3e43e3fed800023c2aab5c51978996eff007467cdaeaca3484d4a4e946db6d0a

Analysis

max time kernel
150s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Helium-bin/chrome.exe
Size 3.6MB
Sample260817-ypbcwsycmd
SHA256 3e43e3fed800023c2aab5c51978996eff007467cdaeaca3484d4a4e946db6d0a
MD5 3d1eb6f388b8b168939f3a40d2ecbf81
SHA1 be7b9f07c2fb3275db25a17500a63aeaa469d8ef
SHA512 7070a98a4d9c7aa8d9bda15f60bbe64a0d406c0ab8ed8cb12ffd133689083e120968425ea2d39d06e5cca56bacfc629d713be4b349fcd67013d4c90e16e96819
SSDEEP 49152:OCcE9Y4jIMbZkVRknUgLiQXfXPJMLHh+mKw4qJBwp79J/IWcWAIeOjswHhn:OcY+1nUgOQXffJM/Pg0u
TLSH
T1F1068C13F2D910D9C01DD579875A9233EA62BC454B31B6DF0A90B7122FBAEE06B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware stealer

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4624	chrome.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2572	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314708395357282"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2728	chrome.exe
2728	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2728	chrome.exe
2728	chrome.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2368	2728	chrome.exe	84
PID 2728 wrote to memory of 2572	2728	chrome.exe	83
PID 2728 wrote to memory of 1072	2728	chrome.exe	85
PID 2728 wrote to memory of 3172	2728	chrome.exe	86
PID 2728 wrote to memory of 3600	2728	chrome.exe	87
PID 2728 wrote to memory of 3052	2728	chrome.exe	88
PID 2728 wrote to memory of 3556	2728	chrome.exe	94
PID 2728 wrote to memory of 3352	2728	chrome.exe	96
PID 2728 wrote to memory of 4352	2728	chrome.exe	97
PID 2728 wrote to memory of 4624	2728	chrome.exe	106

C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1900,i,10421029804640492666,15217046345932051566,524288 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2024 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2572
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1652,i,14802708282421247092,16510776548984437283,262144 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2468,i,1499337474219466739,14540488876324739987,524288 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3084,i,10725491847983670084,3859087158575323077,2097152 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,6734967356099372498,11936507160285650368,2097152 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3656,i,14715616565312212249,4667473616702505488,2097152 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3708 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,38509132360876168,1217597569792182520,524288 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3664,i,5495385102320152990,13116525648239802021,2097152 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5464,i,10496324725275771171,5761743919742281480,2097152 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4648 /prefetch:2
  2⤵
  - Checks computer location settings
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=524,i,6515556540656260017,6875384131463503781,262144 --field-trial-handle=1972,i,10392707691726676351,7884577128996221993,262144 --variations-seed-version --pseudonymization-salt-handle=1976,i,8591202829831129922,16768048885328731503,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  - Network Service Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4c9b5c1d-b9e5-4454-b47c-9eb01f300ab1.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\4c9b5c1d-b9e5-4454-b47c-9eb01f300ab1.tmp
Size 1008B
SHA256 0b0e03085c8b874b8ff922ff260512c1ab94f977685804e1e04956986b140b6d
MD5 1750e81bf72a05ae9ed431509568d510
SHA1 2a52457251580d1fefd0aa61b132305ab7e18939
SHA512 fdbb84170858b0b0ab223cfbb6c10a73940bd701be10635510ebe30c3110edcc776c64ccc4a90dbded89944a395f35bbedc657a9696f95c2e9affd1cbbccc443
TLSH
T18C11217B5825AAF3C9912559A5818D671E627277A1201E849BCE151402F7B8C0B33932
MD5 SHA1 SHA512 TLSH

Submit Download

2b9ad3fe-b5b0-4bde-8f17-ecb9981bb1ef.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\2b9ad3fe-b5b0-4bde-8f17-ecb9981bb1ef.tmp
Size 8KB
SHA256 16a9f102f6c5fb9fca88fe06bbc314592d7aa80710df4d789c71b1c11d3edcea
MD5 dfd34aa509d2561ff6b71ea6a3715785
SHA1 a5c74cd34c6e39d19ef4120908307031ebd4d536
SHA512 94f96d5cdfe56d2e953b63c0f742e251df2f23f7438f89e695e1f6e7145038a62571260ec956290a6e04d70c864b09be1e490ba67fd6201c0b15174ccac14516
SSDEEP 192:zjWglv7KSpX/36+WNOqHM399yIsn2agUw:zSgVzXf0KtUw
TLSH
T181028329AD24A57B5CC2E319F9297B82E7F5123175903D48DAFC893C29E7BCD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 fd8deb64cd0e2e0857691ad3b35bf3de6d6d3b181ab4e1428cdbf98255591b1c
MD5 d5e4975a25bffa18f9bdbb39ae271ec9
SHA1 6931fd7646b087e668409384814d46146bfafe87
SHA512 c7e59f4b33e258ffa0495289cb4ea63a751e88d337edd35b19d38b4b1d69623d99734591c2a02ddedc9f4b2df79bab8a1fcb1d833777c7cb30e90127c6fe5e82
TLSH
T17A4160093EC0D331EFA3623CEDA48DCE8B3918A3428CEF1B840D8DD826535CE2687058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 2fb33b8ecafeeea1cdcc0dcc24394ef597085067e3c2f838339b7e1b599002b7
MD5 c59a2609cb385642b6b9ded20f23cca3
SHA1 9204b9858d83eb797790e9f1129156edd5298193
SHA512 7c50bbbeb4b0a5e4181f1be938a41591a816d27e841d233b5756fcc771d900d11cb82f01462d2570ee2b4115e7eb5950ef12aac510d036aeedeefdd4c501a639
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Google Profile.ico
Size 164KB
SHA256 037eddd52df1a85211ca903870b598366bed3586004322faa613c0f7f84ce873
MD5 f81098229d9d922e06633c80946e7a4c
SHA1 ca695f8a71b5ed6b44e210c457ffa4c5ed682e4b
SHA512 4ef1f4dc29e6d75d90186516d40f9a9bc5a918bb18cda216812fc9dfa4b12d38561edfaa066e32d9527dc1d0df687ce4f82aa951fb3b912e67c9b0a489700064
SSDEEP 1536:5RWNrk+ks4jLzE28nwGnRMaSRonW0j0Bl1xrDN2bQJFsEabr03c5cjXluXoSYTI:5RWN48nwGnRMaSRonW0j0B3FMdcj1uC8
TLSH
T1A5F3899499341626F4259EB3DE7CEF9219983F87B471394788E6792B3DF32C2722500E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a1f91a8-91b6-4f0d-977f-9cb2e3eb8da8.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\9a1f91a8-91b6-4f0d-977f-9cb2e3eb8da8.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\Network Persistent State
Size 453B
SHA256 4ff6c3f3f3dcf5dfdf8e3e35473b25d1a3e1df10068a375082b1c81c9aa58116
MD5 de97d973537e1cf00503805a6dcb679c
SHA1 b0471b8e80e88c9a19b22c74769e7552b18d9623
SHA512 00b78427235d990c36ebdfc9dbccb113ff827d743c9c67fd2fbaa47ec2a8c95ec68f0e555d13719e525f4955fff1ffaf6e3c4ca413fa6224e6485a3008a19d2f
TLSH
T1B2F05C96D6E4497E86A613F01B213923C16F085842283D01C9E4EB8AA7E14B8551044F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 9KB
SHA256 da9f96b0ce18fd8b234b63165f769dd25f9eaf2453342c50331367d0a852bdb9
MD5 d95223bdc7d373325f5a00f6582892b8
SHA1 4521f379c88d066c2e854ad45202f21f7ef4bbbf
SHA512 51382801f219d50afad0b9b1607f176518cc75a578b8b6cd3034ac4410026dd94b8a34854a875d202a83ef02a0920ec82e4e6770e56075a64d85a3f088516c3f
SSDEEP 192:zjWglv7KppX/36+WNOqHMVz9yIsn2agUw:zSgV6Xf0KtUw
TLSH
T15A129329AC24A57B5CC2E719F9297B92E3F5123175903D48E6FC893C29E7BCD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 715fbdd09166b5a9afb34b40910b61ec7acfa81ba97fae1b9f64f026a6409646
MD5 d8b0efdd4d24e2b4a62b4f2f2f4bea5a
SHA1 ea11ddd5b0e386cd525ab62a12184f3591c47ab2
SHA512 7a5ecd456e0a739d925dbe32bee7c3ed171ca9276efcbccfc4e8ccfac7156ab924e2265b9c2f50b80ff297bbbcd963e265b75655be7c9ad1d5043f380b7957b2
TLSH
T17D5161397424A8F349B3A145B4466E97EBA16BBBB5207FC4EADD0A1801E77CC0353A17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 28e2cbf1cec9cedf75f4c02d2157f9753f9a115fa755a6f54f6904c977e2586a
MD5 1c82d502c44332e463fcf207c3775598
SHA1 adf23ad599ebed6b9d77427dea89a1f606635eea
SHA512 ec3ef6338947c447b8e937d072a3433a433faf1697a3fd28e9440521267ecfe6f91dac1daeda0f19f0fca50cac2fe23786319df161e85d37b96e12e79ddc9af2
TLSH
T1A3517239742498F349B3A044B4466E97EBA16BBBA5207F84EAED0A1801E77CC0353A13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 b3fe51fcfb2c4844b4a04ff18acc4d35023349effbbc5a3fe129ee953be96f78
MD5 b355aadfb8b0edae87335f05b911fe4b
SHA1 473a5349ca4a8091aa2586e82e02d738c66752f8
SHA512 190931f29b657b0f5702d622cc510e50e2c13766c080e3327812b307da5aba33eb6e733bbc766f0c76d9d158a24932eb0fc7b4f6dc351cc276c37a4641fabc0a
TLSH
T10B5183387435E8F345B3A145B4466E57EBA167BAE5217F84EEE80E1801EB7CC0713A17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-67-0x00007FFB5C6B0000-0x00007FFB5C6B1000-memory.dmp

Download

memory/1072-68-0x00007FFB5BAB0000-0x00007FFB5BAB1000-memory.dmp

Download

memory/4624-464-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-462-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-463-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-469-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-474-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-473-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-472-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-471-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-470-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download

memory/4624-468-0x000001C0AB9D0000-0x000001C0AB9D1000-memory.dmp

Download