7fb9c527c10866b427e4b61fb414aecfb3ae83c43704ac9ddb8f00805679aa74

Analysis

user interaction
yes
max time kernel
373s
max time network
384s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
helium_0.15.5.1_x64-installer.exe
Size 123.5MB
Sample260817-ypbcwsycmd
SHA256 7fb9c527c10866b427e4b61fb414aecfb3ae83c43704ac9ddb8f00805679aa74
MD5 99933476a9e151c0b9cc136530ce7a46
SHA1 485c7795a918f68e6e98273a9e67c259f1fb96ff
SHA512 c90acdec157c6b58e303b051596f474ca478387e58c23be9002ef7291ab1a6ed12589be5231d4ded722ded7fe0d04567125dbf14353999fe63da5cd9322d0c9c
SSDEEP 3145728:ia5tSCklX2VjC/oYj2VMKl7jYkuFwQxxyO4dEpf:Yh2VsK9l7jduFwcaq1
TLSH
T16C583353F3A600A8D46EC978CF7D91225A357C4A47B493EF26D432E61A71EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5444	chrome.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\helium_installer.log	setup.exe
File created	C:\Windows\SystemTemp\chrome_chrome_url_fetcher_5404_367431303\proxy	chrome.exe
File created	C:\Windows\SystemTemp\chrome_chrome_Unpacker_BeginUnzipping5404_204625965\crl-set	chrome.exe
File created	C:\Windows\SystemTemp\chrome_chrome_Unpacker_BeginUnzipping5404_204625965\manifest.json	chrome.exe
File created	C:\Windows\SystemTemp\chrome_chrome_Unpacker_BeginUnzipping5404_204625965\LICENSE	chrome.exe
File created	C:\Windows\SystemTemp\chrome_chrome_Unpacker_BeginUnzipping5404_204625965\_metadata\verified_contents.json	chrome.exe
File opened for modification	C:\Windows\SystemTemp\helium_installer.log	setup.exe

Executes dropped EXE 26 IoCs

pid	Process
2932	setup.exe
872	setup.exe
4776	setup.exe
3860	setup.exe
5404	chrome.exe
4384	chrome.exe
5740	chrome.exe
2132	chrome.exe
5960	chrome.exe
1216	chrome.exe
2572	chrome.exe
2584	chrome.exe
4732	chrome.exe
4092	chrome.exe
4380	chrome.exe
2744	chrome.exe
4856	chrome.exe
3748	chrome.exe
4356	chrome.exe
6136	chrome.exe
1708	chrome.exe
5684	chrome.exe
2120	chrome.exe
628	chrome.exe
5444	chrome.exe
1384	chrome.exe

Loads dropped DLL 53 IoCs

pid	Process
4116	helium_0.15.5.1_x64-installer.exe
4116	helium_0.15.5.1_x64-installer.exe
4116	helium_0.15.5.1_x64-installer.exe
5404	chrome.exe
4384	chrome.exe
5404	chrome.exe
5740	chrome.exe
5740	chrome.exe
2132	chrome.exe
5740	chrome.exe
2132	chrome.exe
5960	chrome.exe
5960	chrome.exe
5740	chrome.exe
2572	chrome.exe
2572	chrome.exe
2584	chrome.exe
2584	chrome.exe
5740	chrome.exe
1216	chrome.exe
1216	chrome.exe
4732	chrome.exe
4732	chrome.exe
4092	chrome.exe
4092	chrome.exe
4380	chrome.exe
4380	chrome.exe
5404	chrome.exe
2744	chrome.exe
2744	chrome.exe
4856	chrome.exe
4856	chrome.exe
3748	chrome.exe
3748	chrome.exe
4356	chrome.exe
4356	chrome.exe
6136	chrome.exe
6136	chrome.exe
1708	chrome.exe
1708	chrome.exe
5684	chrome.exe
5684	chrome.exe
2120	chrome.exe
2120	chrome.exe
628	chrome.exe
628	chrome.exe
5444	chrome.exe
5444	chrome.exe
5444	chrome.exe
5444	chrome.exe
5444	chrome.exe
1384	chrome.exe
1384	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	helium_0.15.5.1_x64-installer.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314709793516706"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\AppUserModelId = "Helium.VU4764WAZCH7QWV7IMEHL3Q6SU"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationDescription = "Access the Internet"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationCompany = "The Helium Authors"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.svg\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.webp\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\helium\URL Protocol	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\ = "Helium HTML Document"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\AppUserModelId = "Helium.VU4764WAZCH7QWV7IMEHL3Q6SU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.svg\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.xhtml\OpenWithProgids	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.pdf	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\shell	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationDescription = "Access the Internet"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\helium\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe,3"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.svg	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.xhtml\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.webp\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\helium\ = "URL:helium"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\helium\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\ = "Helium PDF Document"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.xht\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\helium\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\CLSID	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\shell\open	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.mhtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\shell\open\command	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.xht	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe,0"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.webp	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\helium	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\Application	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.shtml	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.xhtml	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe\" --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationName = "Helium"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.htm	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\CLSID\{E9852F6C-08D6-4EC9-BD14-8A0FDE975159}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\shell\open	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.htm\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.mhtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.shtml\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\CLSID\{E9852F6C-08D6-4EC9-BD14-8A0FDE975159}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationCompany = "The Helium Authors"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\DefaultIcon	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.html	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationName = "Helium"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\CLSID\{E9852F6C-08D6-4EC9-BD14-8A0FDE975159}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\0.15.5.1\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\shell\open\command	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe,4"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\AppUserModelId = "Helium.VU4764WAZCH7QWV7IMEHL3Q6SU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.htm\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.html\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.mhtml\OpenWithProgids\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.shtml\OpenWithProgids	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumHTM.VU4764WAZCH7QWV7IMEHL3Q6SU\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\imput\\Helium\\Application\\chrome.exe,0"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\AppUserModelId = "Helium.VU4764WAZCH7QWV7IMEHL3Q6SU"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\HeliumPDF.VU4764WAZCH7QWV7IMEHL3Q6SU\Application	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\.html\OpenWithProgids	setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5404	chrome.exe
5404	chrome.exe
5444	chrome.exe
5444	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe
5404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe
Token: SeShutdownPrivilege	5404	chrome.exe
Token: SeCreatePagefilePrivilege	5404	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5404	chrome.exe
5404	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2932	4116	helium_0.15.5.1_x64-installer.exe	90
PID 2932 wrote to memory of 872	2932	setup.exe	91
PID 2932 wrote to memory of 4776	2932	setup.exe	93
PID 4776 wrote to memory of 3860	4776	setup.exe	94
PID 4116 wrote to memory of 5404	4116	helium_0.15.5.1_x64-installer.exe	101
PID 5404 wrote to memory of 4384	5404	chrome.exe	102
PID 5404 wrote to memory of 5740	5404	chrome.exe	103
PID 5404 wrote to memory of 2132	5404	chrome.exe	104
PID 5404 wrote to memory of 5960	5404	chrome.exe	105
PID 5404 wrote to memory of 1216	5404	chrome.exe	106
PID 5404 wrote to memory of 2572	5404	chrome.exe	107
PID 5404 wrote to memory of 2584	5404	chrome.exe	109
PID 5404 wrote to memory of 4732	5404	chrome.exe	112
PID 5404 wrote to memory of 4380	5404	chrome.exe	113
PID 5404 wrote to memory of 4092	5404	chrome.exe	114
PID 5404 wrote to memory of 4856	5404	chrome.exe	115
PID 5404 wrote to memory of 2744	5404	chrome.exe	116
PID 5404 wrote to memory of 4356	5404	chrome.exe	117
PID 5404 wrote to memory of 3748	5404	chrome.exe	118
PID 5404 wrote to memory of 6136	5404	chrome.exe	121
PID 5404 wrote to memory of 1708	5404	chrome.exe	122
PID 5404 wrote to memory of 5684	5404	chrome.exe	123
PID 5404 wrote to memory of 2120	5404	chrome.exe	124
PID 5404 wrote to memory of 628	5404	chrome.exe	125
PID 5404 wrote to memory of 5444	5404	chrome.exe	126
PID 5404 wrote to memory of 1384	5404	chrome.exe	127

C:\Users\Admin\AppData\Local\Temp\helium_0.15.5.1_x64-installer.exe
"C:\Users\Admin\AppData\Local\Temp\helium_0.15.5.1_x64-installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\helium_install\helium.7z" --do-not-launch-chrome
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe
    C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.5.1 --attachment=C:\Windows\SystemTemp\helium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff7a81ecf08,0x7ff7a81ecf18,0x7ff7a81ecf28
    3⤵
    - Executes dropped EXE
    PID:872
- - C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
    3⤵
    - Drops file in Windows directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe
      C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.5.1 --attachment=C:\Windows\SystemTemp\helium_installer.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Chromium\ChromiumUpdater\updater_history.jsonl --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff7a81ecf08,0x7ff7a81ecf18,0x7ff7a81ecf28
      4⤵
      Executes dropped EXE
      PID:3860
- C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
  "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\imput\Helium\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad" --url=https://crash.helium.computer/crash --annotation=plat=Win64 --annotation=prod=Helium --annotation=ver=0.15.5.1 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffeeb123e0,0x7fffeeb123f0,0x7fffeeb12400
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4384
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1648,i,2662536949728748918,4673923007965048695,262144 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5740
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2160,i,1062171991770815743,9557353433351408845,524288 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2224 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Time Discovery
    PID:2132
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2484,i,315713893128678500,5915031968028721069,524288 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2560 /prefetch:13
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5960
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3292,i,8235822418825144713,2463124983197923994,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1216
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3304,i,11655813274888964022,4693322882845412068,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2572
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3588,i,12894916151762485319,594142034408394566,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3728 /prefetch:9
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2584
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,15248149279005086520,1558001668537318271,524288 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4732
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4716,i,17845855567838978924,16639395453412569050,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4380
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4984,i,701395969729380542,16880585340188411439,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5724 /prefetch:9
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4092
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3704,i,4174466684899256863,2076254002804479618,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4336 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4856
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3724,i,4368985204563488707,13531435199622498497,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3588 /prefetch:9
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2744
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6588,i,2898362551577476566,8519437666037698268,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4356
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5408,i,220209762322683828,17473076927263341892,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5864 /prefetch:9
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3748
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,15092682074876036222,5221023694403543048,524288 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6136
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3492,i,12582995488672199464,8577817021297121892,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=3744 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1708
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5336,i,4649229671921499881,10202933893928778612,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=6624 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5684
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,12152999594373126913,3477745940118105746,524288 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5772 /prefetch:14
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2120
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6852,i,9242933912118321041,12917076224049894329,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6640 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:628
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=6872,i,10023556032125166579,6306142475467601054,262144 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6996 /prefetch:10
    3⤵
    - Network Service Discovery
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- - C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
    "C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5892,i,1655230931200668286,6345106669615544740,2097152 --field-trial-handle=1960,i,5741934207805360496,11523514174162871024,262144 --variations-seed-version --pseudonymization-salt-handle=1964,i,16707258238807394056,9423577269459738184,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\helium_install\setup.exe
Size 5.5MB
SHA256 c69edb34a72da0d3854a953161f6e6334621ad91778760134a6a90e0baab51b4
MD5 9bfe135fb72520a69105e7602a729d9b
SHA1 50a2f9348e1029f0791dcb352f6ec6390f274ed4
SHA512 32f386b811892a157cad50b87c8f5979a6f3dc709b5a6e4eb73c064a6698d43b393cccdd3e4ffc224171db783a4a967a3a83ae182e5c9f673e123309ee4098a5
SSDEEP 49152:4CgiEe6qSSzGB6zR7x0nsToAi0dY534vQga10pWyY8u9v6yFcA2M28AR4fidjtP4:OPGUnX4EIXpIyey5LG6w9
TLSH
T19B465B53F2A511E8D06EC974CF6D91229A257C8A47F1A3EF29D436E11A31ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp3540.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\chrome_100_percent.pak
Size 695KB
SHA256 470b47baf3af33a305cb3addec2285d11051a3b8612a671c39e7e70b98516e90
MD5 404daa6570fb6d6652000e2d222b4f47
SHA1 3a4455708b47444cbdf6849036a346ae9e8e2f8c
SHA512 b16fcae0797595d976fd1f459627116ac6340daf74ca20a305133dd20da69ee6dd0f46756e53bd2f7351f48e8e19fdfcc2086762d7a8ff1451f864cfe0dfce31
SSDEEP 12288:ojI3H1fJS0ujzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnWzmxWYJblIfCrsFS:T3VBlu7zEEmPLVbTe+gnWzmxJb4xS
TLSH
T184E412E77374AC7DEE5B1377826614B0FC371A280A91160A1BDBF8796913B4898D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\chrome_200_percent.pak
Size 1.2MB
SHA256 8379aca9b34dec81886d7d56746ebcba4946e879cfcb352e4b952a7e1257dc49
MD5 7d4261f5369f4b35516fe433ab9d043f
SHA1 cc11bd5e228565f95e4e095f71715724b6c60cfb
SHA512 92e091de8bf7e7a23571203a0de74e6a2c651a1050de9c6304d3e9dc498e07239ffb60146a710e7db27884dfed52415f77ccec2fa8ed2d925c29cdc72a6cfbe3
SSDEEP 24576:u3zBD9WIOzLmmibkFR8+mZiqr8BWhQumecRvQt9wb2IQwuSXAPC7n4:u3GIO3mNbkFRJmQ+8khQRl1QPf8uSXAz
TLSH
T11C4512D3D3B0AC7EDD520BB7939B10F4FD7500271A72190F0B26AD7A39166C4EA95A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\chrome_elf.dll
Size 2.6MB
SHA256 a2170eada4b7bd1fa314b7bb9c11749afe73f16d290a0d38357b9e5ed0fa09d4
MD5 d7c9cc03d45fdf270c56b45fba8821b0
SHA1 ae648a47db6fe1a01c6c82a850432687a7b7fa42
SHA512 f7e4d2ffbed4a9a88d221c7d69b2da14068dcc0bd03b3603bd411d7c4f0c5f806011cd9b565285f4e7bf65be7804628a8bfbd90211ba10ed1771ffd5a7ca8881
SSDEEP 49152:z8HYbj1CTM10qg/AiCg6sZYnbjJDyNvJSKwx7Gi5WIAyYp:l31CTFqOWbT5p5rHs
TLSH
T1E1C57C13F2DA01E8C05DD1788B5B9232EA61BC854B35B6DF0A90B6561F7AFE4673E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\d3dcompiler_47.dll
Size 4.5MB
SHA256 82981312525533c44822d54de548c1001071c78ab57a542f67472312612953b3
MD5 d39d758f8705fe7a58dda3897e8ad8ba
SHA1 ce22e2438f07b1b15039251b9f4b2fc23846e22c
SHA512 d1f6a2293c52d2c09ba42dde2377db73551abed13a84587ac8a4a6ba9bdbeb646395704ecd3c255aa48217ae9562b799b3ad62551feaca6dd836ecf5e76f2a7b
SSDEEP 49152:P6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/t:PUdeqt737jFm5wl
TLSH
T129268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\dxcompiler.dll
Size 24.6MB
SHA256 6a6656b26ed69c1c4fc7c712a3349f4ca41645fe68ab589dca765bbc7d608228
MD5 ff4cf904aefa8c48def0f3bbe606d40e
SHA1 4706c07a066adc044caa0da18561bf915772cf81
SHA512 1d95a755bd3cc99f44e9d2675eb4ef9f08e0fcd3c712cd5e2a3291551f960cc65ad0368ef207adf2bde50c318f26d1b97dc6dfb3d5f248dd60933d2c1177b3c8
SSDEEP 393216:lcDP4Rf8ThRFY8Pgy/GRAJdutUrhvu4fb5iq:fZ+Pg4JdCUrhpzQq
TLSH
T101472A122646D49CC099C879C7678B26CA6C30E73FA7B9EFC0F451212B79DAC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\dxil.dll
Size 1.4MB
SHA256 5b2923af6f4f075386b14696ade811db009b2927c2ce27ba99f51a770e18b0b2
MD5 afa5667c953ab3aad3e93b4e269eb4a2
SHA1 59ad99101539a258f9571c5882d3c7e2d7ed4570
SHA512 f633df92453b3057d92b02d0905fa528887e3b273646010ace089f6b170d177bac762e5bfac4528431eef652867537029018a48753f1c808672f7bf6c861141d
SSDEEP 24576:QcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/w:QsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bt
TLSH
T1B5656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\icudtl.dat
Size 10.4MB
SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
MD5 c9d17441b2314fe514cd8cb951577c1c
SHA1 15cae4dee805f3e04171e00781da13fe40036439
SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
TLSH
T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\locales\en-US.pak
Size 505KB
SHA256 e8168271810168396775d0730cf02f795b6b094c290b1f8ec2d02badce1832d5
MD5 4471bff7cbda6273ef6333650a680e3e
SHA1 f51c83fde1c5ab12a957e9e964c01d6d59a8b6f9
SHA512 f94883a6624b9860d0ec919a9a9ef0d01f23836cbd9f5ea362a7baca1c18127c986b5e6313884cd7f73dd83713757a0c46c7800536e4bdf19b4e983cd9d00872
SSDEEP 6144:7R6pbVzmmxuqgcQ9F/GOS1HjtRKStMf92WXj5faYL/6kuw8TN/hYw/:7ibVbAVcQ9F/8MMWXjfJJw/
TLSH
T1A1B41A1FF7441226059312637F0E95A2FB36D06DA39112563CAC812C33B7B6AD37B6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\resources.pak
Size 29.4MB
SHA256 dc3329ee435bbd07383f7c0c80c481a638c46af17081056976bf29d58e872328
MD5 7960db9898a7355ea1bb8a3a007f3f5e
SHA1 c2112a8defa29e9bc4b353b1fd6ac1125a7ed91f
SHA512 4857f11c13656f037d07819656940c873f43b551876271cd77328b04b900ac50c7b6403b3427b82d116ef8debe894515c1f6711bffceadaa61da57d8c398ebde
SSDEEP 786432:AIggwIkQMl/TntmeUti1oQgr4zaW2ZkBuwe4UkEqZe6:QIkQMl/TntmeWWZWW2m3lZ1
TLSH
T1E567E117AF00063ACAF2037C24EAB21AE33153B95243FDD765BA821CDE457DA267716D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\0.15.5.1\v8_context_snapshot.bin
Size 723KB
SHA256 4aa06b1a739760bbbf3d246c07c69315ae4ae90c681beb4d7334c92271666208
MD5 1ae8c0af8eea8c37615f9a5e81955f2c
SHA1 1dd9c0209c403bad20f6c2ddf0a6fbf28228dd8c
SHA512 4180dc199b19493e348eb2dee7936cb8b8a8af9af0c0f584261c468c9ce04b77cb0be20a47f833de4fca002e99dd492bbde433272af84f59583f3e722b5ecdc3
SSDEEP 12288:gbpe8jl246rucdLsWqqUNpkG+VOqJh2ww:gbpeG+pdWqQpkKqJU
TLSH
T16DF494B6F56A8A26CE5127BDCDB6CA063634F19DCF86C65B704217BC78A8FB44E1140C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2932_13431470948772822.pma

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\SetupMetrics\2932_13431470948772822.pma
Size 3KB
SHA256 c2662984514bff12ab8eccd32488398521874a8ffdb99f24bfe5b4de9b8a771c
MD5 20ad849305fcd84c95d0a971907bcc20
SHA1 98c6b06775134599af363329a0e35d0c8eb5583d
SHA512 0296b2935bf4d9984456017f96a49c07b3994efceaf88448718482cbee6df844f36034fad83b5d9dca60b19699da350d74ffda865dbb6bd84ab5454c5777bb1f
TLSH
T1AD714D09E788216BD0C78630CEBF8B949FF4FD8D6600029776DA691E1BA71C48F8D256
MD5 SHA1 SHA512 TLSH

Submit Download

4776_13431470945170769.pma

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\SetupMetrics\4776_13431470945170769.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\imput\Helium\Application\chrome.exe
Size 3.6MB
SHA256 3e43e3fed800023c2aab5c51978996eff007467cdaeaca3484d4a4e946db6d0a
MD5 3d1eb6f388b8b168939f3a40d2ecbf81
SHA1 be7b9f07c2fb3275db25a17500a63aeaa469d8ef
SHA512 7070a98a4d9c7aa8d9bda15f60bbe64a0d406c0ab8ed8cb12ffd133689083e120968425ea2d39d06e5cca56bacfc629d713be4b349fcd67013d4c90e16e96819
SSDEEP 49152:OCcE9Y4jIMbZkVRknUgLiQXfXPJMLHh+mKw4qJBwp79J/IWcWAIeOjswHhn:OcY+1nUgOQXffJM/Pg0u
TLSH
T1F1068C13F2D910D9C01DD579875A9233EA62BC454B31B6DF0A90B7122FBAEE06B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_MASCULINE.pak

Path C:\Users\Admin\AppData\Local\imput\Helium\Temp\source2932_1233855631\Helium-bin\0.15.5.1\Locales\am_MASCULINE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Crashpad\settings.dat
Size 40B
SHA256 8d9e6e1e6d9f432f61a35dae0e9e4e1efe4611a11fd6957e5c9c3c3d60ac2617
MD5 545cc093919506ee40f4a8d767516129
SHA1 197d327ba73dce0ca1ed0fcfd029952177c5f15c
SHA512 5986a12257642898a63094a7b38a7b64be1dcc17980c313875373d81c3175ca3e72663416329a0d8c43626319c06ed3d056d4a3bc651da0679181564af6ff95b
MD5 SHA1 SHA512

Submit Download

7b7ab1cc-0383-45b5-b70c-4f661931ef0b.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\7b7ab1cc-0383-45b5-b70c-4f661931ef0b.tmp
Size 10KB
SHA256 4504595b6d3fe926d43c9f5172b005b53c6f6683f6dcf54adf20b9c7fb713793
MD5 d714112c28147665ee5bf44be5d61120
SHA1 180899ce21e641466a811c75ad026a59aae83317
SHA512 2f11db64cff2a0f135123b7bd53bf689b40d50585d3eb16a222335808a55c4bad3cdeefe58e557e409ffbed5a0d7e48bd654b1fa0116183d9183752e6b39a9d7
SSDEEP 192:Zu9cBmQgv7XjVnTElONX/36+WNOoqyW8/88QTh5CiCp9yIsn2agUw:Z8mmQ87N4liXf0jTQLqUw
TLSH
T18622B45DA824AA7B4CC2E319FA25BB51E3F6113165903D48EBFD893C15E7ACD3223017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

918fcefc-4c11-4496-b36a-a027223372d3.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\918fcefc-4c11-4496-b36a-a027223372d3.tmp
Size 12KB
SHA256 74ada40c444cf92c8f9eb7dfbefea6d249904c1b0378c97857b6be3303021019
MD5 8a4ef51ddbfc3e7544a05090c0c2091c
SHA1 db3f60b9bdf28fcb67f5677e037b112f498cd659
SHA512 1e122ad12da43366a4f6f75cf06a5d605345685a512b1d623cb761f776ca0884a84e025d56548e3ec715262121bad2d4b6be06ec1cbdd53b0c74cad67ee37cc9
SSDEEP 192:m4tq6hP6AA/tFkm8CCjnRslcL/HLuAXfDghEUqXLsAKBAFMUd2uALs8HmwAj0px+:f3hSR1FmCClslmrJQYAAdXkuAwmF0v
TLSH
T19B422BF25C3C9DB60F899BDCBD2BF65BDDA002399688588487E7844C02D37D92386697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92f2fa18-91d1-4dda-8d5f-00a773f29368.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\92f2fa18-91d1-4dda-8d5f-00a773f29368.tmp
Size 8KB
SHA256 325654a73608e5bbd3fdbda2e2163fb04620ffab6ae89a11b6401d5d15b30810
MD5 43e267895a1e3bd8f2f0fea94f802c09
SHA1 f30d58bb977879553a6eead3f12a5a52fe6595b1
SHA512 af5c5ed038df5970be6a3df474fdcb7ea5d27aa6b351ada2998db9165615b928bcf577812fc49f1552ef930d4517c501993277d4fb1d991ece44178b53a12015
SSDEEP 192:zu1Qpv7XRShX/36+WNOqVZI/k9yIsn2ag+h:z8Qp7SXf0xd+h
TLSH
T18002A35DAD24A97B5CC2E319F9697742E3F6113135903C48EAF8883C29E7ACD223741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fc8ba92-8fe8-4220-a789-56dcaa5f4bbf.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\9fc8ba92-8fe8-4220-a789-56dcaa5f4bbf.tmp
Size 164KB
SHA256 037eddd52df1a85211ca903870b598366bed3586004322faa613c0f7f84ce873
MD5 f81098229d9d922e06633c80946e7a4c
SHA1 ca695f8a71b5ed6b44e210c457ffa4c5ed682e4b
SHA512 4ef1f4dc29e6d75d90186516d40f9a9bc5a918bb18cda216812fc9dfa4b12d38561edfaa066e32d9527dc1d0df687ce4f82aa951fb3b912e67c9b0a489700064
SSDEEP 1536:5RWNrk+ks4jLzE28nwGnRMaSRonW0j0Bl1xrDN2bQJFsEabr03c5cjXluXoSYTI:5RWN48nwGnRMaSRonW0j0B3FMdcj1uC8
TLSH
T1A5F3899499341626F4259EB3DE7CEF9219983F87B471394788E6792B3DF32C2722500E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

02eb51d021ce6090_0

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\02eb51d021ce6090_0
Size 9KB
SHA256 6bf734b583fd937655fd304245dd1c0b903e15397cc061aabe8594b4f368e63d
MD5 ae00ca50bea217ce75f73dacc8b90313
SHA1 37f402a5deda68f45c57a6e1c903a9782baecaf6
SHA512 41deac2151fa9131a267f2ef9b91a095304f3dd9cec7a9a15034f96727f21d7bdb5d55403668320bfa8b9564cdf661dab488028bef2b93f14e46f06f97d84842
SSDEEP 192:C6M9rCwUb/3Un0qHh/O4kqkwO4ISJmWxKQszSr9GiT:/MWb6prTklAJmWxKQYSxX
TLSH
T17C121940AB4989B7CFB91734DC79964A6BB01EDCADB0334B9021C24E286B1D46FFD352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b494aca5-07e9-428a-bf19-48ec02646446.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\b494aca5-07e9-428a-bf19-48ec02646446.tmp
Size 48B
SHA256 54a4c4aa057935644f6121df5a28ef361775c19043aa2a2247cf726ef7180609
MD5 9bfb83c9332294637b14d17f192018e0
SHA1 ef15f5f77aad8cddeb4ae8c098c7debed1bcbeb7
SHA512 4b59984c5178ed8fd853f2b8509e760266b46776f18e89cb4be3bfda290d24a6173e5cceaca2ddd0bb5c2646a4bae0ed2b5c93fbd60ee2c2cb5da7f2aac6fdbc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e035ce47482606fe997bcda64e9badcf53a4a06686cfd37d9b0ea014aef30319
MD5 e4538bc53870277d8367d0acdbabb993
SHA1 8bbe833d8c087146ce1c465965f9a44a349be6f8
SHA512 d6e3dba58934a5a84833f2b24a54e4bfa2e44d295e8db26faa1c28e398be2fc70d1c67ed93265fb411ad851957ec2156c541b130573a6c51ad05448c3d16fec3
TLSH
T1C941300971D01030EF306634EE959E91BB2C3BD7917C632BB40F5C7B66531C9257A58C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0eefd2e4a5cd0316ad63c318361a7a40f02590d377079ca98019fde1541c9bb9
MD5 0a16b4fdf859f37ab7494a63859ca8f2
SHA1 d6051026c3f7698b63584607c7c0afa4180b2dcf
SHA512 4092c8c7f8765e8853c85e42da037f8768b993b3652f9374f1c2743749c995bbe2a3709a7cfaf1b2804e31a6b1d7f46959ad02f0fcdb1a5f140ab28545aebf51
TLSH
T19A511D0569E00428FF205236FE569EE1672C2ED7C1B86327A50F1C7795A31993236D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1ff4981b969f122b40c4d27e383fdd35a1ff8da00bd81fb4ab3c498e75a6c92b
MD5 f2f70a58b8286c06f2346322ec9c0466
SHA1 2cb1336817feaee6a48bfe9d02f143a48f8d3754
SHA512 d1b3b0b09e28aebf4d854d1690ca740278c30e1d6bf8880dc32bb59bd3922151cabd0e390733b0b550af1352b7f6addd58ac6e8710b3a8af535f56e4e621df0f
TLSH
T16841C70569D00428FF605632FE569EF1AB2C2ED7D1686327A00F5C776663189377A94C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000016.ldb

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Local Extension Settings\blockjmkbacgjkknlgpkjjiijinjdanf\000016.ldb
Size 2.8MB
SHA256 f599117dd7744939418c3a4f120ce4c9f3843c47b48dea823cd81e63da3af435
MD5 2de764b23b9ca1a99d472ab252ff41dd
SHA1 741f19dc5291f6ff4555531d22da2eeac3e1c0bf
SHA512 4a3e28e0b8eebd9d2384ea7a2746902b8d19225215b27f552095c698aeb9d9fd536f7385bee999f00a5ba359cc5e4fd472d5baefc2e84099ed587c9896cd15d8
SSDEEP 49152:Czkb59MbgPPdofJ0Te+NflBknzX5ikFAn2/2:aQMbgndQJ05dkzpmW2
TLSH
T121D5120B0BAD3FBDEA070A28CE75E55C4DA149B98CBC8FD5EC3E6C4B11671159258B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2d06f0bc0eeba8370e112d181822e83fafaa73810dd9673af1be5392344ffe97
MD5 42d4ecc3fe3ee876e2ebc00820a2a31c
SHA1 96edbf6d6c45e96d077f1bf548d1490d520159b3
SHA512 9c0ba35b336f141b2167a7870386d5f001e6a5c392fce43c905b1cd8a1ee41e65ce674586c6efd088209a92f4c7ca6afd773b8a1590d0a047bdc3af6b65c0288
TLSH
T1EA319DFB82E18A7DCA1262F05F152917CF190519027C3C57C9D8AF5A93E59B1E241B0F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72ca12b724d3f58a17b8f6028c17e935bb4233814b3c10eba86e339d34485d8a
MD5 14e23bc7111d0fb7e68fcda2356fbc90
SHA1 bf519faae76e57b719fdb330f544422d9d3039e0
SHA512 ff7f342dd13484ce8fe096d6f47ffd08969e8718ae62c14bd2276c13058878d0bd7545a26b013c1b19505ce7b173c620528dc1ed82e1b63c3f0932b9dca84ec2
TLSH
T1C211C3BAC2D54A7DC55252F55F153913CA1D094C42B83C0BC5E8EF9A93F98B4A361B0F
MD5 SHA1 SHA512 TLSH

Submit Download

f5fd51a7-0ac6-41fc-8b42-d0d520f2c560.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\f5fd51a7-0ac6-41fc-8b42-d0d520f2c560.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 10KB
SHA256 5b673e844123026693808444575001cddb5c7cbbd7f5b5f352965b960fad8297
MD5 58077c4ed9b4e59ddad4e023a6103a3b
SHA1 3571697da1d8ead3ee375e31874d98a338dd1e04
SHA512 b36ce12308b4aab50a42d4ed937bc57219fbdeefda585aceccf8194eb52deb86e5b3cb4a51a4caaa278ea624666cb71f587296dcf1ad035a724e9be2e512b572
SSDEEP 192:Zu9cBmQbGv7XjVnTElONX/36+WNOo1Vd88QTh5CDp9yIsn2agUw:Z8mmQe7N4liXf011QL8Uw
TLSH
T17D22A45EA824AA7B4CD2E319F965BB51E3F6113165903D84EBFD893C15E7ACD322300B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 9KB
SHA256 75dd1b16a01056d81f91db2928c570ca3f03b9dde25580353c0411ef1fec0b82
MD5 b8e01f01cee99e0423c0e8ba53746fda
SHA1 839af3c4c94bf88ec1055f8bb4bedf17b60dee49
SHA512 9459a083854c74dffaed3e84f06a2cf70c231af72fdd699dde0c8da4c5027c5498fa61743041c0d37fc05f5e2f03cb11b9cce2596bdd421fb0b02e090f615127
SSDEEP 192:ZupcBmQLv7XjV+NX/36+WNOq88QTh5I3p9yIsn2agUw:ZcmmQz7QXf0lQL+Uw
TLSH
T15922B35DA824AABB5CC3E319F9687B51E3F5113135903D48E6FD893C19E7ACD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 8KB
SHA256 d93d64fabc613bda85d3ecf8da9acde7da22a2288777f3e1edd4d116c8284284
MD5 f014c4953b42e3f85bef62d5c161aeca
SHA1 c4af515d9898b06d3ae0cbb540487f59d00734c1
SHA512 16ed779e5f182d968948aedfd101a533ca03a16da8aa4b0c181f3e7a45e3db2aa5f72820eadb5856032dddff5e36e0ae8e211b01bea768c8826a8b4036db930d
SSDEEP 192:zu1Qdv7XfShX/36+WNOqVZI/k9yIsn2ag+w:z8Qd70Xf0xd+w
TLSH
T18502936DAD24A97B5CC2E319F9687751E7F6113135903C48DAFC883C29E7ACD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 9KB
SHA256 776adb90955f7adffec7e730b14263b154b13200838d3c4837a45af60bdc71bd
MD5 765bad0a616e1f31d35b652a7e3f282c
SHA1 742d7d3722f873187bb57276997d0daaa1fe0897
SHA512 e46cc03f2c7f14a6f61400d25bcb315501330074e8863912031719dccc6194b01eb8a0067a614db12a71de03982025d79bcdbe89c3617d7aa21939ab5d8ecfe8
SSDEEP 192:zu1Qpv7XfVhX/36+WNOqaSCSp9yIsn2agUw:z8Qp7XXf0xbUw
TLSH
T19F12A35DA824A97B5CC2E719FA697B51E3F6103135903D48E7FC883C29E7ACD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 10KB
SHA256 ee5c2f57455a97bf8c59f566593188344a119b56fca6efb2cd173f7954ff2649
MD5 175fab90feec3f65463a146dd3ae0a89
SHA1 34c5d3a5c37291eddfae85fd433c7f3ff68bde2f
SHA512 5af99cbf2213fc393ca5b20215aee8459afd69440196e9cee4e4103e81e4e482a2aaaa1cdcd77e7a23e5b33622a6589491193629afe91180949435a03c0ff818
SSDEEP 192:Zu9cBmQgv7CjVnTElONX/36+WNOom9d88QTh5C2p9yIsn2agUw:Z8mmQ8mN4liXf0m1QLLUw
TLSH
T14122B45DA824AABB4CD2E319F965BB51E3F6113165903C84EBFD883C15E7ACD2223007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 10KB
SHA256 bfdbf5809db0625614c9ead97191f2fe1de75544b479aecce2a43ab870bc358f
MD5 d7bec6e700b92c088518bca23113d31d
SHA1 53106e07ed3caa791ec573d0c5d9d3608d108a57
SHA512 f1b481d2365304acf8999555b7929c5143a4ed99b92373d88eb9030763a94bd10ee1dd235bf4b469a111c169c1ddfce189b49149a487ec8483102bbd3b1d9754
SSDEEP 192:Zu9cBmQLv7XjVnTElONX/36+WNOq88QTh5I3p9yIsn2agUw:Z8mmQz7N4liXf0lQL+Uw
TLSH
T1CC22B45EA824A97B5CC2E319F969BB51E3F6113135903D84EBFD893C15E7ACD2223007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Secure Preferences
Size 12KB
SHA256 b942ec3fd170fda0bd630334b144cc6967cc4aaf3c7066ffa10e0ea7bd4b6943
MD5 dcb32291e5f18623ca1873996e2f4c42
SHA1 3636c7832640ddf567b464688324fcdcca127a05
SHA512 328830af4f5505e94e86df87c9f5427437fa51621522e05e6f04a6611088e0bfa61f7c637303cb8c44a1b65fe151984d765540b00847225fb2aa31fb45ae796c
SSDEEP 192:m4tq6AY6AA/tFk58CCjnRslcLfr70nDgy86Lq3AvqFMhdMuLA8QwquPT0YbKnqIa:f3ADR1F3CClslbDpLANu50w+a
TLSH
T193420BF25C3CDDB60B989BDCBD27F65BDDA101799688684486E7944C02D37CD23C6293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Secure Preferences
Size 12KB
SHA256 bb3dfd09bebe7115f72900de5cc87d5087839a010cc95779fd298fd08bb73c1d
MD5 faf271d2fda11f4a9d9012d66e7f7030
SHA1 eee190956d880711dfeaf8714a764777c312adeb
SHA512 f7fdc2f954c4b2b98e7f552528e69d3d76f68737b0d67d63ee36ee7aa60e0193f87ee290ca86f7434aae4f8dd0fa80bf63b6af9cbf91e04444263fe0bd843d45
SSDEEP 192:m4tq6AX6AA/tFk58CCjnRslcLbgzheeW0DgF+jqpbRfNFMwdVLGh84vw3qUW50Rl:f3AqR1F3CClslceV6vDM3GCPs3
TLSH
T1B2421CF65C3C9ABA0F9D9ADCBD2BF657DDD1013995885844C6E7850C02937CA33C62A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 3KB
SHA256 414c2156abab444a7da1f055c992b00236116376faa82d09ca544040f6ba6992
MD5 13efd33eec3b94c2884167bfe63b4e6c
SHA1 27131c957b9510b599ef99399ccca25f4b0e5eaa
SHA512 d1483a98b5c4ee2d1b4ffe3ade4cdda39c1f93c1823f155a1aece2d56f91f1501bde9440578b05c7b7c690ef2c67e2fa289eecd6b81dd4506c8ceb9f161fe478
TLSH
T16361C6216468ACF34CF7F051B4413E4BDBA5A2BAA9517F88E9ED4E1C02FB2CC2302507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 3KB
SHA256 74f83c2a61227d2b5044fb57e936007727a122bc45d7aa3e74c53f56799eff39
MD5 6028e93ddcd7492c571df9ee4855c57f
SHA1 9383197fdb5148477ac274cd0dc22c5ee10e7b2d
SHA512 68cc50061b5a72cb35296046932d47d0fc9944b05830bfcc3ea1167592d3bbc00a86185e1fd55459dc0efef601131cb8c69dd09eef9efaf108def5a2672ad502
TLSH
T1D661C6216468ACF34CF7F051B4413E4BDAA5A2BBA9517F88E9ED4E1C02FB2CC2302507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 3KB
SHA256 415126e7a3efc7f1bf0dfc55b7f879b90a60b5d20bb589268c235b8ae85c8e9f
MD5 ae13b5edcba7c0520469d7a222272054
SHA1 4267075cac30d3f5bf74aa0b8b5e3e3a9602dfb0
SHA512 1488dc10bc58f07cbd6a08beb9bd69ab20e586155ca1663fa9ad2ce2921afa2296ba286efa47772ae2eaddb374707ef32ea1ad6491cdccbc5665b6468ff6cf10
TLSH
T16061B5216468ACF34CF7F051B4413E4BDAA5A2BAA9507F88E9ED4E1C02FB2CC1303507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 e13d5175a1882a722090a2cd9107d9318bd8a40b02cb1bf81049123b412f0c71
MD5 20307c74f572c63763a37675f35f2a3d
SHA1 ab7b7dc15578209ed132e4475257f8c2b88680bd
SHA512 7680dbf3fecba7dff748f346dd7c814ba349b6a54d2fe713201f3e728c59ef5c42be9427aaccf66fe20e785df75972b746b43d72cc46bf377c30d346aedc80cb
TLSH
T1185183717468ACF359B3F051B4463E4BDAA566BAA8607F88F9ED4A2C02FB1CC0353507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 8e1689bf39d0dc5e2c256e80e2794c44ef11fdcf255528d081f1bb483ba8c56d
MD5 00b9af32b8627bfdb544e7259041a2a4
SHA1 79972b5e522272c03199c705f352359582d4940c
SHA512 ac0dfa0ecbfc63eb52931e9820469066d08f93cd266d4aa7248907594781ce2a0497f0fcf611f54c7fb381c40c94ad9958d3d1c1808cfd3492f00d77b69a333b
TLSH
T1F55194716468ACF359B3F051B4463E4BDBA566BAA9607F88F9DD4A2C02FB2CC0353507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 3KB
SHA256 6aee4302219d687d29e0cebe55f3ca15f2af39acb4efa80ae7c0beed91a6bce4
MD5 13abac20cb42501421730141e2e9a901
SHA1 7dcab5ff3089bfc0e58441c34a9602463d5fb170
SHA512 065c64b0246fb2524c3f31e250a5a0b1fce9ce75f96c4757f1c0df6e3a48241a1d21acfd0c751a7d09eebea72bb37739aa6821ca31166596be2b98b64997c1b6
TLSH
T16C61A3606468ACF34CF3F051B4423E4BDAA166BAA5507F88E9DE0E1C02FB2CC1343507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 3KB
SHA256 148bce7273d3777a99d2067f07550b4f034984dcfb9db907ee433b3dca7374f8
MD5 d128ff8bde1bf48ca7f81a45b402e77b
SHA1 2c576e43afe9366e5b39853fe74df34230429c1b
SHA512 ff09b3abaac166d6ce5dc9f18e6025b89002f72d2e3a2e54b0d06f917cf8c8ddded7fef399015ea76eb4c293266f110b769f61f996266fc047fb57e0e4e0f07d
TLSH
T1D46193616468ADF34CF3F051B4463E5BDAA566BA65506F88E9DD0E1C02FB2CC1343507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 d9c33b7641a98d0248a02b1431c90d369f8f9e67f742794a149f4fe6f29b663f
MD5 d1ea8df2bdf383337adc6a0991456197
SHA1 68dad975d7929d260483647cc7e86c915a10dd08
SHA512 ac7fb8f6b12b15f059bf213b30a17d43b076c28f14e6117806749b3cce34d0a6309dbe69a1caacc16e1d1b8cd5e8d37e36e9531460b20090adb815eb72611c3f
TLSH
T1E45195716468ACF359B3F051B4423E07DBA566BAA5507F88F9ED4A2C02FB2CC0353107
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 3KB
SHA256 2a768f61ba45b8e7fe065c09c911976831f0ced62e0183ad8c688f767ae6dfc7
MD5 32b86b56dccbb963570bfdc6c7947123
SHA1 6b988f306cbb8263221762ecc434df8d67810e9b
SHA512 72bad016b28b32057329e7f5bd7571bd167e056034833f21e485b723b77031abce50374bc5d68c1ac1247a257269baa780c14d4b4ca626a383fa5fd5170104bd
TLSH
T12F61C6216468ACF34CF7F051B4413E4BDBA5A2BAA9517F88E9ED4E1C02FB2CC2302507
MD5 SHA1 SHA512 TLSH

Submit Download

81d900520e48132da206d631fff60c52cc28afd1cbb1f9758e8913ee852f3c7d

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\component_crx_cache\81d900520e48132da206d631fff60c52cc28afd1cbb1f9758e8913ee852f3c7d
Size 1.5MB
SHA256 81d900520e48132da206d631fff60c52cc28afd1cbb1f9758e8913ee852f3c7d
MD5 6b2e88fbe7180c6a1f22a4d4f6c2df3a
SHA1 90f457f637a9c148e13c65d610eb81f71d181f40
SHA512 256b5f3a502247c7175e1da40ca97595a6324c2d076722faa73064c889170224f95eac67a01446bb671b730959a37248800fa80fe1eff8bd4ff9e0f365a55f2c
SSDEEP 24576:xyNFz3s/54P4uO4nb9sIpM5WUKkp0eJCOzYbR3voEolT2GgJan:YIR4P4pqLG5WUKkpdTzYbR3gEo19v
TLSH
T16D65339B967C2B18EA5731DE50CED2A21F3ACCE1867394FD45D1036F0B53192EAD08AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac121e46-2922-4144-ba33-673cf121776a.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\component_crx_cache\ac121e46-2922-4144-ba33-673cf121776a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\component_crx_cache\metadata.json
Size 124B
SHA256 042637a42b2c3708470f9221048d3c78954409fc9c2dc1d2dfc53fdaf41dc3ed
MD5 5e3a31ae4b08a12d5513a504662b410a
SHA1 5847cc48ce2b69bc5ee7e7932720d6c227f293a9
SHA512 ae652c02e0187ca03e9782b53687a86df71da494339aea4158d471637326bbac6b50c17af96bbf4294fbe01202297f0c25f2e4c495fc2ac0b40259c2e187790e
TLSH
T11AB02B1008E79D406B86772F22C119204341E6020020A2C04A08B502839CF8C40108A8
MD5 SHA1 SHA512 TLSH

Submit Download

d9def14b-0cce-4b0d-8f8c-f6de0acc47cc.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\d9def14b-0cce-4b0d-8f8c-f6de0acc47cc.tmp
Size 1KB
SHA256 5b8ccd37beaf773c7d15c6c34e0c8492b12ea57037dd828cf3e26546588dc447
MD5 b37daf152666ed749fb09fb91878488f
SHA1 d520b0a227979feb101572474f8c8311f45dbf93
SHA512 e29e590a63a3e52bd9a90c10c7e998c7e8fb650c905b987f2d9b3c4a47dff4480235bd5a0f316c2d7def7c4b46a92d824c4da76358da7d51283d523c26bde33a
TLSH
T11A1161F3985CBEF3DCD1F56165827A4A1E16A23285A11F08AEEE062803FB18C1927422
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Helium.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Helium.lnk
Size 2KB
SHA256 6e77cbf895e2b7605a2e87b49507800f04116956e1491752734e4cfc0cc94bfb
MD5 94700b69bb8ca58b45c5ed3b68bb7f51
SHA1 511e892610c0887cd0ec5742a309cf4daf312891
SHA512 0fb29688d8f48107d299287ccd8a5be14ee39be93079b55b7112fa97cbc8ab45d444cbab23879b801b32902384640550969ee444cbdfa0607b828ef244b0eb10
TLSH
T1E751CD1679CA2610EBF75A359FFB72209D7F7C26A2CA590C5040860D2C41B121D89F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Helium.lnk

Path C:\Users\Admin\Desktop\Helium.lnk
Size 2KB
SHA256 1cc5010ea0709c4cc0a5c5d002acd1b13feb3b4636dd8fe0aa61f357a70ad6bd
MD5 d5012efec6eeb920036ae4c61785a9d0
SHA1 86607f37b99c7d3e20f9dcef40079a8eff594e19
SHA512 01093fe5b99d20341350b8926ef5581957122e78aa1daf9dc1f2e3728deda03b10a05bc354a4913a0181b615d1f6315e51924d6e1988d3ff8e64b5d6a08f03ee
TLSH
T1FA51002679CE2211E7F75A399FFB72609D3F7C36628A590D5040860D1C41B111E89F3F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5444-1537-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1533-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1534-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1535-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1536-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1532-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1528-0x000001858B920000-0x000001858B921000-memory.dmp

Download

memory/5444-1526-0x000001858B920000-0x000001858B921000-memory.dmp

Download