f4da69df1e93b28faeb02007cd089d873bc1b6244ecb343ed20b60a735b833ba

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potassium-Portable/Start.bat
Size 7KB
Sample261113-mx91msax4m
SHA256 f4da69df1e93b28faeb02007cd089d873bc1b6244ecb343ed20b60a735b833ba
MD5 cf5bdfae491b0188185ef20da66acd04
SHA1 2a8d47fc04f07a06231ebaac434f098903864db8
SHA512 6ec69f1dd5139275fa949c8536baa4a434a38b808db4d58d80960de5a71759adcce81eec33e437734df1f97b0a3bb5efdd5d1ce66ddc46715a94581ba7773be0
SSDEEP 192:g4fCZYIeaI9gPuzNO4mESiebLTw1y0TzsWfPiyZeOM6:s3tIGPuzwDiiMBTzsWPZep6
TLSH
T164F1C5161E88433A82F9CB76918C1296E31DC0AF23157ACD307EE15A3F6919E87FD1D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5008	powershell.exe
2952	powershell.exe
5064	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
3032	Potassium.exe
1832	Decompiler.exe
2044	Decompiler.exe
1428	Decompiler.exe
4256	Decompiler.exe
4888	Decompiler.exe
4164	Decompiler.exe
392	Decompiler.exe
2004	Decompiler.exe
4764	Decompiler.exe
4116	Decompiler.exe

Loads dropped DLL 18 IoCs

pid	Process
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
316	authsrv.exe
3032	Potassium.exe
3032	Potassium.exe
3032	Potassium.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Potassium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2988	tasklist.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\male_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\test.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\ranked_dicts	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\model.markov	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\surnames.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\female_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\passwords.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2904	powershell.exe
3572	powershell.exe
2520	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe
4568	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Potassium.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Potassium.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4192	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3948	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2904	powershell.exe
2904	powershell.exe
5008	powershell.exe
5008	powershell.exe
5064	powershell.exe
5064	powershell.exe
3572	powershell.exe
3572	powershell.exe
3572	powershell.exe
3572	powershell.exe
3572	powershell.exe
2952	powershell.exe
2952	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
3032	Potassium.exe
3032	Potassium.exe
3032	Potassium.exe
3032	Potassium.exe
1864	msedgewebview2.exe
1864	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2884	msedgewebview2.exe
4328	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeIncreaseQuotaPrivilege	3572	powershell.exe
Token: SeSecurityPrivilege	3572	powershell.exe
Token: SeTakeOwnershipPrivilege	3572	powershell.exe
Token: SeLoadDriverPrivilege	3572	powershell.exe
Token: SeSystemProfilePrivilege	3572	powershell.exe
Token: SeSystemtimePrivilege	3572	powershell.exe
Token: SeProfSingleProcessPrivilege	3572	powershell.exe
Token: SeIncBasePriorityPrivilege	3572	powershell.exe
Token: SeCreatePagefilePrivilege	3572	powershell.exe
Token: SeBackupPrivilege	3572	powershell.exe
Token: SeRestorePrivilege	3572	powershell.exe
Token: SeShutdownPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeSystemEnvironmentPrivilege	3572	powershell.exe
Token: SeRemoteShutdownPrivilege	3572	powershell.exe
Token: SeUndockPrivilege	3572	powershell.exe
Token: SeManageVolumePrivilege	3572	powershell.exe
Token: 33	3572	powershell.exe
Token: 34	3572	powershell.exe
Token: 35	3572	powershell.exe
Token: 36	3572	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2988	tasklist.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeIncreaseQuotaPrivilege	2520	powershell.exe
Token: SeSecurityPrivilege	2520	powershell.exe
Token: SeTakeOwnershipPrivilege	2520	powershell.exe
Token: SeLoadDriverPrivilege	2520	powershell.exe
Token: SeSystemProfilePrivilege	2520	powershell.exe
Token: SeSystemtimePrivilege	2520	powershell.exe
Token: SeProfSingleProcessPrivilege	2520	powershell.exe
Token: SeIncBasePriorityPrivilege	2520	powershell.exe
Token: SeCreatePagefilePrivilege	2520	powershell.exe
Token: SeBackupPrivilege	2520	powershell.exe
Token: SeRestorePrivilege	2520	powershell.exe
Token: SeShutdownPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeSystemEnvironmentPrivilege	2520	powershell.exe
Token: SeRemoteShutdownPrivilege	2520	powershell.exe
Token: SeUndockPrivilege	2520	powershell.exe
Token: SeManageVolumePrivilege	2520	powershell.exe
Token: 33	2520	powershell.exe
Token: 34	2520	powershell.exe
Token: 35	2520	powershell.exe
Token: 36	2520	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4744	Potassium.exe
3032	Potassium.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3012	4832	cmd.exe	83
PID 3012 wrote to memory of 3204	3012	net.exe	84
PID 4832 wrote to memory of 3500	4832	cmd.exe	85
PID 4832 wrote to memory of 2904	4832	cmd.exe	86
PID 4832 wrote to memory of 5008	4832	cmd.exe	87
PID 4832 wrote to memory of 4348	4832	cmd.exe	88
PID 4832 wrote to memory of 3948	4832	cmd.exe	89
PID 4832 wrote to memory of 4192	4832	cmd.exe	93
PID 4832 wrote to memory of 5064	4832	cmd.exe	94
PID 5064 wrote to memory of 1104	5064	powershell.exe	95
PID 4832 wrote to memory of 3572	4832	cmd.exe	96
PID 1104 wrote to memory of 316	1104	authsrv.exe	97
PID 4832 wrote to memory of 2952	4832	cmd.exe	99
PID 4832 wrote to memory of 4744	4832	cmd.exe	100
PID 4744 wrote to memory of 2884	4744	Potassium.exe	101
PID 2884 wrote to memory of 4064	2884	msedgewebview2.exe	102
PID 2884 wrote to memory of 5036	2884	msedgewebview2.exe	104
PID 2884 wrote to memory of 5036	2884	msedgewebview2.exe	104
PID 2884 wrote to memory of 5036	2884	msedgewebview2.exe	104
PID 2884 wrote to memory of 700	2884	msedgewebview2.exe	105
PID 2884 wrote to memory of 4800	2884	msedgewebview2.exe	106
PID 2884 wrote to memory of 4800	2884	msedgewebview2.exe	106
PID 2884 wrote to memory of 3452	2884	msedgewebview2.exe	107
PID 2884 wrote to memory of 3452	2884	msedgewebview2.exe	107
PID 2884 wrote to memory of 3452	2884	msedgewebview2.exe	107
PID 4744 wrote to memory of 4568	4744	Potassium.exe	110
PID 4568 wrote to memory of 2988	4568	cmd.exe	112
PID 4568 wrote to memory of 3548	4568	cmd.exe	113
PID 4832 wrote to memory of 2520	4832	cmd.exe	114
PID 4568 wrote to memory of 212	4568	cmd.exe	115
PID 4568 wrote to memory of 3032	4568	cmd.exe	116
PID 3032 wrote to memory of 4328	3032	Potassium.exe	117
PID 4328 wrote to memory of 3348	4328	msedgewebview2.exe	118
PID 4328 wrote to memory of 4388	4328	msedgewebview2.exe	119
PID 4328 wrote to memory of 4388	4328	msedgewebview2.exe	119
PID 4328 wrote to memory of 4388	4328	msedgewebview2.exe	119
PID 4328 wrote to memory of 3164	4328	msedgewebview2.exe	120
PID 4328 wrote to memory of 3868	4328	msedgewebview2.exe	121
PID 4328 wrote to memory of 3868	4328	msedgewebview2.exe	121
PID 4328 wrote to memory of 3824	4328	msedgewebview2.exe	122
PID 4328 wrote to memory of 3824	4328	msedgewebview2.exe	122
PID 4328 wrote to memory of 3824	4328	msedgewebview2.exe	122
PID 3032 wrote to memory of 1832	3032	Potassium.exe	127
PID 3032 wrote to memory of 2044	3032	Potassium.exe	132
PID 3032 wrote to memory of 1428	3032	Potassium.exe	136
PID 3032 wrote to memory of 4256	3032	Potassium.exe	140
PID 3032 wrote to memory of 4888	3032	Potassium.exe	144
PID 3032 wrote to memory of 4164	3032	Potassium.exe	148
PID 3032 wrote to memory of 392	3032	Potassium.exe	153
PID 4328 wrote to memory of 3280	4328	msedgewebview2.exe	157
PID 4328 wrote to memory of 3280	4328	msedgewebview2.exe	157
PID 3032 wrote to memory of 2004	3032	Potassium.exe	158
PID 3032 wrote to memory of 4764	3032	Potassium.exe	162
PID 4328 wrote to memory of 2464	4328	msedgewebview2.exe	166
PID 4328 wrote to memory of 2464	4328	msedgewebview2.exe	166
PID 3032 wrote to memory of 4116	3032	Potassium.exe	167
PID 4328 wrote to memory of 1864	4328	msedgewebview2.exe	171

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\Start.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3204
- C:\Windows\system32\findstr.exe
  findstr /i /r /c:"^127\.0\.0\.1 *auth-3430394859384.potassium.pro" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$p=Join-Path $env:SystemRoot 'System32\drivers\etc\hosts'; $l=@(Get-Content -LiteralPath $p -ErrorAction SilentlyContinue | Where-Object { $_ -notmatch [regex]::Escape($env:AUTHDOMAIN) }); $l += ('127.0.0.1 ' + $env:AUTHDOMAIN); [IO.File]::WriteAllLines($p, $l, [Text.Encoding]::ASCII)"
  2⤵
  - Drops file in Drivers directory
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "if (Test-Path ('Cert:\LocalMachine\Root\' + $env:CERTTHUMB)) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\system32\certutil.exe
  certutil -addstore -f Root "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\auth\ca.crt"
  2⤵
  PID:4348
- C:\Windows\system32\taskkill.exe
  taskkill /f /im authsrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath (Join-Path $env:AUTHDIR 'authsrv.exe') -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\auth\authsrv.exe
    "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\auth\authsrv.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\auth\authsrv.exe
      "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\auth\authsrv.exe"
      4⤵
      Loads dropped DLL
      PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$end=(Get-Date).AddSeconds(20); do { $l=Get-NetTCPConnection -State Listen -LocalPort 443 -LocalAddress 127.0.0.1 -ErrorAction SilentlyContinue | Select-Object -First 1; if ($l) { $p=Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue; if ($p -and $p.ProcessName -eq 'authsrv') { exit 0 } }; Start-Sleep -Milliseconds 400 } while ((Get-Date) -lt $end); exit 1"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$name=if($env:POTASSIUM_NAME_B64){$s=$env:POTASSIUM_NAME_B64;$r=$s.Length -band 3;if($r -eq 2){$s+='=='}elseif($r -eq 3){$s+='='};[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($s))}else{$env:POTASSIUM_NAME};$q=[char]34;$enc={param($s)[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($s)).TrimEnd('=').Replace('+','-').Replace('/','_')};$id=[guid]::NewGuid().ToString('N').Substring(0,24);$now=[DateTimeOffset]::UtcNow.ToUnixTimeSeconds();$hdr='{'+$q+'alg'+$q+':'+$q+'HS256'+$q+','+$q+'typ'+$q+':'+$q+'JWT'+$q+'}';$pl='{'+$q+'id'+$q+':'+$q+$id+$q+','+$q+'iat'+$q+':'+$now+','+$q+'exp'+$q+':4102444800}';$jwt=(& $enc $hdr)+'.'+(& $enc $pl)+'.'+(& $enc ([guid]::NewGuid().ToString('N')+[guid]::NewGuid().ToString('N')));$obj=[ordered]@{jwt=$jwt;username=$name};$json=ConvertTo-Json -InputObject $obj -Compress;[IO.File]::WriteAllText($env:POTASSIUM_SESSION,$json)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe
  "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4744.1888.17147826363569830674
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbcaa9b078,0x7ffbcaa9b084,0x7ffbcaa9b090
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,13166246979879826705,15976107146001350049,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,13166246979879826705,15976107146001350049,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,13166246979879826705,15976107146001350049,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,13166246979879826705,15976107146001350049,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3452
- - C:\Windows\system32\cmd.exe
    "cmd" /c C:\Users\Admin\AppData\Local\Temp\potassium_update_4744.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "PID eq 4744" /NH
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2988
  - - C:\Windows\system32\find.exe
      find "4744"
      4⤵
      PID:3548
  - - C:\Windows\system32\xcopy.exe
      xcopy /E /Y /I "C:\Users\Admin\AppData\Local\Temp\potassium_update_4744\unpacked\*" "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\"
      4⤵
      PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe
      "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\Potassium.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3032.2656.1812423565220661075
        5⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x23c,0x7ffbcaa9b078,0x7ffbcaa9b084,0x7ffbcaa9b090
        6⤵
        
        PID:3348
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1936,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
        6⤵
        
        PID:4388
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2144,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:3
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
        6⤵
        
        PID:3868
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3544,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        6⤵
        
        PID:3824
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3904,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
        6⤵
        
        PID:3280
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4608,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
        6⤵
        
        PID:2464
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.pot.potassium-tauri\EBWebView" --webview-exe-name=Potassium.exe --webview-exe-version=1.7.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4600,i,2207917992553864817,12505900946739363424,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Potassium-Portable\app\bin\Decompiler.exe"
        5⤵
        Executes dropped EXE
        
        PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$app=Join-Path $env:APPDIR 'Potassium.exe'; $r=Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.ExecutablePath -eq $app }; if ($r) { exit 1 } else { exit 0 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

female_names.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\female_names.txt
Size 26KB
SHA256 a15bb2c5f362b00b74eb4a25c538f3862cf76ba235e6ab84c32722e0d06235f8
MD5 65c6b77a97ccdb4f09402295c75cd151
SHA1 48d9de4e0c6ef8f29db7e3b69008d1e25423f333
SHA512 59608916ece278c8d6b518b9ac19f38b071acac1e8698be851a5e357b97a2e4c4dea4d122321f61e937fd2480e6041e78e97e01648098da194890895d7ea0dc4
SSDEEP 768:QLAlqUDcjeadVlvbnevUtIaBY30lzpoTTC:Jlq4Ceahn2HQqC
TLSH
T150C2EAF7EAA8097F748F890DC5893B604C58FA332C3658A59E698FDD42056D0DDA4F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

male_names.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\male_names.txt
Size 6KB
SHA256 95b2b51e4d30946e0e3873663a9e191503f4b7926eac98639c65ae06c383be0f
MD5 ed2a7be8d1007adf88defbba6a30fb18
SHA1 f00e2d8892ff2808a81f50d360edc960bd8d51ef
SHA512 1577919e4654086ae6d673ecbb5e436ca2fdcefb30bb4f839fdcb545f3b3b102bb47e78ce6c4ba451bfd9cf6099eba35c765dcbdadbac80aeac3083dc095017d
SSDEEP 192:+qi/Dd0Ms6tPdSiuDvtnNdqfkKY1kqPgxC4Hb64:+vbLu5Nc8UqPu1b64
TLSH
T14BD1E8BAD2E43975AC9F058588CF2F41994C36337F321676E6B90AC94252A805ED0D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\manifest.fingerprint
Size 66B
SHA256 6a5e20bbc41a5ac347d7b85b0e3709431710357526e4661387597225d49dbfd7
MD5 a346573314757c677ba7b22bf474c77a
SHA1 aec9bbc033bc1c11aa690a8c5ceab69324ec42e5
SHA512 8bfad9d06097a6571bf855b189d645a3f4913798fd6ff66fba00c90673f891901d03571ab57dddab2982591b60a8e6c27fc47f05a69f33da0e92ec49ef5fa43e
TLSH
T17DA022B02C230A0000C802002BF08C3308F8C2008C30232302CC38C0003C0C0F88CCC0
MD5 SHA1 SHA512 TLSH

Submit Download

model.markov

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\model.markov
Size 44KB
SHA256 8882d44cf3dff2e2ca5ec1af749460040e41b8d1f20b3da2308c4f976d321754
MD5 2bb4fc702c8b59a0b518482f60a082c1
SHA1 ffdc0a063cdd51e4913df4e4917495abf7e486c9
SHA512 f6b113084bd43a1f1844102ca860efd8bcd363de3eebc8acf23f5744d74b191fdc92a601630eb8e602e93005a63b73a9cb3bf5de115e157a2b72eab4dd891c5f
SSDEEP 768:aRuG/TuKUqwxhRH6t9O4v2uoDO+L1kO5qNlFpIpJmfaLtk+Yg6qFw11/aeMgE3Uf:aRuG/SKoLH4vC9L1kO5qLAbJkE2/aeMy
TLSH
T15923F1B3D385DE3992E317B0E67D22A74BD21AA47ACEBB23492BDC4215F1C504254DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

passwords.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\passwords.txt
Size 233KB
SHA256 8b58407da38fc0edac67ad09487ee195cc171960f4a72ab756c912f46a052468
MD5 13c1efee289d7ecc8a7e7bcc7ce47df8
SHA1 c2864b21ab8130e8cae66f1f19ac38723a7cf42b
SHA512 08df4c520a896ee26ef9b8f093b2e14b6e4af67f910f12d70270917df2d78a4666458386fc6e83258d84d24b03e517e39d7799225b41a6687278dbe9610ae537
SSDEEP 6144:EY19QF6DI5luckZEjoQKe8rbbIptoWfEYixiRG+GpAcBN:EY19QKI3HkZ1QKe8rYf3fEp0RDIAsN
TLSH
T164348EB5F6A03176E6CF464E580A3F058A9D37335D11589FE7B80788120BBD885BBE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

surnames.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\surnames.txt
Size 74KB
SHA256 9c57664a651bed87b046ed8bceebd0aad634538a917a75de0a8ecffef06ac641
MD5 64ffd4d0d29a84dbf99bddf1afe7e068
SHA1 f1c3703c60fa8ceb538a851acbeb2cc48e78243c
SHA512 d447a251bbc6b5da76b9327dca62d3a40d6e2ae5c59c35f9e7615be15e1e5eedcb7ec6d20ec48df33904851002c823501f9f3347dcd0e279f3fa86b00d050d28
SSDEEP 1536:HZQFhD0AAQnaaq6NE1f+oNh2MGfAoocKAPvY02+dhQ:5y5/LaZmoCJeoxbdK
TLSH
T169731A76E2B4383AE95F1B8D48953FC1C904D6338D10A1A5F7B906CAA047BC58DB5F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\test.txt
Size 15B
SHA256 92b772380a3f8e27a93e57e6deeca6c01da07f5aadce78bb2fbb20de10a66925
MD5 29b933a8d9a0fcef0af75f1713f4940e
SHA1 9fbc3fafddca353898269a2f4069e4653083bcdb
SHA512 9751ea443fd632e147831566ccb822482220188993cd1269edbe98d2e2d69beb5fb4b631c5001f47491dfe7550cb68035267fae518f1ff119e465b54379389fb
MD5 SHA1 SHA512

Submit Download

us_tv_and_film.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_1560671994\us_tv_and_film.txt
Size 159KB
SHA256 49185c0fb29f08237602dadd236d919e4372fb1f0f5baad2936ec6f51586bb24
MD5 206a438724efc16dc8afa5a8984f05d1
SHA1 57225b5fb5cb51333fa9d79865f2393ec4445e42
SHA512 6a653e259d4f15c88145c820d1e3062194370459da34cb2cc49fbdc681e1bf3176501129640fdc1b635ea805c03ab85c8bc5169e23ef099975fe559bf284bbab
SSDEEP 3072:CwawB3H2+8PW7D0Nr45Wn9TkOijxjTBUCbws5d0hKS4D/ODGRtenXpMFU2c92C7/:fawBXbD0NEc9yxjt3bws5d9S4D2CnKXn
TLSH
T1FEF31930DB64353ED79B2BCEC8642F52415445321E3570B9FAAE0149180BF9E8B7AE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\_metadata\verified_contents.json
Size 1KB
SHA256 a6ce8c1d0d27c54034e67a83270bf3fd2bdfcc45ffc4b9084357169c00c90f77
MD5 42b331a107b7320d16f115eb7872b3c5
SHA1 3438a81f13c76becc7eb8bf0a7881088e5ad358b
SHA512 afc9393c7a63ec8d95c708eab601ab76887e4600a03b10f3c8c6e6c78c1c48d8b8bc6f059f8f38e66f1e54c5040656b75b6d46b91a795f76dbb5d3c6ac59b333
TLSH
T12F31B7414DD5369EA14E42245AB873AB9F0E71B372C8A51DA9C5900CF4F914ACBD308F
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\_platform_specific\win_x64\widevinecdm.dll
Size 21.9MB
SHA256 e1f9ad648017e2cb0f0cd798d815dc51012b279ba32571e7b6eb5120b0ed2c05
MD5 046fdd0c07bbac0c160b03a2cea5ad4b
SHA1 fbe9107b962ff2c77070579a8769ce7188c4b473
SHA512 0a3e385a3d27883e6495e4cb4fd20bd5dd0c61176e04df2762fca9d13847c9ae88de7ac57648732ce6d6cce27f2eb9da4dbf9c54d1953504de784c4cb35c8fd2
SSDEEP 393216:DKuarWwW0LmrEr38dudevJCJU2kpq1gL2aVRHk:MWCmz0dwJIkpqCw
TLSH
T15A37E14AE35350E9E81ECDF0866E9A62E4343C4E03319BEF17D47A355A727C42A39F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\_platform_specific\win_x64\widevinecdm.dll.sig
Size 1KB
SHA256 868171d91275d1e180a452621f66428afec0a9288ab96344ce92fc904ac1f70d
MD5 c7bf17a2f118fdb4a4344196706b6393
SHA1 d07695b35bf2f4bd746586fe56ce2ae9d7c99f69
SHA512 11abb5b2ea4120df63216ac38aa85c8deaa7d96b9e0a8867b8f281b0652211f4600bd4107d182f3ea0c657d8a1675ff56d0279837a7c33410a7968f2c5a9a754
TLSH
T1742108F4A215A94A7F50C142053DE827CF3E8AC12C6188B644BFC23628EE7C00F8457C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4328_2073849582\manifest.fingerprint
Size 66B
SHA256 56d1fe98928ebd4be664fc103e35673a15c2dfa98ff241478bbd39beb15a0754
MD5 bef72178d2d9f61006676a8323ac4a20
SHA1 281541cc22aaab5d71703791192ef66ee2e831ba
SHA512 ee3664c72ee9a894249799b642ed8c1f10b7a7a422d1277d7097f43b4f892d7b267200d323f861bb90b0436262da13dd3c674c4425dfdc264c1cce3755a593a3
TLSH
T154A022CE0CC208BC30008300FC8C8B222000282823280022F8A023CA32EF30AB000C02
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download