52e6d222c977bde9e43dc9b3fe33e1
MD5 82839afe53b7fbe69d228e8a30e9e461
SHA1 9c832e37ae00f4f39546011d46e019a3a8f618f3
SHA512 5189435ce2e1862bcbb75e5fa9ab2d6b990741e82c34697cc0b5733c94d21fccd9fc06b39385d58f0c9296667845488b8c723196b8953a6090b82f3d90681824
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 e1394654090ec451095067d114cc5662a15a8e3e1f002039528db13488d52e65
MD5 04a15448e7203ed48e1e8cb8843f7da5
SHA1 f5acc2b2e5161a292837d0616bef704984071b91
SHA512 0b1cdd22ac853f349e1c2368e8cf06a47bc78a771db6ccbd6012b6fcdea5d51e8773fd76af59461d1fbf3bb6cbd635bef0efc6c334be01a340bc1c5c0e149535
TLSH
T16CB012C47B059137C1E81E3D43C4C7B0E721E2037A4058034C448F610EA77E42E448D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Site Characteristics Database\LOG
Size 325B
SHA256 bbf8dbc1816160ce872eea19a96d3ce4ca4347ab5266e422c763e63073739eb5
MD5 301ace977c816369301467a159cfe070
SHA1 7b0b005c2cb6eac124b4ab4966f31358f6dfd83a
SHA512 e81b728ac618c39ed90dd6f1e329c6018c5f8872e9503354eb24166e28ac45eedcda624fb9f6d94fd965de586aa52e80edbc121bd58dc25ba42fcf694237d479
TLSH
T162E0202034CD8B2712C714DF17B9B70CC6256410F7CD19590F68F3C0118B48CB541341
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\LOG
Size 301B
SHA256 a7cc24f481362b098df30b25b834758ee7202ccb728af3d782c83910c76b466e
MD5 09a68e24c468b9c6c27009bb1c5b96d1
SHA1 c665065925b6d846e5751b740cee6860bb4ba3e9
SHA512 ddf4cd3ddb27cec5c554f7f4b0c75d727f891002045b6edf650d5b4559c075af7183d8e33f7eb25cff2a6c849ed9e1750465d353d02d857011c9fb161ef56750
TLSH
T1D9E07D7178CC833205C688D703FC7B1EC6B89C5063CA3A4E0F18E284288708CFAA0381
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Default\Visited Links
Size 128KB
SHA256 21e2eedb725f0040975115892c8b45e0e310384e1900292c2d7da5638aa99fc1
MD5 614a3653a144cbf482980ce758cae576
SHA1 f0e3d69cb1987fa9c8cc91e0970c70b7367804e0
SHA512 092950430cdeb3d5f196c295438fd8b04ec215c4163935882f05e55941eb824842997e55eb537fe55864a3154abc7974a97e562a9eb5c8a88938f861fdac2330
SSDEEP 3:ImtVuO3McwLltzoC:IiVuO8cid
TLSH
T1C4D30455C105F411C0551C30C7104545C130C51001730C11C33D0413444010343C3FCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Local State
Size 1KB
SHA256 232817f70b80453c825dad5d02b3f9fe0f0d0018814dbece864af6f69943d2b4
MD5 aed69960a3b53902b56397eab377e857
SHA1 03d91ae1950df22ed2bab4f115d8efb71de413d5
SHA512 6aace852fe39a4973904645e6eb4335f8c335378a5e1bb6159b6d2b743734ebd084c2db2daba885d8a15e2ecf47fcce382ac4e882bec516a4ffd7d22dee5a486
TLSH
T18C2142B3E9701F76EEA026456207BF575F31A06791828F0190CE4E2C03E250C9776C33
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ShaderCache\index
Size 256KB
SHA256 53a98ddbe3fb263476b22564d30946385efe8e1cbb28531a83c5956b0c72ec5f
MD5 16c68ebc1dc9dcb16162ffc91da15ee0
SHA1 3e7216bbf00fbf40dbdbc5be242596109c90f73a
SHA512 74a4273814d0997ce552e67acdebdf8c34aaa410b46fcd0229cfeca10a05e5f4ac45a37b82c1b17d079e1d498432b9164de1ac08e6b2263fb032865b0b773b37
SSDEEP 3:LsOllllklkXl4ulX:LsUlPN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ae1ed552-5e01-4d15-8858-8d72e74560f9.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\ae1ed552-5e01-4d15-8858-8d72e74560f9.tmp
Size 4KB
SHA256 0cb177e02fa06e266c2f4ca198b59d3f8c404c1dcbaaee97d55ef54ac6f7e3e5
MD5 328ea4289c69d2741679e916ff16979c
SHA1 b61794def55b9ff6ee9573f103f67aa7064a2692
SHA512 ad43dcd23375d92b8b9ac9fdb557d4d36bc11c2c506a9ee8246d66b1ec984f99982fd4037179db67bbbc8d55ae8de6eb9e9abf259f5df4597e626480c215af03
SSDEEP 96:pGxB3NkGSC9hfHttd8kh/cI9URLl8DotoN5gwwB+gz6rewZK2ZZi8J1a:pO3NBSQVtBeiDUac+giED
TLSH
T1F5819437A974A93B8DF2D505BA463F07A7B5A023A5C67F95C6EC0F1C02D72891382C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1f4c595-c363-4f44-8351-2b29a1d90cad.tmp

Path C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\e1f4c595-c363-4f44-8351-2b29a1d90cad.tmp
Size 3KB
SHA256 a21a0db0a4c9ab6f7e232fa05a009f38e8691f99622e3177f4e2325eed5fd0c3
MD5 d4ee1346e2a1683c73a92d38a906b6ca
SHA1 ba6c039bc2dcb98a8a6df0bc673ec67d9772382b
SHA512 79e181a29f042b27dbaf2013d5b1f55056b350b61f23852bf7670c0d89837dc1033b17f862df30cea94b95d6fea86f6de00807961f2d49e8d71df03a39cdaeb6
TLSH
T116618437AD74AD7B8EF29A05BA4B3B06AB659023E5C27F55C5EC0F1C02D72881391C27
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_643276208\manifest.fingerprint
Size 66B
SHA256 9136f7c8a30419dc70fbe015784d1e8590a197ba88b564ca26b5a1e918e1b850
MD5 b740181eff7f7b568c83ad9d00213b13
SHA1 b3dcc9b0dc397aca84ca76c9fce3d0b37c7e37f8
SHA512 1d5c62a473a4e07c9e3d3d3900992eb6bf504b014763f7c9b7b0ce7e4b05648a9d69bb30a94b139eee88116767ed8d713f42ac49b8bfb4fcb9a1ffeff516397c
TLSH
T1F2A022C082A000F8C8080002C008008ACA00C00208003F00F080F200030CEA008FB800
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-AA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Filtering Rules-AA
Size 2.3MB
SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
MD5 b91a6cf79bedefedcb5603d3477cc3ed
SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
TLSH
T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-CA

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Filtering Rules-CA
Size 11KB
SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
MD5 40b3ba01a09be340fdf879f97b31c867
SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
TLSH
T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ES

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-ES
Size 137KB
SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
MD5 6e8f660d075254a08948dc3517304256
SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
TLSH
T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-FR

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-FR
Size 528KB
SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
MD5 6804859c589fa0ce46529c3a53b882d6
SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
TLSH
T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-IT

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-IT
Size 216KB
SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
MD5 268f6a3c0990d434175268cf09cfa6ad
SHA1 464e10c57c536e6bb55a326a48469246a9241505
SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
TLSH
T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-NL

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-NL
Size 79KB
SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
MD5 65126d1e76de4f0872e6cfa96609beba
SHA1 95268d3b2134894040afd0530d062a3b836f63c7
SHA512 0c6dd17cf622ad1a1a4ddc43fdc6f36567a98309e145e16d95edf38e9b21905867b28865bee591b52eecaa371138ac436eee6d18ff8d78f4c8f7031ba4e7ad84
SSDEEP 1536:x3ACbKFpRTfKGy7Dpj+u9huKCe/MELfmoRyQpnokj:x3ACbYpxfKGy7Dpj++hu8/L7moRyQpnv
TLSH
T14A83D70AAD68F8754A331D2FA4990D1C9625B600C7CAFDC4E725908EC9F52DF2AD07ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-RU

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-RU
Size 1.2MB
SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
MD5 e946014ae78f059f0698731a745a3f00
SHA1 afeb8dc2d86d2763b69f97717e454a7c6b8a267a
SHA512 3c699d3205c3a000c13d20411a0e958f2107f62d813591652cfc573f9a29647badfb1703e499a8896644f1485ecc19cdcaca0c6bd5ec1e5e328339c95784cfa3
SSDEEP 12288:4o9g8Q9u1Xku8Uc24wpDs2zGFtyKnVgLxB7rsvAyLuQCdj9/CwYJWj0Ek0ozM/vQ:4Oe9u1Xn1KFtyKnKq1CvH0Ra3Rnkd
TLSH
T1F44560137254F9F04F734E7E549A9C089275B1A083D7EDC5CA29C19C98F2A9FFA402B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ZH

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\Part-ZH
Size 686KB
SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
MD5 3e8cbee42dcb97db0df88cb96643e3fc
SHA1 94cd9e2bc876e04bfd2f311cdc160b6ae1d3c9f3
SHA512 319c69fcba623a0fea9ba4e1dcfabe3e9bd47f31dce7146e317835331217730fb61d0449abe7e66b1bc6f06a50c12269f7f09dbb633c85b4fd8dcc7b21c95304
SSDEEP 12288:g3gaBN1zyZzxT04duSeYXzhW+svzgAfk+XTAdXUd84nT4x09/xSE8Y:CgaBN1zyZzxT0N9YVW+sv8Afk+XTAdXy
TLSH
T114E491132168FCF51EB21E7D284B6D48813A76A047E3ECC6D62BD54ED6F025F39A01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1392_720878707\manifest.fingerprint
Size 66B
SHA256 b1c8d3a1e8d3d85433eaa60a50001e5d1599809fb03a7b31bc19f963058a0d54
MD5 58d2918fbd8bfa6cecc58ecb48dd0723
SHA1 1c6f36fa1434000e97d6f32f32edf02772bb40ad
SHA512 31a3a6d71ec58392f3330df1cb23088c437d72c8709da71598fd626af76b45f26091daa1ae3d49ef15929b6b518a3fac0a911d09cf79ef67bc823d52db4580a5
TLSH
T18FA0220C20C82AA088BE0A0302082803832000A0AC383380A30CA3C8BC0C80820C00FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2528-113-0x00007FFB7D4F0000-0x00007FFB7D4F1000-memory.dmp

Download

memory/2992-656-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-654-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-660-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-665-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-664-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-662-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-661-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/2992-663-0x000001BABE920000-0x000001BABE921000-memory.dmp

Download

memory/5332-644-0x000001A695980000-0x000001A6959AF000-memory.dmp

Download

memory/5972-110-0x00007FFB7D4F0000-0x00007FFB7D4F1000-memory.dmp

Download

memory/6040-543-0x00007FFB7E400000-0x00007FFB7E401000-memory.dmp

Download

memory/6040-542-0x00007FFB7D830000-0x00007FFB7D831000-memory.dmp

Download

memory/6040-602-0x0000022330360000-0x000002233038F000-memory.dmp

Download