8330cf4397db0598deecc728c9fa4fb9a05d63f9d4c7eb6009a53b2a364a6790

Analysis

max time kernel
898s
max time network
904s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data1.msi
Size 29.8MB
Sample260418-vrvb1adt8l
SHA256 8330cf4397db0598deecc728c9fa4fb9a05d63f9d4c7eb6009a53b2a364a6790
MD5 17d83522be4a236d4174a8a2d08ffc80
SHA1 601220e077ecbe5572bc2c4228d2dcfbeba93e02
SHA512 fc6887ba4e2e82c0c455646cf573c0520740f08fa10531a003e5c8593c523d97745f0760795ec45bc4fecfa9ecc4ccb25647170881d8fba46852c4a83fcc73ec
SSDEEP 786432:99ugPa7oZ1ZcKZBgQ7pWuJ0A1P59+Dtz+0jBepYj4l55Q:rdPlZyQdWu/1hB0Nxj4l5m
TLSH
T19D67336CFC66ADC7DFA9B07DD9A4A3919EA20CA6C5000B011D38F35C3D726CAD785297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
3692	powershell.exe
5348	powershell.exe
3944	powershell.exe
3808	powershell.exe
4504	powershell.exe
5588	powershell.exe
4348	powershell.exe
2548	powershell.exe
2636	powershell.exe
3740	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
1944	node.exe
5868	node.exe
5268	tor.exe
3608	node.exe
5708	tor.exe
2044	vlc.exe

Loads dropped DLL 3 IoCs

pid	Process
5868	node.exe
3608	node.exe
2044	vlc.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\HelixInspector = "conhost.exe --headless C:\\Users\\Admin\\AppData\\Local\\HelixInspector\\runtime\\node.exe C:\\Users\\Admin\\AppData\\Local\\HelixInspector\\src\\bootstrap.js"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org
19	api.ipify.org
21	api.ipify.org
1	api.ipify.org

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5E74F6EA-FB70-49DF-8DF5-F57C7AECDE83}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF03F083F2043A5C1B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2769.tmp	msiexec.exe
File created	C:\Windows\Installer\e58221b.msi	msiexec.exe
File created	C:\Windows\Installer\e582219.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e582219.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF01201D1461038744.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBB1C904C2D245378.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBC73B3ED8019195A.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2780	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611ecaf51c3c1a840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000611ecaf50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900611ecaf5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a611ecaf5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d611ecaf5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 50 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vlc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vlc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3312	msiexec.exe
3312	msiexec.exe
4504	powershell.exe
4504	powershell.exe
5588	powershell.exe
5588	powershell.exe
4348	powershell.exe
4348	powershell.exe
3692	powershell.exe
3692	powershell.exe
2548	powershell.exe
2548	powershell.exe
2548	powershell.exe
2636	powershell.exe
2636	powershell.exe
3740	powershell.exe
3740	powershell.exe
3944	powershell.exe
3944	powershell.exe
5348	powershell.exe
5348	powershell.exe
3808	powershell.exe
3808	powershell.exe
3808	powershell.exe
2044	vlc.exe
2044	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	3312	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeMachineAccountPrivilege	2780	msiexec.exe
Token: SeTcbPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeLoadDriverPrivilege	2780	msiexec.exe
Token: SeSystemProfilePrivilege	2780	msiexec.exe
Token: SeSystemtimePrivilege	2780	msiexec.exe
Token: SeProfSingleProcessPrivilege	2780	msiexec.exe
Token: SeIncBasePriorityPrivilege	2780	msiexec.exe
Token: SeCreatePagefilePrivilege	2780	msiexec.exe
Token: SeCreatePermanentPrivilege	2780	msiexec.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeDebugPrivilege	2780	msiexec.exe
Token: SeAuditPrivilege	2780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2780	msiexec.exe
Token: SeChangeNotifyPrivilege	2780	msiexec.exe
Token: SeRemoteShutdownPrivilege	2780	msiexec.exe
Token: SeUndockPrivilege	2780	msiexec.exe
Token: SeSyncAgentPrivilege	2780	msiexec.exe
Token: SeEnableDelegationPrivilege	2780	msiexec.exe
Token: SeManageVolumePrivilege	2780	msiexec.exe
Token: SeImpersonatePrivilege	2780	msiexec.exe
Token: SeCreateGlobalPrivilege	2780	msiexec.exe
Token: SeBackupPrivilege	5052	vssvc.exe
Token: SeRestorePrivilege	5052	vssvc.exe
Token: SeAuditPrivilege	5052	vssvc.exe
Token: SeBackupPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeBackupPrivilege	2416	srtasks.exe
Token: SeRestorePrivilege	2416	srtasks.exe
Token: SeSecurityPrivilege	2416	srtasks.exe
Token: SeTakeOwnershipPrivilege	2416	srtasks.exe
Token: SeBackupPrivilege	2416	srtasks.exe
Token: SeRestorePrivilege	2416	srtasks.exe
Token: SeSecurityPrivilege	2416	srtasks.exe
Token: SeTakeOwnershipPrivilege	2416	srtasks.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe
Token: SeTakeOwnershipPrivilege	3312	msiexec.exe
Token: SeRestorePrivilege	3312	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2780	msiexec.exe
2780	msiexec.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2416	3312	msiexec.exe	83
PID 3312 wrote to memory of 6052	3312	msiexec.exe	85
PID 6052 wrote to memory of 1944	6052	conhost.exe	86
PID 1944 wrote to memory of 4868	1944	node.exe	87
PID 4868 wrote to memory of 4500	4868	cmd.exe	89
PID 1944 wrote to memory of 6100	1944	node.exe	90
PID 6100 wrote to memory of 1620	6100	cmd.exe	92
PID 1944 wrote to memory of 5868	1944	node.exe	93
PID 5868 wrote to memory of 5880	5868	node.exe	94
PID 5880 wrote to memory of 5192	5880	cmd.exe	96
PID 5868 wrote to memory of 5268	5868	node.exe	98
PID 5868 wrote to memory of 1268	5868	node.exe	100
PID 1268 wrote to memory of 4504	1268	cmd.exe	102
PID 5868 wrote to memory of 1472	5868	node.exe	104
PID 1472 wrote to memory of 5588	1472	cmd.exe	106
PID 5868 wrote to memory of 4764	5868	node.exe	107
PID 4764 wrote to memory of 4348	4764	cmd.exe	109
PID 5868 wrote to memory of 2124	5868	node.exe	110
PID 2124 wrote to memory of 3692	2124	cmd.exe	112
PID 5868 wrote to memory of 2836	5868	node.exe	113
PID 2836 wrote to memory of 2548	2836	cmd.exe	115
PID 1944 wrote to memory of 3608	1944	node.exe	116
PID 3608 wrote to memory of 2920	3608	node.exe	117
PID 2920 wrote to memory of 5644	2920	cmd.exe	119
PID 3608 wrote to memory of 5708	3608	node.exe	120
PID 3608 wrote to memory of 2768	3608	node.exe	122
PID 2768 wrote to memory of 2636	2768	cmd.exe	124
PID 3608 wrote to memory of 2900	3608	node.exe	125
PID 2900 wrote to memory of 3740	2900	cmd.exe	127
PID 3608 wrote to memory of 1748	3608	node.exe	128
PID 1748 wrote to memory of 3944	1748	cmd.exe	130
PID 3608 wrote to memory of 3772	3608	node.exe	131
PID 3772 wrote to memory of 5348	3772	cmd.exe	133
PID 3608 wrote to memory of 2860	3608	node.exe	134
PID 2860 wrote to memory of 3808	2860	cmd.exe	136
PID 3608 wrote to memory of 4032	3608	node.exe	137
PID 1532 wrote to memory of 2044	1532	explorer.exe	139
PID 2044 wrote to memory of 5932	2044	vlc.exe	140
PID 2044 wrote to memory of 5932	2044	vlc.exe	140
PID 2044 wrote to memory of 5652	2044	vlc.exe	143
PID 2044 wrote to memory of 5652	2044	vlc.exe	143

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\data1.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\system32\conhost.exe
  conhost.exe --headless "C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe" "C:\Users\Admin\AppData\Local\HelixInspector\src\bootstrap.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe
    C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe C:\Users\Admin\AppData\Local\HelixInspector\src\bootstrap.js
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "HelixInspector" 2>NUL"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "HelixInspector"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "HelixInspector" /t REG_SZ /d "conhost.exe --headless "C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe" "C:\Users\Admin\AppData\Local\HelixInspector\src\bootstrap.js"" /f"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "HelixInspector" /t REG_SZ /d "conhost.exe --headless "C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe" "C:\Users\Admin\AppData\Local\HelixInspector\src\bootstrap.js"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1620
  - - C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe
      C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe C:\Users\Admin\AppData\Local\HelixInspector\src\server.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5880
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\tor\tor.exe
        
        C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\tor\tor.exe -f C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\torrc
        5⤵
        Executes dropped EXE
        
        PID:5268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" | ForEach-Object { $_.FreeSpace.ToString() + ',' + $_.Size.ToString() }""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1268
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" | ForEach-Object { $_.FreeSpace.ToString() + ',' + $_.Size.ToString() }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_OperatingSystem | ForEach-Object { $_.Caption + ',' + $_.BuildNumber }""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_OperatingSystem | ForEach-Object { $_.Caption + ',' + $_.BuildNumber }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | Select-Object -ExpandProperty displayName""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | Select-Object -ExpandProperty displayName"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process | Select-Object -ExpandProperty ProcessName""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2548
  - - C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe
      C:\Users\Admin\AppData\Local\HelixInspector\runtime\node.exe C:\Users\Admin\AppData\Local\HelixInspector\src\server.js
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2920
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\tor\tor.exe
        
        C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\tor\tor.exe -f C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\torrc
        5⤵
        Executes dropped EXE
        
        PID:5708
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" | ForEach-Object { $_.FreeSpace.ToString() + ',' + $_.Size.ToString() }""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" | ForEach-Object { $_.FreeSpace.ToString() + ',' + $_.Size.ToString() }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_OperatingSystem | ForEach-Object { $_.Caption + ',' + $_.BuildNumber }""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_OperatingSystem | ForEach-Object { $_.Caption + ',' + $_.BuildNumber }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3740
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | Select-Object -ExpandProperty displayName""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | Select-Object -ExpandProperty displayName"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5348
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Process | Select-Object -ExpandProperty ProcessName""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3808
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Users\Admin\AppData\Local\Temp\rnd_fd2c36398830\vlc.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\rnd_fd2c36398830\vlc.exe
  "C:\Users\Admin\AppData\Local\Temp\rnd_fd2c36398830\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58221a.rbs

Path C:\Config.Msi\e58221a.rbs
Size 1008KB
SHA256 93f886225b7ef62ad43faa3d377345a1c03c3ed3e1881486d281424b81984210
MD5 10d8fe76c58e9dc5a34f50cea70f8f04
SHA1 09791a3359277e7ad39edf246a4f286cb8522113
SHA512 6a910f7bfe630989eaedb635e258d518f8c664ad275dac2b7b256336e11455bb2cfbda5c1c8bd27e558d4c7ce53484c0058d42b7326bac7389c480652d777e68
SSDEEP 6144:WYo6Bpd5Pm7p3cwIMMLWhvrHGrYTaZim/jm2SIAFqbLxB9YuxBdb/nsKXpIalrTu:acwIMMLWhvfI2/
TLSH
T14425EE9AD4A2C9DECD0804FB21FAF2DBC65E3496A9E65D1C931EC8E99C120E4DF41D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\HelixInspector\config\config.json
Size 586B
SHA256 ccd4908ba5a68a4a8f2a521ebd5c660b73b2bd519ba69b89b579629a846a1a84
MD5 8bbc0938182c5de0062e553a61f78a37
SHA1 615800dda12d16ad32c08758bd7cbc0aeb772fda
SHA512 921aba19e69d960e1c818f1b63b5f15df819eecd6649b497f3888e5c4e48b0da3ba85957c28d5778d87828a1dcb3e348063e66a75bdc510154982f47ccd5a3f9
TLSH
T114F02435CCB40CA30AD98028587E1707A03295670C997C6973CD021D8F0E33F2DBDAD8
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.json

Path C:\Users\Admin\AppData\Local\HelixInspector\config\deploy.json
Size 462B
SHA256 4f4358821ea5a625b45561245ce19a7193d255b24cf0aaa6a2c660def642df2e
MD5 47ec2e90c83413f9969f47288234f39a
SHA1 17d968aed70c4240cfd428ef23115eae69c925c8
SHA512 8ca4a7081d1a28f26bc6f8119c299882a1a1eaceaec5c47cf1ba5f7794bc5f211c059220a057bc92e07c353c75b5b178182128319595b515cf7b19813044f44b
TLSH
T105F097E305048148AF6AB84BEAA80DE869EA22B60423748B0C6D68C164A36308DE1E43
MD5 SHA1 SHA512 TLSH

Submit Download

colors.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\colors.js
Size 5KB
SHA256 e0aa28d1cfe746e50b36eadd8b73f7077df3003e07c4f7b3cc5c40e45c597031
MD5 aeae8a09f5fb6a0e6f58cdb9fbf6cfa3
SHA1 a7a5b0ceadb0e3cac9b4723d6158b3ee9605437d
SHA512 9cf4ed474a168434d9b195cea759fdb35d8a814597829fec0bc04805239985937a76d160fad9fde18697acfc706ca4487779c1ed313bc45d8f21b5a44116ca5d
SSDEEP 96:edoupQHToN5jRwXmTEo/ErnhKaCVGPi7yZv6b+3L25kgtcisyi5LL8KGH4nnenhP:ETQHTaPw5oCKaCVGPx6b+qkEK9L0H4nW
TLSH
T159C15248F9E262124E7370B8959FD454B23B7413256DCF05B8AD92B95FA043C82B6DBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trap.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\custom\trap.js
Size 1KB
SHA256 eac886df893bfa10e30e28228350d5a89126a4ba773a3d0e2d74d7b56029751d
MD5 10bd79daa882f24426ce6dd2130c283e
SHA1 ec8d149dd0c3d5b260c83544a24c4f8ba6eb1a09
SHA512 633794d78e91303af8ce902d6f21e88f597b1bc80727267bd2895c84ea32e88d3da4ac6811a7bb21c706544b27d36a65f23cfb205d5b4ed8531a6dfc03ffa1bc
TLSH
T1D931AE800DE17DAC8F9792338939902C795C408FEE8ABEB639AC11E06F0F1187679546
MD5 SHA1 SHA512 TLSH

Submit Download

zalgo.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\custom\zalgo.js
Size 2KB
SHA256 124463a7437210cd07269461255ecd45ce8af1ac48c8508857cb07514fa42c03
MD5 fd04e09cdc372a7b98e03a0791a2c10c
SHA1 874eef937d0e95291e995584c132fb2a0ded6aab
SHA512 9f558ea0d9c684a90b25012e0bed046922fac858f951480fc80949e20c612c93bda5a444317f18956019974970e21a070c9c03357261bbb5484947299a11c09e
TLSH
T1A6514B9C18D73157618E253A178FA0C660E2A213D8C9E808754D87FD5FFA32AB1EA774
MD5 SHA1 SHA512 TLSH

Submit Download

america.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\maps\america.js
Size 278B
SHA256 a8747ed6f9fde27c23d8374a87fa6a80898c72c9be80959b405382624c07ffb4
MD5 5088213a9db0e451ad6e583f6065cc31
SHA1 93197f184ae42006229373314e3df6e29b1602bb
SHA512 0d592416c07463236a1f5e39a97cdb1f5a979ea1fc09c3a13879bf83e09fcc146926441c0c6966f9cdd4a2609c60fc0301052921f2f904537dac2fced85b3da9
TLSH
T117D0C2D6E3F7612793B33B1A5A6FE0C0F81C4807101E5A8ABC9CB2063F1A0A8C029138
MD5 SHA1 SHA512 TLSH

Submit Download

rainbow.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\maps\rainbow.js
Size 311B
SHA256 85641874e0c1b9304099169479bf89b29b46c7e042c16cacef9b5e4c5f8b9e7f
MD5 d5ecd753d7f60ed9b25a56ebb85deead
SHA1 581cdfd9dd9d1449c2c0fc0d77ffdda713415b6e
SHA512 b7e6a18673f2657243320e45026b94df1e7b139bd5244bdce08f7c7645aa8a803b1a2276e1a5cbd34de5c8ce39ac5779ea3ee508db01eeefe37d1b0e2f4e5a77
TLSH
T13AE072889BD7323A9B77BE0D2A0FE080E26D1C13505C8A8278C8F331BF621AE40F05C4
MD5 SHA1 SHA512 TLSH

Submit Download

random.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\maps\random.js
Size 454B
SHA256 a0461e6327c356e9815e4273c9972ef63c77535e9dda29d7f5a8cf4b1b896ace
MD5 dcf15f9bfe36db8471a73ed2465a5b30
SHA1 b657b6477d0f9680a0e316ada993db165f28cbab
SHA512 8cd9c5873acbd77f3734da8ad47c5a875f0baa6a97b9b022ab497994d8d9d496edd7c431a43f7fda24da273d6bc6b8150caeb9644279174576f29fed7527d5f8
TLSH
T13AF0ABD5FDE630BB6A63AE1BD01EE48293391C03C82B3E84300C82126F4A089D07DCAC
MD5 SHA1 SHA512 TLSH

Submit Download

zebra.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\maps\zebra.js
Size 146B
SHA256 07f31c776e6fed5a0660dbd6d1848c5c0944f0a1e53e4a7813da0b23286750ca
MD5 992877db0bb4b1a8793b1cc0533acc5a
SHA1 577a98a2d5116fdf4145efcda27293052adcc352
SHA512 1d612e3927ae48c99274029b9ccc7d51f1e1011b499c6c9c788e1b063d1e385062af8085eb9f40401b08486318a5edff885771200a2626c22eba03411d387485
TLSH
T117C08CD8EBE2B01BC703BB0C602FE4C4F76C680530EE0685D41C22522E2209980A6459
MD5 SHA1 SHA512 TLSH

Submit Download

styles.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\styles.js
Size 2KB
SHA256 d469bf3213acd43f72be593acdacf925f248893e015f13c12a4a365a2076ecf2
MD5 cdafdc6dc4d16ca04034f289d40547f5
SHA1 f76065b794d382cd8702b19a0c4523a06d537d9d
SHA512 db800988265d01ac7e75e83e375493f85407ae443d4b09a524c8f2dff2c340ed718a3d6b66b929cacbfef3624541b52721145cdbbe7ecad12c775240bd9bb738
TLSH
T1A5515317E52AE5410D5A671AAA957417F3EE930A482BB07CACBDC31C331C1F853FAA90
MD5 SHA1 SHA512 TLSH

Submit Download

has-flag.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\system\has-flag.js
Size 1KB
SHA256 c2b82f82dbbd15bebed4449975e48b4077562269d44c31c6c238d728b9765b5d
MD5 cec02f7fce0b20775f65de0fb88e9e10
SHA1 504bfaea1048fe25a44f8e7216ebaf9644fab92e
SHA512 7601dcf19f64a7f3f8e921256975d80a85f97fd2bb09eafc8f55d4f2864806a566c462f529951cd456813a9271a002e80bff86bb228cf30ea6e774ebf5e5721a
TLSH
T18B21741D35E523621D6A12E075ADAC85B2BF6019756AAA4048ADF140277786CC5FFC84
MD5 SHA1 SHA512 TLSH

Submit Download

supports-colors.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\lib\system\supports-colors.js
Size 3KB
SHA256 8ed006395e84e32cf3ad027c789817360d3553e66cc01a63d66e0dfea9f42a00
MD5 5e53710d6b83525f0227f5f9afa4f6c1
SHA1 232b5da48a433e4c6f545b48fe692056b3a87445
SHA512 107ac75f6f02ae2c2592d4806681262e9a22104279ad0c08dbadf6cdf642d1b7c96c7667e83fe2344463318db10156cb4e2692eb1433f603161056dac1e64ada
TLSH
T1388150EDB8E13257071321BD864EF106B379E46B000DAF96745FA350BF502398ABA8D4
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\package.json
Size 1KB
SHA256 af67d5bc4fac331176780d7da47802a48d9bca01596d571685351b4a03a6b9c1
MD5 dec307320a0d5d3d59c8c98a33fd37c4
SHA1 bc0cd68d3d25a31abb16de7e2b5ff5e20d974403
SHA512 71cc58c65f846b808cb25bdffd351755fcf9abdbecb67e5d23043deb21feafc094332c8362e3d7fe6d65f5688afa888dd771683096574b91169ab313784e0e0c
TLSH
T1031106B9C8540CD34FC976ADAC559282B524504B8C80BE0EBB5D521C4F8D46F55FF6AC
MD5 SHA1 SHA512 TLSH

Submit Download

safe.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@colors\colors\safe.js
Size 248B
SHA256 672cc883942925ce2e36076ccaf2d3caf7deb7c50ffe65601b40de54281cd1c9
MD5 b9538bed90769a2fe122a57dc07a4943
SHA1 a055c3c673ffe9da4b9b6336f5d715b278913f19
SHA512 6ffe8d8c31541379b076955390bcafe9f38d51cf776c0f934ffc7e38bac97485de2b2f15f58a00ca9af79cdd0195851b839dc760214de4851545e0c18adcc4f4
TLSH
T1D5D05E86CBD457373E5714CC65ACC49601A5D909862ACB1BF885A3E62050422A651DE7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\@protobufjs\fetch\LICENSE
Size 1KB
SHA256 a67b34a24a5daddcce46aea68c5004e4442bbfb63690329fa607bf4de4269794
MD5 532013e80f57c86a3d7176374afe6380
SHA1 e40a5d2090efd5d2eae97987590d414d7b1389f8
SHA512 db98bcc743122ae1ced03c2d7e4efc4cd090d61b75a2eeee0534cff58ef6ec9a313ad826d4bcf490378a8b13c8a360f20a026df83700c0244113988d7e35b7f5
TLSH
T12A31509752441BA315F256543666BAC4B08DD02C3F272A042C6AE288677B02ED577540
MD5 SHA1 SHA512 TLSH

Submit Download

eachOf.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\async\eachOf.js
Size 5KB
SHA256 4c8f997f3cb81051d648dc5c0cb829e9ee611e2cdd1b5671c69ffedaae73b8a4
MD5 6feb63447198dd9e5cc8418d898083fa
SHA1 6e551f90e38b687140b53f0edd7e1dff8b98ee6f
SHA512 a264b0818fd8a8bc609aea28ed0d265fa6d81a604c95ae6671025d13d49695abd44b3ba8c2c53ecd38089ac1dca1258837e67b0da2da6519e8305620202e314a
SSDEEP 96:y6ldKgy27NTgBlefzwYQHu4OiRhBrfNP5t5jLxcAHg3kltHQnQg0M:y66gy2iBlyzw+4O+BrfNP5t5j9cmf9Ql
TLSH
T1EDC1952629F31737406BB074880F02917769CE5A055AE50D708EEBA45FC4CEA87D6FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

forEach.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\async\forEach.js
Size 3KB
SHA256 5a1dfc4bc3096bed90f675b27736f5a80ed3f177265de5a07df44bf20080c8db
MD5 7fbbce8af18284d8335f485e68d2ccae
SHA1 3f51b1082e362b76be93557254fcc43e2b124286
SHA512 e5b2f68b10158f1a81c15b3897d3b4afc39c532c00e23d5505725ade4a4e660894c4a5ff2884f11b553f0822ad1a4291dc36c0094251c841b89169da7872c6e3
TLSH
T1AE81471B5A75333A04A3B6A5810F15D26705C1DE906BF05C708EEBB0BF924C546D6EAE
MD5 SHA1 SHA512 TLSH

Submit Download

breakLoop.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\async\internal\breakLoop.js
Size 254B
SHA256 8b6c6a5bf543b89997b244fba5ec7d4b733e6e29449e78ed51e9ccc2be229d74
MD5 4447e517d74411abd8066d613aa3b350
SHA1 ea3b31ebdf9f9d077d9f6ea26b280381ec0fd6a8
SHA512 67a0a42ae7343396e471abd06bad614df3a308f01dded0658c3e7b847933f9cae20283e1414b3fe2d9f1c6f62fd0723bd58bd9983c1dc77fc74d03299d2b4554
TLSH
T1F6D09501B4B593F006F15098971AF0D1ADC14C334167F06453DDCF6B5104F58D0C0381
MD5 SHA1 SHA512 TLSH

Submit Download

isArrayLike.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\async\internal\isArrayLike.js
Size 279B
SHA256 05c01bdf61b44973fbd4457b3d2702bdd5ef0cf8f197f27ff3117e7c406963b2
MD5 6ed365f3ee2c6db8ba1ca4274a994ebb
SHA1 27be832c856b6a949c48adf6eae4f4822a8dc407
SHA512 95bbd29ab10b829618adcd56d150a20bb7342ffff6948283456f6e906b6e2859c4b9f580958cfcd8ceec1a7df749555024cc82274f2db736ae8c446f3cbaf328
TLSH
T157D02B087DF586D0C25040446A2DC041E4B548B3651DF8BC636C4FDF1600D18D7A4216
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\async\package.json
Size 2KB
SHA256 e010fe63aa861e8a60fb8b9d3e7fb5205e3b8d6001ebe3ff95985996abe581a9
MD5 e0c7c5d702fbde3d3357c4dcbeb82143
SHA1 edef722d2ef943350b398c9c11b1fc4e2e4928f5
SHA512 5962087029ddf2ca3ebf0c0ed1893fce4888b6278be98077441e24c659a87298bcb98146d68c99a7a46d7677c720276608a9d73f7d0bea282bae33f0b9bb12ad
TLSH
T1A6415621CD69CDE39E8522AA74AE0583655096830D81FC0F3369178C4F8D17F31F9E5D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\es-object-atoms\LICENSE
Size 1KB
SHA256 5e325595b4ea8cfec3802f545b1def5d7b73e4a5b8e9ba63e32a320f67732292
MD5 8fe23ea421aaf9f9d687709f6a6a09b7
SHA1 a47868ab90b532df82abe3e4f507bcb2ea441364
SHA512 8acd3b84f3afa8c6ff9c1a58ab774ea33aec7701c022ba8f4d36218a8d1c03e80ef2ee1d692dbd43dbf5883153137c5e000f113b98da23d870dfab6f71b78afa
TLSH
T11111751EB25107B228AB13605578ACD5F23BB25F7A9F2A84246DF345633A06CC5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\get-proto\.nycrc
Size 139B
SHA256 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
MD5 d0104f79f0b4f03bbcd3b287fa04cf8c
SHA1 54f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA512 daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
TLSH
T170C09B65E43F596B255D119CBD4CD5C7155415E1C1CD8F097D156661C31DB64004F541
MD5 SHA1 SHA512 TLSH

Submit Download

inherits.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\inherits\inherits.js
Size 250B
SHA256 bb380f32bef5feb18678f0f45f88073fed5d7a0069a309132cb2080cd553d5c7
MD5 9ced637189714b8d21d34aeb50b42ae8
SHA1 222da288a07d8f65b2aed9b88815948cfe0b42d9
SHA512 59925a20877c9193308e6766b96c11b6d910b45583c73498b8761b091231bce2f4f7d95eb7d2b2e83d6b8a595689b80878c27e7c1e87347ba03f6ccb0c945cd1
TLSH
T133D05BB2CCF93FA393E14495969992013699C25402D44944C7AAA1D464D5694811D9F9
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\inherits\package.json
Size 581B
SHA256 be645800bc94fd8de29c8ae91690549b316cc437100108aeea7b2f347693cc80
MD5 f73908dab55d4259f3ed052ce9fb2fbb
SHA1 62b11dd736a0047fbd8d2dc0406d2118a549a359
SHA512 470b2ffbcbcafb423d46c724d046b6471a7847f6c8a97158f4c22d26f429655bb40f3962026f7935741dda6ed5e6449fb942537f610df13d20892c5b6bb14a9d
TLSH
T124F0F020C97A0DF308D528556F9614027021191B8A88BE0C77DBA18C0F1D1BB07FE33E
MD5 SHA1 SHA512 TLSH

Submit Download

colorize.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\logform\colorize.js
Size 2KB
SHA256 0c1190a8bf8602ef75d36e6cac57b5ba8fdc44bc541776f80982b6fd7fe47369
MD5 ff9a7f78b4a7a1f77d116a764b2de377
SHA1 d23e1a982e9b53800baf2ea21849f671983197b5
SHA512 50b839107d300d323c2d9a6cdd9745a8a12ad807f95301ff2a0e23729e53858708b672ef210e8af4f2ce20b9d2d8e91ac1ede485de60a8ac6f9a914389e479ad
TLSH
T17351220CA6E256672D3330EDB7DF9044A522E03B2129EB7F3E0D87745F4593C429978A
MD5 SHA1 SHA512 TLSH

Submit Download

format.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\logform\format.js
Size 1KB
SHA256 5613b52a4bcb96d98812e5ef0e89842976d4c4c2cc2d64b32daea979469d3371
MD5 4979b5318706095e8e0fc5896d53846a
SHA1 84d836b0780f6e5185016cefea7ea6eba185ca76
SHA512 2d86317d5d5e2bd90ab2b3599fda1797ebe5b92b910f960969bc6ac14a1914d94719ddc91066ff04a0fb6e80487740585ecef01f0caf3364c9b25900a553a5d4
TLSH
T19521E109BAE17263C11324E256CF75CF9FEC8025211849032466C0D54F91D7D8797F8C
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\logform\index.js
Size 1KB
SHA256 18502b248f32926ded44e81f3785496379b87c728d952c093b5ee9957971a67c
MD5 9d87f3a7cc8f073254d1e9f418eb4035
SHA1 484f8cc3f4705c1b4e4f5dc8c6def147610f5474
SHA512 ed1597eb0a02d9b3658c6e09e2dca5dd9254f0750a9e70a1fa7ffe78397fbbc78102645eda5eeb737e290ac63cb726f3744437d6fa65b744c606af19fe27edb1
TLSH
T176315786B7D9B20DA0B771F9C68F84846F36D450105E2B02D85C50E25FA4C9CCF26FAD
MD5 SHA1 SHA512 TLSH

Submit Download

levels.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\logform\levels.js
Size 251B
SHA256 300bdbd1878ad098c4a31d8d9c6e38ef1813e2edc64eb49a3182d95b37e144d0
MD5 22f368c70ae97222a7c18193c1dcaaf0
SHA1 1a98859056162d8e70a9748896b45215bfa5143c
SHA512 a519cace15deabad5f57db788942290891ed04e5942b303a751476b63ae98fdfa2ba7ba1cc41a660bfaf250c943905accaedd2aca655477ee6ef0cf451d06e32
TLSH
T1CBD0958583F55A37A7BF04CCF353C0707D07D2F41016CB150E8D6154444146CC097D94
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\logform\package.json
Size 1KB
SHA256 7fe3c68c465efc9460ce9abfbf95d5cacefc76fe159c7b171bf8923aa27e2660
MD5 117b95201142694baf92a692f4b57b8e
SHA1 ee3e0f5dfcca636f59f35b524c6cfee6f3839835
SHA512 ead961fad32810cfc083652a24f8e734a936d756aa18125f5cfd453a93c098a95e72f67d9c3e94b711549d755d78c64a49b1f3f76b21ed8bed26eaad167c1b93
TLSH
T13431CB61C9288CA31FDD16D4E4AC12C27975880348D8FC4CB7EA936D8F5D12F20BDA5D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\minizlib\dist\commonjs\package.json
Size 25B
SHA256 8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a
MD5 df9ffc6aa3f78a5491736d441c4258a8
SHA1 9d0d83ae5d399d96b36d228e614a575fc209d488
SHA512 6c58939da58f9b716293a8328f7a3649b6e242bf235fae00055a0cc79fb2788e4a99dfaa422e0cfadbe84e0d5e33b836f68627e6a409654877edc443b94d04c4
MD5 SHA1 SHA512

Submit Download

errors.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\errors.js
Size 3KB
SHA256 7028cca95b2f124345bd5b816e0d8184e7b7d208fe0aa76eb38df43e8644fd03
MD5 548cc34803fb38415a833ae633b73048
SHA1 c12a741abe200aacc443f40633d398f1369739bb
SHA512 db6acc32fc19eef87ae6ee900b7284cf686d9eb980c9a8a188353652dbe6e516b59962d5c5b98c4c631de06d1e55d53ffdfd72722d77089f91713b5e6f9eb56d
TLSH
T1AF71654636D8515603A1B0F2299BE524E1FE9003549C4A51B5CCF3A1EFAA939CCF4FE6
MD5 SHA1 SHA512 TLSH

Submit Download

_stream_duplex.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\_stream_duplex.js
Size 4KB
SHA256 e2e55263df344f33d016a3e051de1a86e2206989a2162951e651e5557665954c
MD5 3e7b822c399acb53abc5b0a031277e4a
SHA1 57e5b8d44c5f6c083810abb4639a5d2684369cb4
SHA512 2da2217f7e735185130e977a3847b3c0f91277a054158cad8b0c0432c590b792a175f329286d4c67b9e98738ca3d7d25a0452e93ebc631048cbb3f32635931c1
SSDEEP 96:MpPI/lDQHGgOYQLDanh1CDYiediemieCKcg5M9V3ziPQuw1+:5QHl2LDanqDYHdHmHC5gkV3zCQB1+
TLSH
T1E591824EFBE433750882A2E0465F684A7328C5770D1ADA687498C6FC6F0743442BAD72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_stream_passthrough.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\_stream_passthrough.js
Size 1KB
SHA256 af6250df6a49a0148eed8b5f2e28b2f692c3ffa9df538a59dc716a4bd10901e2
MD5 03079912917033cc780db259ec6dd815
SHA1 0b7ab4aaf1a5034c444971dda33dd85175bf3b7b
SHA512 1a487ae07412f5d5be9c092e958a76379fd0e15f45e8f7273acede692e91f26e2ef8d192dadcf8b11afa39eded68124adaa592fcd64d0e36131c855b9a600d8b
TLSH
T12C31865E7FE5136008C713F089DA58C472AAE74B687615C7A46CF1C4537A43C92F7A17
MD5 SHA1 SHA512 TLSH

Submit Download

_stream_readable.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\_stream_readable.js
Size 35KB
SHA256 9837de8cae91f9a80da75368855b45c3ada9a858983355fd873d8885cab1c5ab
MD5 39e30df90f63a90f6d003c31738ec17c
SHA1 fe2d066c4943e19a77af1306b48e2801e56ec842
SHA512 4fc65ad2eaf6bd4aec41698599437cfd0740172a25eef3fc106c85c9b47e68b737e3982cb5d5fcff4aa8996529ab7bfd02567a6ba6ea79043b7e0d45ffa07e72
SSDEEP 768:KZAkwU4oWWy1DR8KjE2E9fbnbOa9EBlE117dTIxSYwaHvbjr:Kh+bZoya9ELchTkSiHvbX
TLSH
T118F2A48E7BF932284D56A0F5970FA56773A4C11B062FC660B08ECAD43F98874857DEE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_stream_transform.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\_stream_transform.js
Size 7KB
SHA256 a2f6e6d17a74dfa75bc7b34b50546ebcb76eeb2f4aac6d1090f80915aee20342
MD5 f88b61a833f9fed00f17a4a0352ae99e
SHA1 1ff98cf12e4bc54a554e251b47039b5e1e16b466
SHA512 376dfd4f17c1bcdb9488f5ae3038cb6c0d409719818b0fa5ea3fe71cd11cb41afa1eb06fed3fd705da47c6a3742b0355e46242f224247a96f5757feb9a4d98f3
SSDEEP 192:5QHl90hVkusQVXPvG4inuIN6GHRQcVRVFISu:5k9wJsAPvGbu+dQO3Nu
TLSH
T14CF1874E7B892360024221A08DCFD64E3368D32B55268AEAB55CD5EC6F9843C51F6FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_stream_writable.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\_stream_writable.js
Size 21KB
SHA256 0f3f2accecd343dfae91d7daa72f3ad125b6f139d5883ff51362042d8cb65cf6
MD5 1997e9040e13749540039901789afac1
SHA1 2ea69c1e8e0c9fd0fb25a8e5ed398bd3803ccb7a
SHA512 74c072d3160a8f0be3ac6434087c1faf7adef7271b1355e79fa2535e8b3ffede9b57415c3f295ed8f21532aa4be50bea668f0fd79572c1726b8c3d0fd5b42016
SSDEEP 384:5ktbF6A2WfQ4awKCrb6AIcVVYhDQcPGNuBDg7rHH9Bn2ijVRy+K:Kt52WI4zKCrb6OWhx8u+rn9MijVU+K
TLSH
T133A29848ABF623285F5271F18B4F966973A4C02B061BDA60708DC6E47F6217C427DFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buffer_list.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\internal\streams\buffer_list.js
Size 6KB
SHA256 15b266db6ad5c6ee0309d13ed4ce137d8974d2fd236c1af7f3d602b7028a90df
MD5 5941a6c05d57bcf11a8a2e5ed7ed5583
SHA1 63024ca878bb415b3c33254a22aff1cb08d96063
SHA512 bb686b29c52c02f4aad72337ae6db160087ec11626c38b98b1a7d6e6131b96856cbfe3829e236f8e93f8cd648d70681df60a1165771b9748f4fc4cd34b46d2ab
SSDEEP 192:xB7vW3jRPRM96GAeLEnBN7lMJI+7aL6aK+7aLNwcH:fWzRPRM96DUEnLZMJTe6apemI
TLSH
T133E1248BBFF5A4E05952A0354F5E2945F260E813041FEC08BA4CE6D05F60D399BFAED6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destroy.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\internal\streams\destroy.js
Size 3KB
SHA256 e1c1a185a2cc4bee2be5e7d33b5e294eb0fb55c1a47b61853a8c43e50cb822a4
MD5 911f1b0a9da5646f070719a4b5155ed4
SHA1 4360512d8ccddc09d6a2af937c24d3293af7d928
SHA512 1414a8362c638244f3049055c7807dc0f452025c3d7329131c0506d84a6d35135e847ede2d72816d082090d505a7c855e1f56bc8123e1e7ed739c5a4e0577db1
TLSH
T18651584DD7AE3256A92A65701E1F581B2BC4C4491E1BC624789CCAFD6F5EA340C3CEB2
MD5 SHA1 SHA512 TLSH

Submit Download

end-of-stream.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\internal\streams\end-of-stream.js
Size 3KB
SHA256 2c35cabc9b279cb81e73d0d14859b2056ea10d9688d16a12199d2ca9904b93ae
MD5 e1cdad2418fe697448b02ebbcd9cf684
SHA1 5331e3e33c1c4f6113e2ee195606057985365b3b
SHA512 63630cf251f4f3543e86296ceff044a960f8d37ac0592f0e06121f913494296748cba35e36a11d8f5968536a7e7cd7e0f13837e39a4839050d1f2df6d60388e4
TLSH
T1D651228A9DA73256A573F56B824FA31127E6C4130D1ED721B085DDA0AF214BC193CDA8
MD5 SHA1 SHA512 TLSH

Submit Download

pipeline.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\internal\streams\pipeline.js
Size 2KB
SHA256 6d51b72e1ae5ee0965f0f549e27ececdb4963605995ffad8b698d5359a9999c2
MD5 95708e1741d7ce72561ddca9bf6fffe3
SHA1 eb07bc48f37c4ae097677c91ae592430d7518507
SHA512 1a09035f671703adcd2e5728378fcb0d6c2cab54597e433c9aaef0d0cbd52917b5ff644da8ad94c38b3cacd38ef62cf0ec2a0ea84ff570c273a613168a89c4fe
TLSH
T1BD41EC8C64EB729695B2A6F4819F172A72FCC803143DCA90BADAD7B03F9153C0335E59
MD5 SHA1 SHA512 TLSH

Submit Download

state.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\internal\streams\state.js
Size 745B
SHA256 bf9c5ce1ccde2131d474422bef258dc968d6d19ccac72f9b178e8246faf0c9ed
MD5 0306df5e76cad892f09d4c46fde02529
SHA1 10fdfeb79c0a4cd671b562744be948f789bc4d5e
SHA512 4a69284449be01d0d2b7b0118694e6b3190539fc533ff3bca5d6205e22e4683c0fc98796cf75a38b16c2b13df01f61ba7fefe7a8639b39b2186ed621554617ef
TLSH
T1B6019C0D64BB128C49A3E4F2080E4E04AA98DB12220EC904BDFCDFD5DB1B86161DFEC6
MD5 SHA1 SHA512 TLSH

Submit Download

stream.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\lib\internal\streams\stream.js
Size 36B
SHA256 1e7903927df33aadb3659ecce55266c9c851da65ce6c8b723a60a305c1c5422c
MD5 76bae0aaca4d9c61a71995751b67448b
SHA1 90b89ec87417d1301e7615a3ba50b04626c2796c
SHA512 9be70625af9c47a3772622031cdc4ada6e009d9ddf71f7409109ef6b6adfb444414630897eab07f77bd268f66c9462d199cb72934e0bb4fdbbe614f16bb3de24
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\package.json
Size 1KB
SHA256 469ea81f64037d1f179bcd46412217903a2924dd2e7d7d9b728659b6f12c3e69
MD5 9c2127bf7f0075c3bf99edb27a77034c
SHA1 6bc59e2d7a44059a5f86b25e3e8ef9b80a83fcac
SHA512 d00872ec72a9d21517524c1b20e4b224070ae811532175c3766a0178717cd5a8886eb930c5a8a0ba94fb96b319112479f5364f46708da66b2e819e691a890308
TLSH
T19E41CC12CD1EDCD32DE4A6D8589C5643A02098478C95BC1C3796874C9F5E1AFB1F8B5C
MD5 SHA1 SHA512 TLSH

Submit Download

readable.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\readable-stream\readable.js
Size 729B
SHA256 2944f1d3c8c5d5c5e07e7c30d6cbef5fc37440b7c73de47aeb37fa8424f04bf1
MD5 f78ab238be23d4747a8bb44e35b6bc81
SHA1 857455f43161c4c63b67a42de981ef947385303c
SHA512 b1413c818a305ffb1a4d249ecec9d011a1fd99ac43d6bfd05c4320251494272bbcf2bcc849e6a5c3c31adb725345556d3180a117d32011760981e267427c0ab5
TLSH
T17E01848B0EB9B8CA2352B6D0A7AEC3476CC2D44B0548D1369150CBF548909945DB3FA2
MD5 SHA1 SHA512 TLSH

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\side-channel-list\.nycrc
Size 216B
SHA256 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
MD5 c2ab942102236f987048d0d84d73d960
SHA1 95462172699187ac02eaec6074024b26e6d71cff
SHA512 e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
TLSH
T12ED0A710F03A051561DD629C7D4DB057051404A2818A8625AC712260CB78A10104B941
MD5 SHA1 SHA512 TLSH

Submit Download

tsconfig.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\side-channel-weakmap\tsconfig.json
Size 116B
SHA256 6346ee4c020f341387588479dd83740a65ab902a462b8c6b3b8bf51f032c6795
MD5 52fad431b4493384deb61bca02e2ff01
SHA1 a16472424f8c26184de557eff8d6824939d1fc8e
SHA512 35b51bdea5bd3080b065d7aa72de5de16c5d839c6af8671f8325d35b69f7da5d9a5d53c53c38ccdbcf74847cc0bbf3d06e1eca01415a1546ffd5581747b1434a
TLSH
T19BB0922A960D0CB321D93E4C6D0FCACA969863C3C9C3655EADFAA162CB10A480027990
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\strip-ansi\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\tar\dist\esm\package.json
Size 23B
SHA256 3ca9d4afd21425087cf31893b8f9f63c81b0b8408db5e343ca76e5f8aa26ab9a
MD5 d0707362e90f00edd12435e9d3b9d71c
SHA1 50faeb965b15dfc6854cb1235b06dbb5e79148d2
SHA512 9d323420cc63c6bee79dcc5db5f0f18f6b8e073daaf8ffa5459e11f2de59a9f5e8c178d77fa92afc9ddd352623dec362c62fff859c71a2fab93f1e2172c4987f
MD5 SHA1 SHA512

Submit Download

cli.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\triple-beam\config\cli.js
Size 616B
SHA256 e091c039a75dbc3a7bd26dd00a14e23e4ff94272f8eaf70b529140280844ee92
MD5 38207e7d4759d7de3814fceddf7ec337
SHA1 450e7f93c6e1959c0eb38839966d18b0d62039c2
SHA512 8c46c6a485b7c7b7dfa94079306b48429fa9e91f1a1dcbfd79605c34426e363103481be3316c193180ea288f6c336449a1f4f4db1c745b140439b1e9bdf86781
TLSH
T14DF002FF9A2DA8930F750C74518E73129B2C0357743F75EA043633285A8C80563B5A94
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\triple-beam\config\index.js
Size 538B
SHA256 c4a03f4aa6a50d53d7853dceb6f4c494c1655d88453940285874236f4f62ae44
MD5 ca20e1a7a874d15c2e3ad1bfe4d5ed1e
SHA1 00dd456cedbcf5f3ee962f43abee07fa6a5483e2
SHA512 04623b8968145815a4d59157f87781ed83f75959122e51165b77df11dcb3489f21b3fea34f32789d3320ffa9f2420ec42b7ddf4832de58ac5eb7da4e93878cd3
TLSH
T1DBF02B9B966CCCD301A00CFC4347B682B9124663803FF04D19E2A7FC6C4408E46D5F63
MD5 SHA1 SHA512 TLSH

Submit Download

npm.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\triple-beam\config\npm.js
Size 516B
SHA256 e752cf9b1b7b087cdc7503d594b48886658776bf0921942ca5daa6d1b46617ad
MD5 c8fe92d39496d2ae2677464f576f3cb7
SHA1 dc25ebec5a74dd71cbad748e12cfcba62ea740a7
SHA512 d4b1f8f37c5bc185240fb32f7384292d7230d3c6ed58b49153634f88f5a1fce09521a8d88fe5712587bb19cdcd72d15a49486418a106801697abbb4cfe09f7f1
TLSH
T11AF050FE991E696307404C38508F76136B380357783FB5DA147692685E8D0060576B44
MD5 SHA1 SHA512 TLSH

Submit Download

syslog.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\triple-beam\config\syslog.js
Size 556B
SHA256 ab4a41dd252f2ba1ff671dfc7690cccbefce77e6f64bfa7d7b073c7235c911ce
MD5 58c20f70dc5533dc2b9e650b39868bbb
SHA1 ea92399351d721a39c118b92f7eeaae9d032e8bf
SHA512 b0506454b071d658bcb193a740ea7be4244fc3b9a8a1594acc609507f823d80055a7d24ceb534c3eec9457b5def541d2e11ec74a55ee8250d9e0f5e0c27ed67f
TLSH
T127F02BF9691CBD63074198B8108F77525E34079E743F76D9049B92380D8D50555F9DD8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\triple-beam\index.js
Size 1KB
SHA256 96ef37489ea31cfd50980777e22d4969223db12a5530fc8a0dcbc816a2c34376
MD5 b96b19924650138a9bfd7986df8802cc
SHA1 071e5db98a0f102bdfb3b05256b4f4f71770fe89
SHA512 2904c913f82d6a8bd38757563d1755c6f73475f0d2857792049099e69ea58712fa73449c61bafa8133e391e10163817820dbfa15ccd24f8a5fcf940acc75a1a4
TLSH
T1ED11B1026B7C6A9702D24465325EB1C9F8155037603671EF3BEEAB7E6D0C086518CFD3
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\triple-beam\package.json
Size 1KB
SHA256 b7c3d5228846e6719feb034f1aa72f294f1804ef9cf1f3fd7e1659413b9b3950
MD5 ad543bdd7f1fd50d9c7cb3cfb2bef178
SHA1 1e356e8f3df9978c633d2fdd6adef6f8f6f17f9f
SHA512 fcae9e8934d02d86d1de7c72dd9c5124bd25268afb92c8ed2cf9d298a3b76149fd6ff243568bacc4e8f1317315e0d2de8b7418c42c31a2e94d3099f1622367e3
TLSH
T18611AB25C8284CA30ECD2AA1F8AD1181BC6248474C89FC58F7A6433C8B9E46F10FDB5E
MD5 SHA1 SHA512 TLSH

Submit Download

node.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\util-deprecate\node.js
Size 123B
SHA256 9a86a29fa34a99b861e707345fb1d1e2e55a6c23edb8f992bed57cc607f42d8e
MD5 0e28b0a11a7a2d9d18f33f2bfa67d380
SHA1 26bb9fcabaf57f0bb50e5e026c13de394bc0c478
SHA512 e860d48ca4ae777d963ab666aae99f3719bdf336bf218b282b76a2a0f0268ca6b7283bf8c825544a0ecfdbdbbff3ceb7c98649d89f95665d3a5e2b2f6daedc0e
TLSH
T1D1B0929B11793212EB056974AA9AC08ABAC6922117086841C36507D2B81DCC481CDCC8
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\util-deprecate\package.json
Size 694B
SHA256 7bba467f049074957e693fc06672848b040c38fa071b6eed8690f5fbe090a8b2
MD5 73e6c3ff1709538c921d13a75cae485d
SHA1 2e69081e7bab6e09d3dcfd680716fdeea577431d
SHA512 b7c2475ca4aea834c9bf338d15ce9801b30a33046c68be77f706f85953b27acc1d4d22e9758fad10b04af26a2af7808830c85748bf8b7dbcd5ec588c2c2910fe
TLSH
T19E012B66CD7C48671FC016B06C194192766088574A887C04B3C7421AD74D9FB95FE14C
MD5 SHA1 SHA512 TLSH

Submit Download

winston.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\lib\winston.js
Size 4KB
SHA256 25dd9351a2ee791b3ec12fbb8cd92a03ac132878462c417a8c8adc5d1d2e3d0e
MD5 65599abeb35898a020584b3dca4e9034
SHA1 91929d1f380c3df7a6b4a3d9fe6b378590edb568
SHA512 534d521c873de4169fe050cef7f61432bb01e041473c7ab4d2ca26e1b581faf570278a980adb69efa21aaf227baf022239eb57eef7b909dee25bd64021cd9d86
SSDEEP 96:BZWwocKHgkuTuqTBPxOvqksMk+QRMTrATtyV082y8GKIcdbPkWh0KuhYWbyNBWot:B6JaPfRMTrATtyVH2oK5dbPkw0hh3bSV
TLSH
T1D691435AF79FD1B1066A40B8825D6102BF66C6172026B41A39D8F3F92FC809D49E6FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

common.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\lib\winston\common.js
Size 1016B
SHA256 3128a8cd8f1a0df64a55d82a7690713992ee94bb3c1abcd11d2e441246dc47cc
MD5 d61b39aa73b4ecc508853138cd8aa840
SHA1 10bd24baa516fa9712012d3e6eb719be70586630
SHA512 391ac9ad42fdd18db45bb499f5595141d52f62e4780e48314c56452bac0aa0c23f4a1ca26dc562512f2b91e19514287b978cfc0fe0ce011cd924d3d57c6625e4
TLSH
T1E111CB0EF7B517A20727B4B0460B8082FD1F15472169AE12BF8E27E68F414AA08E1FD8
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\lib\winston\config\index.js
Size 676B
SHA256 c5dd42e324ab0ee73441595847a5fa033435065a8ee8d73fdd309fb3423b9005
MD5 e15d71e4a306c6dc5741205ab8e2acd9
SHA1 f3cb38e202b477f2ace222831f530c8742fb3d81
SHA512 a80a9b2dd7751607640496fa3704799381abe700c5a2f86382daf0e0a57c9e046b9c616d45c6ac35eb77a2b5ae0729842f1fcc96c2b7fb5dbee60feb4a76dbd0
TLSH
T19501206F920D4CB359650DF482DF65A3CF51079230B7E4AE0441A375099140E1979F81
MD5 SHA1 SHA512 TLSH

Submit Download

create-logger.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\lib\winston\create-logger.js
Size 3KB
SHA256 7b2a560178a1ee39ec06c64eb8a47e4b00386b321e808c08bc12fc6b95b6ba8b
MD5 8e8cd2ea8037d9ed12b4540b091f8e07
SHA1 34504ae940e826c3217d550716e3a241e214eddb
SHA512 bf8948c6384ca37c750d2758ce15629e1a6b2545e8bc0ff116eaa0dd139482d8ed7d17f25618ed0d200143c7c738eb1e9c307ed821e0cfcd9a565cfd788db28d
TLSH
T14E5133296FFAA123141B54A5574F3242B538C4ABA11AE5F03CCFE39C0F41164479BDEA
MD5 SHA1 SHA512 TLSH

Submit Download

logger.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\lib\winston\logger.js
Size 20KB
SHA256 cacf975c23aac70fbf476fba548691762f2c08f9b6f347845979558c830257b6
MD5 faafc0959b75ffe15f890995e7b4e72c
SHA1 9ba9b0e019735899c51356109219243dea992011
SHA512 0fefcc803da04e172da304abf9a39059830d7e2ddb0c910e4ebffe0fe3f7ff3eaf9dec1feb3a777a50451ffcaba2fd74dfbb77d2c5316f67d733ed7df1fd77f4
SSDEEP 384:0oxf4EOtrWXR9iuepJA+Oq+jxjVP4oKWpp4wu+DwgPJ+FQt4fZ4HKZGBBNEN2zA:fKEBXepJ3O5FtWWcGBPJn0OKZGBBNENT
TLSH
T11E928698AAEB219346232468CFCF7145B739C61B201EE4A4B95D53DC1F8D23D4772BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\lib\winston\transports\index.js
Size 909B
SHA256 189ec9af45604bfd5d1b29131abb3fd18c94586457be426208d91ad92a8efaea
MD5 6e237e6657801827c07fa051d8d75d56
SHA1 5c78815cf7465755685097a8380c3f0991597442
SHA512 6c2c0e0f1305dfeb7ed5d5e5b5d960b7f145af3aa1f7119ed5446db1f79237c1b64d550e34da72000a5e2565b451be94898d315d01ad59d0e2638194d9bd5a84
TLSH
T1081131943DFCFA63C19690984E96E0807806D612513F7439F7D107799D883C594E6D96
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\node_modules\winston\package.json
Size 1KB
SHA256 f96cc6b8da151f7237b2fe38629ed06f55b7f230b281a70ddfa128e1b2648e6c
MD5 02b38eb0269bd9264e388a3c1938ed9e
SHA1 20eab7a88cdb780cb1023993439f123e19020641
SHA512 6c095799fd34c371ab59605f605410f9cd5ad88f1b7823bd3d4aa01adc3bd8c4fb9b7d3261d663501113d06f1372dce2d6f02de6dac67695e657f9ac6ed55686
TLSH
T1D6310F13CD28D9E31BCC2EDCF4AD81C0ADB5844658C2D4CEEDD9F3A6C0AC02B3256A46
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\HelixInspector\package.json
Size 561B
SHA256 20c83c9fdda0906c500ac8a1f610d34596ec41d7f360913d5160d674459c2635
MD5 b346f561133757e8ef29de1de63466f1
SHA1 9d812bb66fbcabd9a1ba4a16ca30dc8230249544
SHA512 9cac38eea7b54add7d394c3f0b3ced714938314e582b5e367190d8de30631026fad0ec33ba1489d752953223e06ae0a7835590804c4df0650965894d11572b58
TLSH
T186F0F620DD10CE2704DC19A57435474361B58457CAC8F8183365638D4F8C76F26B952D
MD5 SHA1 SHA512 TLSH

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\data\cached-microdesc-consensus
Size 3.5MB
SHA256 9da35c38773d093cc799a88c592829d0886cbd31944447110be9c30c52e7d804
MD5 3520579b7dbdd15b28a9203b3dd42570
SHA1 3aa287a447ba67edfe83850f1dd703fe94edfdbf
SHA512 e0ce9e6c31f2536490ee5629675590d24cc64c7c0f66318f07e2c0c644519d245754fc473001dfe373397af03526db8a12dc6e2cece746397540cfa11ee9bfd8
SSDEEP 24576:JVI/J9iRXXZV4KIYZjSRYAMT+cLWINuF3U/:fI/6J5IYhA4hEC
TLSH
T1100665EA97124EEAD32609EBE510FF3BF33F1615C2486B94297F88F97605085762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\HelixInspector\runtime\tor\data\cached-microdescs.new
Size 13.4MB
SHA256 c22c942bcffd375e6ae2be24d39454081a844785c518e225191b47745e383315
MD5 bb5af54d0bc0b84488cfefd41104287f
SHA1 10d49b5490f4aaf8abe28f7a518c4976a434be95
SHA512 5e08b60515287d2890f78cc0736fa37bb5b8a7516c3b5354bbd46749c1f3d75be568dc479bd96d4f2357c768542f48a8c3f90b6b7439ac80f2c9d895f1991f42
SSDEEP 24576:0Vjwqw3qrVhV4VkVksV+LV7V9V5VjKwrVmyq3kIIuL06m656VLVjRljltFV7V+lL:YLirmN
TLSH
T16FE6AEEA886B00C15E45A7CDDD2203C3DB144A3E4B5040A176ABB67B7F7329FC55EA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\HelixInspector\src\bootstrap.js
Size 1KB
SHA256 4102a8937850c73f9841208eef0be08b2fdbad0c94b5ec39cbd7688b0f26816c
MD5 b4cf8c488476ba083e478f169f66884c
SHA1 52e09b36410e6fb8e2a4541bb54aa33d13f70fac
SHA512 0517456bdc24742d6196d45b6d748f044c7aa7c93748091f1f25fc79b3e662e26c62496cb7c03a7099239bd7ca1d24916fbf6f09a160faa2e644798eba41f7b7
TLSH
T16831FEA704E29770D9B0DFE96B39021B780BD1E7794166E43AFCD0851BB20A65161DFC
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\HelixInspector\src\index.js
Size 2KB
SHA256 f3493d605d1687eeda3f615d7420ef1599dda8436c49e64997d8bae5de6b03be
MD5 5fb664db260fcca95f7512e787ebb71b
SHA1 b4420210aa4d05fde085dc38361fb6989a1b0617
SHA512 bda629db3a152b0061a6fd41777b74eb30de253d4ba17a3dafdf2d6798eb9d391c27652538e085ac28e9929a05ffbdcba49d34fb4c5ab6ba828fe87ef88c3dda
TLSH
T1CD41B277A74749E35D7782A99632831BEA0FC2721640E194B9DFA0CA3F7151407A1DFC
MD5 SHA1 SHA512 TLSH

Submit Download

config.js

Path C:\Users\Admin\AppData\Local\HelixInspector\src\utils\config.js
Size 1KB
SHA256 ee3e9f274eb7b7f26fe1fd62dfd3f7fa38fa6b0bc578c48ecf2505c697b24495
MD5 2521d908f9f56a883756df83ae2bb190
SHA1 8727f9fcc49238f5dee46b24c60584cdaa71c6fb
SHA512 2a035616d8e520959098f940ec7cf7e6e197812215f48a9e39ff53cf5177b1790a5d5cfb1cc96f6829e065b8e832cce6a88f414f7b731624849b2ea3dc27bfa0
TLSH
T1AF2142D7085AB07748B29FD8F3A2110BFC0F9392201AA196F8AC59D53F7BC000412E7D
MD5 SHA1 SHA512 TLSH

Submit Download

logger.js

Path C:\Users\Admin\AppData\Local\HelixInspector\src\utils\logger.js
Size 1KB
SHA256 029eef5dc9b2d67adcdfb88caef23426e02a5ccbe8ee4b742c367722a99231d4
MD5 b335b96bed624e0172645d36f52e718f
SHA1 ef47b5545fb52b95302bf8a51f4bf96b8dc9d4a2
SHA512 2dcd1dd2d0ab12345c76f829144e7610762a7c6614016f0ebc08358a3aab534389ae91a35cd5a9ad96434a29c48e97c6f67af2f6415d39a1a3bc42c7ed050579
TLSH
T1F92111D3CD89206615330D84E6DD1752DFACC682251190E379BC33F91B375602517B25
MD5 SHA1 SHA512 TLSH

Submit Download

polymorph.js

Path C:\Users\Admin\AppData\Local\HelixInspector\src\utils\polymorph.js
Size 2KB
SHA256 8da1da1c2398b8e8cb49918269a7dcbf622e5274895b4a99d048409cb08e3404
MD5 78cf4fa2e59653340f864e7bef57842c
SHA1 fb8f7ba182bcae14fb998ca5ea68c7408d8bcf43
SHA512 9691c46621a8753bb95f074a27e727d3dafebbf99db4566255c55cba58b7048a73a198a76086e32d708d4bb7a3286e1511ac47660c9144051082761c27a0f05c
TLSH
T13C51EF803AB465914BB0C6F28B77B526A666E4503313D7A0F7AD1C8A9D66930C5638AC
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ccjf1z54.tlc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ccjf1z54.tlc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e582219.msi

Path C:\Windows\Installer\e582219.msi
Size 29.8MB
SHA256 8330cf4397db0598deecc728c9fa4fb9a05d63f9d4c7eb6009a53b2a364a6790
MD5 17d83522be4a236d4174a8a2d08ffc80
SHA1 601220e077ecbe5572bc2c4228d2dcfbeba93e02
SHA512 fc6887ba4e2e82c0c455646cf573c0520740f08fa10531a003e5c8593c523d97745f0760795ec45bc4fecfa9ecc4ccb25647170881d8fba46852c4a83fcc73ec
SSDEEP 786432:99ugPa7oZ1ZcKZBgQ7pWuJ0A1P59+Dtz+0jBepYj4l55Q:rdPlZyQdWu/1hB0Nxj4l5m
TLSH
T19D67336CFC66ADC7DFA9B07DD9A4A3919EA20CA6C5000B011D38F35C3D726CAD785297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 9042e8f40416b340807f7fa73e72bdeb1938831e9d958996259047ae3af4cdb9
MD5 45e88b46c756e5bdc193d8e9309c54fd
SHA1 503a44c32ef06abd449b72ae08067ec9244d2ca5
SHA512 61cff1553f7de395ea44ba3bbe269bf4f209e59770e7f0845ef6a05febc35389053500879b057d11e07590ebff5b5d99ebada572fb7803809b8c6807c6d1dc79
SSDEEP 24576:Z2gmSp1NdoO/vvTLvmEuB0Hq/6pPwYgOWWXd3JEUN/6IkIQRoPFjr5eDB:t
TLSH
T16A47D12436F92210E7B39E3C6CF06A234D3A7D5B9C15DE8D05461B8E0961FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{704ad5e8-3368-4e86-85e2-008454c803f1}_OnDiskSnapshotProp

Path \??\Volume{f5ca1e61-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{704ad5e8-3368-4e86-85e2-008454c803f1}_OnDiskSnapshotProp
Size 6KB
SHA256 83913571101be412a62960439d739a19f33faf1d74c2fc1ac6cdde757f8dd9ff
MD5 a7b72778d26bd482c8984d36c481b4c0
SHA1 3c1f4514cda32bcfce704f7c603bdbb28d923ebf
SHA512 4c42e3cea81590a99b4159001727bce19092f074d3d711d99e6b7facb681815561b93052eaf8e0d9a3e8e2124afe95cf311698a6b8d44538baeec691f61d032d
SSDEEP 96:FVbFNjLCHvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:F9CNb++ZVm
TLSH
T1D8D188085AE54311E2F3AB3129F14557A877B911EF33CB8E0198238E2670A10F836F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2044-3807-0x00007FF7AA180000-0x00007FF7AA278000-memory.dmp

Download

memory/2044-3808-0x0000018F611B0000-0x0000018F611B9000-memory.dmp

Download

memory/2044-3803-0x0000018F614E0000-0x0000018F614F2000-memory.dmp

Download

memory/2044-3802-0x0000018F611B0000-0x0000018F611B9000-memory.dmp

Download

memory/2044-3787-0x0000018F61210000-0x0000018F613C8000-memory.dmp

Download

memory/2044-3775-0x00007FF7AA180000-0x00007FF7AA278000-memory.dmp

Download

memory/2548-3628-0x00000284DD190000-0x00000284DD1ED000-memory.dmp

Download

memory/2548-3629-0x00000284F5820000-0x00000284F5832000-memory.dmp

Download

memory/2636-3694-0x000002A2657E0000-0x000002A26583D000-memory.dmp

Download

memory/2636-3692-0x000002A27F890000-0x000002A27F943000-memory.dmp

Download

memory/2636-3695-0x000002A267110000-0x000002A267122000-memory.dmp

Download

memory/2780-3430-0x000001424D0A0000-0x000001424D11B000-memory.dmp

Download

memory/2780-3-0x000001424D0A0000-0x000001424D11B000-memory.dmp

Download

memory/3312-3910-0x0000018A29B60000-0x0000018A29BDB000-memory.dmp

Download

memory/3312-3501-0x0000018A29B60000-0x0000018A29BDB000-memory.dmp

Download

memory/3312-4-0x0000018A29B60000-0x0000018A29BDB000-memory.dmp

Download

memory/3312-9-0x0000018A29B60000-0x0000018A29BDB000-memory.dmp

Download

memory/3608-3750-0x000001AFFD640000-0x000001AFFD649000-memory.dmp

Download

memory/3692-3619-0x0000013C0ED50000-0x0000013C0EDAD000-memory.dmp

Download

memory/3692-3620-0x0000013C10A00000-0x0000013C10A12000-memory.dmp

Download

memory/3740-3710-0x000001DB63AF0000-0x000001DB63B02000-memory.dmp

Download

memory/3740-3709-0x000001DB61EB0000-0x000001DB61F0D000-memory.dmp

Download

memory/3808-3749-0x000002D9B7150000-0x000002D9B7162000-memory.dmp

Download

memory/3808-3748-0x000002D99E9C0000-0x000002D99EA1D000-memory.dmp

Download

memory/3944-3725-0x000002C121AA0000-0x000002C121AB2000-memory.dmp

Download

memory/3944-3724-0x000002C1214D0000-0x000002C12152D000-memory.dmp

Download

memory/4228-3790-0x00000143EB000000-0x00000143EB05D000-memory.dmp

Download

memory/4348-3605-0x0000026C7C490000-0x0000026C7C4A2000-memory.dmp

Download

memory/4348-3604-0x0000026C7BD00000-0x0000026C7BD5D000-memory.dmp

Download

memory/4468-3789-0x000001E475370000-0x000001E4753CD000-memory.dmp

Download

memory/4504-3569-0x0000027BF3D00000-0x0000027BF3D24000-memory.dmp

Download

memory/4504-3565-0x0000027BF3CA0000-0x0000027BF3CBC000-memory.dmp

Download

memory/4504-3558-0x0000027BF3A10000-0x0000027BF3A32000-memory.dmp

Download

memory/4504-3572-0x0000027BF1A40000-0x0000027BF1A9D000-memory.dmp

Download

memory/4504-3573-0x0000027BF3920000-0x0000027BF3932000-memory.dmp

Download

memory/4504-3566-0x0000027BF3D50000-0x0000027BF3E03000-memory.dmp

Download

memory/4504-3568-0x0000027BF3D00000-0x0000027BF3D2A000-memory.dmp

Download

memory/4504-3567-0x0000027BF3CC0000-0x0000027BF3CCA000-memory.dmp

Download

memory/5268-3536-0x000001FE15000000-0x000001FE15009000-memory.dmp

Download

memory/5268-3535-0x000001FE137B0000-0x000001FE1380D000-memory.dmp

Download

memory/5348-3739-0x000002380F6B0000-0x000002380F70D000-memory.dmp

Download

memory/5348-3740-0x0000023811380000-0x0000023811392000-memory.dmp

Download

memory/5588-3588-0x00000231FF230000-0x00000231FF242000-memory.dmp

Download

memory/5588-3587-0x00000231FD570000-0x00000231FD5CD000-memory.dmp

Download

memory/5708-3752-0x00000261528E0000-0x00000261528E9000-memory.dmp

Download

memory/5708-3751-0x0000026151060000-0x00000261510BD000-memory.dmp

Download

memory/5868-3661-0x0000022011A10000-0x0000022011A19000-memory.dmp

Download

memory/5868-3525-0x0000022011A10000-0x0000022011A19000-memory.dmp

Download