268793a792e363413c958eaae932044f920f4277f489c737fc6d2ff922d22c11

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Helium-bin/chrome_proxy.exe
Size 2.4MB
Sample260817-ypbcwsycmd
SHA256 268793a792e363413c958eaae932044f920f4277f489c737fc6d2ff922d22c11
MD5 0b2a71abbd8ded16f58bc0a77212db6c
SHA1 5f46c60c9d5e95b6cffa2ade9c9f12baeb68dff8
SHA512 c9f46c7ab56294e5609278dee43bf7b96668c3dcefed9ae697a658a0532acc2412961be75ff9077c6f26c013de348b2d7967ff3c20258bfde5b148b8e564dee2
SSDEEP 49152:66OJP5k/zclabUTdBRstU9sZ1wPb36g9DTzqB9:sP5k/olTlB3hfqB9
TLSH
T117C57C13F2D911D8C01ED1788B4A9632FB61BC454B35B6EF0A90B6561F7AEE45B3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5576	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4200	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314708382428391"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5084	chrome.exe
5084	chrome.exe
5576	chrome.exe
5576	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5084	chrome.exe
5084	chrome.exe
5084	chrome.exe
5084	chrome.exe
5084	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe
Token: SeShutdownPrivilege	5084	chrome.exe
Token: SeCreatePagefilePrivilege	5084	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5084	chrome.exe
5084	chrome.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5084	4776	chrome_proxy.exe	86
PID 5084 wrote to memory of 3464	5084	chrome.exe	87
PID 5084 wrote to memory of 4200	5084	chrome.exe	88
PID 5084 wrote to memory of 3692	5084	chrome.exe	89
PID 5084 wrote to memory of 4892	5084	chrome.exe	90
PID 5084 wrote to memory of 4660	5084	chrome.exe	91
PID 5084 wrote to memory of 1992	5084	chrome.exe	92
PID 5084 wrote to memory of 4436	5084	chrome.exe	97
PID 5084 wrote to memory of 892	5084	chrome.exe	99
PID 5084 wrote to memory of 3980	5084	chrome.exe	100
PID 5084 wrote to memory of 5576	5084	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome_proxy.exe
"C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome_proxy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
  "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=1644,i,5353938521626537613,11278660595474509964,262144 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1964 /prefetch:2
    3⤵
    PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2192,i,10323594463873964944,6604321842150235916,524288 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2480,i,16839429501862434830,14943519651380889324,524288 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2492 /prefetch:8
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3064,i,934899555709052237,13546171448630546437,2097152 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3128 /prefetch:1
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,15056334180103031376,9370344149956849886,2097152 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3856,i,9007215162452653394,13194349634079459084,2097152 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4256 /prefetch:2
    3⤵
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,10535700909002578391,13041049638246346242,524288 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4436
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5300,i,1302027779906532131,17282971191832621417,2097152 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=renderer --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5524,i,14681665971171787131,17139033329744814401,2097152 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5500 /prefetch:2
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe
    "C:\Users\Admin\AppData\Local\Temp\Helium-bin\chrome.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=64,i,16684749511250817721,3487096316290932226,262144 --field-trial-handle=1968,i,1948153695093656864,10959862330091609282,262144 --variations-seed-version --pseudonymization-salt-handle=1972,i,16031245021982917737,3221415456954020286,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3336 /prefetch:8
    3⤵
    - Network Service Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

66527c38-4c2b-4cc0-aaea-1b9d01ebf923.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\66527c38-4c2b-4cc0-aaea-1b9d01ebf923.tmp
Size 1008B
SHA256 b8427e580c9c3910cc2b1fb03afb9359aa5bc665c448e9d402a216f74d714d02
MD5 55ba46250b5938b4aa0310ece243fb09
SHA1 f2c0d5c6eb2c003896e62ff73e88f0eac7daef8a
SHA512 3a85a90eec580c4743aa2bbf3958b677a360bb0852774f749f54b968e38c6fd2796cda946a35cb8ecd95b2e14a1a8f44d2db0aaca793530df33b6615ba73b893
TLSH
T18111943254A8BAB3DDC1757571C5AB876EB5F23782304B0897CF442902FB4AC1127C72
MD5 SHA1 SHA512 TLSH

Submit Download

41b95d75-0421-474e-9cb2-8a8f71a24b4c.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\41b95d75-0421-474e-9cb2-8a8f71a24b4c.tmp
Size 8KB
SHA256 3fe5ede25e9d22f79a19e03cdaf40d1ad77ad02d6f01546dd3e89bbdf4c92c2a
MD5 c66f4edf10efb440e1ecadb0110390c1
SHA1 9548bcc9932e97def79ff39d7a3534a7b50c7523
SHA512 a6845cbaa1690b9f0ec0a53319dfd1d683649b47ba9d59d8ec1c47dd37d1c90e586c7fb67a11d40946f2043dc2d62e95c5fba97ab3ba21b9ff3b15949ac98ece
SSDEEP 192:zXFWpv7YEESuX/36+WNOqvkRO9yIsn2agUw:z1WpsXXf06SUw
TLSH
T1E7027129AD24A57B5CC2E309E9257B82F3F5113175903E58E7FC893C29E7ACD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

392d20bb-e1f6-4830-b550-1447aa8ae371.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\392d20bb-e1f6-4830-b550-1447aa8ae371.tmp
Size 48B
SHA256 6219b6a16f622fb52477cdb132fb4092078e8de631706d064db3ffee8384c579
MD5 ab67ecff7c587dd4798b69584182eb44
SHA1 5431f85c5adf029a0ba5dfb1ffb51c624c596a7b
SHA512 bf18ef103bc33be1a738c44592767967fefae0811831f3ae4984138d9b7e95e27d5bdc07d52e1538f05e3c51216c69fefe4beed873de902220c6408df40a4d56
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3a4292b186d9edd411e6a882044b894be93c29d4bd5a46e22be33454c3fbfa5c
MD5 ac5d23a981e3351909620c391e87109e
SHA1 8627f559462e726c6d4fff919f2ced1a358487ae
SHA512 8efaf3e85a20b02d2ccdf489173141c6a3812467179b2d9ce5e24ee3d27bb2cb3316c9abef0f5789d8c7062da9106f76fad20ddaaee33907ca811faff3f8c24f
TLSH
T1A241EA83BD88D308EF28113EA4754C154E5A1AE759142337402CDCF839772DFD5E76A8
MD5 SHA1 SHA512 TLSH

Submit Download

11447a6b-cd21-485a-a583-b485289f242e.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\11447a6b-cd21-485a-a583-b485289f242e.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Network\Network Persistent State
Size 453B
SHA256 96bd9b0bcd18b6e1d5ce893608d9955d4fb136a4abd3e8d9c737cbd6128f68c9
MD5 49ba689a2b63ed2d95964d2cd83cac58
SHA1 f8d6e72918c8ddceab5acbd279c4ebc3e2a9dc09
SHA512 8df0e2f64a166038738d968be77bb0012dbd862d55c99e5f914c57b53881f4e95f8738c86f772169ca9bb3a72712bd483c0a00bf81b5fc80a0eca6ae9ca12d0e
TLSH
T1E7F055DADAE84ABE46E613F02F213923C16E185842283D02C9E8FF8A93E14BC521044F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Preferences
Size 9KB
SHA256 dc7f1d69924848f739b100e6d3710439a9800933e62c830f443feec7a8938203
MD5 202720bb711655f6f0170a283a40fc4b
SHA1 ac704d45aa3571f431c833aac77c99043264ef78
SHA512 5278ab1a2fc5a5ed140eb40a7fbff1b9b9183caaaafbd5259aef7b46cd37b7b4a97cac694af781f19ea46b36f283358651560a30f2e08a0646bb32ef23336b52
SSDEEP 192:zXFWpv7YEEluX/36+WNOqvkra9yIsn2agUw:z1WpskXf06oUw
TLSH
T19E128129AD24A97B5CC2E709F9257B81E3F5103175903E58E7FC893C29E7ACD222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b28c1bdc-ba58-4189-bb73-24ef166d9401.tmp

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\b28c1bdc-ba58-4189-bb73-24ef166d9401.tmp
Size 164KB
SHA256 037eddd52df1a85211ca903870b598366bed3586004322faa613c0f7f84ce873
MD5 f81098229d9d922e06633c80946e7a4c
SHA1 ca695f8a71b5ed6b44e210c457ffa4c5ed682e4b
SHA512 4ef1f4dc29e6d75d90186516d40f9a9bc5a918bb18cda216812fc9dfa4b12d38561edfaa066e32d9527dc1d0df687ce4f82aa951fb3b912e67c9b0a489700064
SSDEEP 1536:5RWNrk+ks4jLzE28nwGnRMaSRonW0j0Bl1xrDN2bQJFsEabr03c5cjXluXoSYTI:5RWN48nwGnRMaSRonW0j0B3FMdcj1uC8
TLSH
T1A5F3899499341626F4259EB3DE7CEF9219983F87B471394788E6792B3DF32C2722500E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 93afd39fd5b5334dea0c08f8be5c2fcbdd914c255ee1377d3a1daedf30b871ac
MD5 ea5282320038d66e17e424c1e864693f
SHA1 6f634eb6907390520238a0756b0fc07a6283b106
SHA512 cb71efddac8de943f41fd72649a62d2173f75d01ab436dc85b1b810a0f94c514a14feb3db91327ffd4a61e8f2b7b95c573629cad0477536c9d181a0b76d3ca4f
TLSH
T1E95196346468E8F359B3E051F4423E87EAB4A6BEE5217F94EAD94E1C05EB2C80347917
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 13949754a6cdbff8e57bb7320301d01d74c948070c4b84350b12162680cbe5e9
MD5 35adfed5c82b98cbb4969f0e60836193
SHA1 c15ea6da99ef6bc79091c9f88b742fd652da5b21
SHA512 47c346e4219984056a3aadafb4300a2e17c5e9617b6e77b0d15d6a8122eb3043070f7818a8e47cea0ccc86d75fdf7e7cb6e794c5913156a4d74c39d6ded1b80c
TLSH
T1D65195246468A8F359B3E051F0463E87EEB4A6BEA5207F98EADD4A1C01E72DC0353917
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\imput\Helium\User Data\Local State
Size 2KB
SHA256 25c2a673dd021bf771857327b874e7ec0ed18fdb210a780c450ced58da26cbc8
MD5 6a5a3e66acdc9a0accf76752bf039e88
SHA1 deeecf1455b1959662bc89ddcb7105425920940b
SHA512 8c89d18d85d5e88c45bf0e59357083a0cdf4cef700d9ac95a3c3106f90a4d13b03b49a26a3d591fc9123b1c64a4396d1dd6cd107dcd992930e92f64f58715cda
TLSH
T1085196346468A8F359B3A051F0463E87EFB4A6BEA5207F98EADD4A1C01E72D80353917
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3692-24-0x00007FFE778C0000-0x00007FFE778C1000-memory.dmp

Download

memory/3692-25-0x00007FFE76AA0000-0x00007FFE76AA1000-memory.dmp

Download

memory/5576-497-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-498-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-499-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-503-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-505-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-509-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-508-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-507-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-506-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download

memory/5576-504-0x0000022BB6950000-0x0000022BB6951000-memory.dmp

Download