Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/08/2026, 03:53

General

  • Target
    Helios-Setup-1.7.23.exe
  • Size 76.4MB
  • Sample260825-ef52csswbx
  • SHA256 50ff3c4c1ee969cfafc3c84218b4dd15e203a39fba0f5ee98b59c761a27b6edc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Helios-Setup-1.7.23.exe
    "C:\Users\Admin\AppData\Local\Temp\Helios-Setup-1.7.23.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5048
  • C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe
    "C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe
      "C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\helios" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1788,i,1474107150791064004,11436235248029000709,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4640
    • C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe
      "C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\helios" --field-trial-handle=1956,i,1474107150791064004,11436235248029000709,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1508
    • C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe
      "C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\helios" --app-path="C:\Users\Admin\AppData\Local\Programs\helios\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2504,i,1474107150791064004,11436235248029000709,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3448
    • C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe
      "C:\Users\Admin\AppData\Local\Programs\helios\Helios.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\helios" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2356,i,1474107150791064004,11436235248029000709,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1460
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5048 -ip 5048
    1⤵
      PID:4240

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Programs\helios\chrome_100_percent.pak
          • Size 146KB
          • SHA256 2fb9826a1b43c84c08f26c4b4556c6520f8f5eef8ab1c83011031eb2d83d6663
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\LICENSES.chromium.html
          • Size 9.8MB
          • SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\chrome_200_percent.pak
          • Size 220KB
          • SHA256 83d9243037b2f7e62d0fdfce19ca72e488c18e9691961e2d191e84fb3f2f7a5d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\d3dcompiler_47.dll
          • Size 4.7MB
          • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\ffmpeg.dll
          • Size 2.6MB
          • SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\icudtl.dat
          • Size 10.2MB
          • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\libEGL.dll
          • Size 469KB
          • SHA256 76efadca4ef6d2abe6ab3701b4071e04470eebfeed8d8d22c7252683bcbb37b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\libGLESv2.dll
          • Size 7.6MB
          • SHA256 150a02e43426a0886f023e88cd88454fb0e78696ea3881347a6256920c7a02ba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\af.pak
          • Size 481KB
          • SHA256 716e296c2f663ad90cdde85c5134582fc2305e5ebe10649fc9653bea533500a6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\am.pak
          • Size 782KB
          • SHA256 9cff5c4af5997b45fb2a384bd73560e56bcb7710149e1a7e3e172d64e6eda025
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ar.pak
          • Size 855KB
          • SHA256 516584da5741e7bb49ba6a70c9cf2ac47ff190ca9c4f692c3a30bc03a4560f50
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\bg.pak
          • Size 892KB
          • SHA256 d223e994ad1aa6e747507187f724cdede8c369d2e8e0def50c4a6c912dba3880
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\bn.pak
          • Size 1.1MB
          • SHA256 1e49980f89360b395a70e844ccd0c43b3a34eab84461b1499e7621f757149e3e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ca.pak
          • Size 542KB
          • SHA256 7e8b5bd0a7a9835f20130ed17fb68242d7eb277cfaa2be6407f08c8d0dfcd500
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\cs.pak
          • Size 558KB
          • SHA256 21916011c2668389727c8970e1407b9c0806812effab9552106da963951d9f27
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\da.pak
          • Size 505KB
          • SHA256 10dfa841d08a3ab094f83e151fdc1edbd66bf8f2392f1511e325628e4e9c7a0d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\de.pak
          • Size 539KB
          • SHA256 400f965d457e958b063e60131d88eaacd74fdb6213ae14cf84c4b6b45809e04d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\el.pak
          • Size 979KB
          • SHA256 58ca76aa55e11a475c830ac89010d4431f455f531079c1e8a0943490b4dd8e4b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\en-GB.pak
          • Size 439KB
          • SHA256 a672387f6fb84ade1b0c44c456ff1a19dcd464c4a9e65e439ca95a115455340f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\en-US.pak
          • Size 443KB
          • SHA256 95fd54494d992d46e72dad420ceee86e170527b94d77bfaaa2bfc01f83902795
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\es-419.pak
          • Size 534KB
          • SHA256 dba56ab390a959dc40cb79db195e4ed6b17d4009235063f738b9ebcf41c4b5cf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\es.pak
          • Size 534KB
          • SHA256 ea54cbe126cdd85b2799ad9600b86ca98c994e69251344163037139296ecea7c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\et.pak
          • Size 485KB
          • SHA256 3610615dcac844cc9a64b843da606f4f8d29b1c945ecc19b288b54829d0e92e4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\fa.pak
          • Size 794KB
          • SHA256 34d79e8a7fa478bf3b350412160a59249e87d31932d728f0167cee89aeff2bad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\fi.pak
          • Size 495KB
          • SHA256 01f9669cd2fa17965f882e2cd81c39fa2face2f13ba4f024c3799f1841111ffc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\fil.pak
          • Size 559KB
          • SHA256 3265ae5b6c16a09b1ec9ea53181de78df75e951c3ce28f33d4c483088a9ab37b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\fr.pak
          • Size 577KB
          • SHA256 8a283001240c59a552945d0466e3118dc125fbc9f1a10bdea4ca4197460102ba
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\gu.pak
          • Size 1.1MB
          • SHA256 74c62dca0b7a310aa593d1dcca8b0b0b382b052837e7cae6b87cf05b8b346b1b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\he.pak
          • Size 696KB
          • SHA256 25281efad59a66f310cabb92da67198451567da553f2c437e52388e8fd25b9a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\hi.pak
          • Size 1.2MB
          • SHA256 4b5585a8cc1a21e2dfcbd0d33f6cea87b7a583b8690f0f3635bd74bb5cbd2ed0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\hr.pak
          • Size 538KB
          • SHA256 d1f8093b91663d061bc2fa20426e2c430d53b06fc605ac1b0b2279d446dc9317
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\hu.pak
          • Size 581KB
          • SHA256 0a62d168c0f6d9d651dedb4e01be5b533b94e8617535cd70ad22717748fbbc64
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\id.pak
          • Size 478KB
          • SHA256 d9fc19e683240404a60d57037f24e1d8b20cfda4c8bcacfed577b86cd8988517
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\it.pak
          • Size 527KB
          • SHA256 f38e6b6d975f8148f46dbeda89563cf71bf07af98e9b79c1a8d158b5f8f1309f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ja.pak
          • Size 644KB
          • SHA256 6df72da472ee171acc440c20a2a194a2a4af4839b6a88323c4654c50ff8b492b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\kn.pak
          • Size 1.3MB
          • SHA256 333725ea1045d44acf2c19efc765bffc38cc5cea6e9977fe583ad6e203442582
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ko.pak
          • Size 544KB
          • SHA256 3ad0012db772293073acb05d24b8dfb26697d6cc5dd1612150df023dbc31b674
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\lt.pak
          • Size 583KB
          • SHA256 946351ed2d74f247dea0f2742fc36d89225355480f0cec99d71599ccce3ea9e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\lv.pak
          • Size 582KB
          • SHA256 1e6f9a40f4fa1206117063234399bd7c1e7d198cbf6c4ad633e5e18ad0929836
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ml.pak
          • Size 1.3MB
          • SHA256 f2fb440eb0518dc695810fcb854b20b72aa47e5ffc75c803aacf05861d35a94f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\mr.pak
          • Size 1.1MB
          • SHA256 a674db4e60152fc17a32d4b92add129adaebfc02a1a783a12653f984447c535e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ms.pak
          • Size 502KB
          • SHA256 7707f79a2a4aec553e68af87802a0f19d3714a25311fb7b8afdc6ff4a5b6c5ff
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\nb.pak
          • Size 487KB
          • SHA256 53b12866e7265661c0088b89653d2c1cb9220e1ec0ce0049f3095d53356b3f1c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\nl.pak
          • Size 503KB
          • SHA256 4736b7ec56cb845c14795e6e4fa98ddaba47c75aecec86e931f61222dff45ad9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\pl.pak
          • Size 560KB
          • SHA256 2191f77aabe75522166a3325e2660395479633b936d5173d150120367ed501a4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\pt-BR.pak
          • Size 527KB
          • SHA256 1deee32edff320827dbfbe22aa42e83d8caf79f95f7cf18013424da7cdadb975
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\pt-PT.pak
          • Size 530KB
          • SHA256 fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ro.pak
          • Size 549KB
          • SHA256 06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ru.pak
          • Size 902KB
          • SHA256 6e53b1b54bac43c07798ee6507bd05806fbd2146ac0f987a7f03aae3cf5d9985
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\sk.pak
          • Size 566KB
          • SHA256 7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\sl.pak
          • Size 544KB
          • SHA256 7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\sr.pak
          • Size 839KB
          • SHA256 35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\sv.pak
          • Size 489KB
          • SHA256 bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\sw.pak
          • Size 515KB
          • SHA256 eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ta.pak
          • Size 1.3MB
          • SHA256 e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\te.pak
          • Size 1.2MB
          • SHA256 8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\th.pak
          • Size 1.0MB
          • SHA256 a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\tr.pak
          • Size 527KB
          • SHA256 f842b56ddc4145e4474c5cfc67893900b577c131a4b123cb16cfcad48ed0f338
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\uk.pak
          • Size 902KB
          • SHA256 5dd2fcc64ef09be0775c2efe7e07dddfc18f5ba6059f878d0c22b9b0c2207cdc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\ur.pak
          • Size 790KB
          • SHA256 a0c752a805da7dd6608ad04625734f4d27cb75b682f51b2dc8ef08350cc7a2cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\vi.pak
          • Size 624KB
          • SHA256 d7f676cf557d43db07b14a22b0b20ca761ced59285cadd75c07c68613486e909
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\zh-CN.pak
          • Size 450KB
          • SHA256 48e32f53d07cad6e6dc12040619f7021fa8f0b3254cc6945905b7c6748acb787
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\locales\zh-TW.pak
          • Size 445KB
          • SHA256 a8b11c74a0512fed29b11748181ef4b1de84dc99197c48d9eecf316aceb425fa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources.pak
          • Size 5.1MB
          • SHA256 75e03df55d7d23c840c09288da270285f17d067cef8709252451c0a8aa1254f4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app-update.yml
          • Size 93B
          • SHA256 214304150a69cd673203732e7c19069802bdecfec88ece6fbec1dba8198b3dff
          • MD5 SHA1 SHA512 TLSH

          app.asar

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar
          • Size 9.0MB
          • SHA256 a0ef0461b8a78937ea70e2f2fea81a28eb6784d3efd114892041eebd67d0c322
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\LICENSE
          • Size 1KB
          • SHA256 071c22737c45e77621eb378db221ebf88cf86138474371dbcc06382d6606980f
          • MD5 SHA1 SHA512 TLSH

          index.js

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\index.js
          • Size 5KB
          • SHA256 b927f8baf1180d79592900cd3a5eb5bd8ce2c2b0dcfe8a7da58fd37891d64b6c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          index.js.map

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\index.js.map
          • Size 4KB
          • SHA256 22777e225b299e0b0cac6c8287e3f31e8f78bcea0f912dd5d841f70ed7baf39e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          prebuild-test-noop.js

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\prebuild-test-noop.js
          • Size 120B
          • SHA256 9a7b050e26b0ee0076ebebe7b44e779d1b4b90d50331550316b47ba1d82b8cfc
          • MD5 SHA1 SHA512 TLSH

          prebuild-test-noop.js.map

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\dist\prebuild-test-noop.js.map
          • Size 140B
          • SHA256 a4ce7fc9d8cecdaa9e93b6717740e9cf83f5896f0da7d21d74db438dd201a363
          • MD5 SHA1 SHA512 TLSH

          uiohook.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\include\uiohook.h
          • Size 17KB
          • SHA256 f752d74b8572e1fb833a9440341a45a4c4364a354fe627f6f645b959cd897b86
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_helper.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\input_helper.c
          • Size 31KB
          • SHA256 b0bf7ad4231638589ac96454044a8ec2cd545df152613c0475ac68a9abf54780
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_helper.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\input_helper.h
          • Size 5KB
          • SHA256 93064e88c32ebe57c72b94b3da4015ca940d25c5e2d41568eb7b124c13fc816e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_hook.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\input_hook.c
          • Size 53KB
          • SHA256 58fd4b36ace091559efe8007bdafe26b1a9bab9912c284150cb71d9a4ffb71ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          post_event.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\post_event.c
          • Size 9KB
          • SHA256 6797f21c8dd8f33717f2393d59574551ca9b3fc6fc39c6a4cfdf91a04a1c3ef5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          system_properties.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\darwin\system_properties.c
          • Size 17KB
          • SHA256 4b325656c6319013d04380a52ffa9d1fc57cfde10a90a9fa42dd07bd72fba9fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          logger.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\logger.c
          • Size 1KB
          • SHA256 7c980d3a0590098b682b467a6f789751bc6f30658d9f3a761c280f8c573b258d
          • MD5 SHA1 SHA512 TLSH

          logger.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\logger.h
          • Size 1KB
          • SHA256 60a432037bc5488fb5f82a214315ecb93e24261c81363ce41e973138fa8e2cf7
          • MD5 SHA1 SHA512 TLSH

          input_helper.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\input_helper.c
          • Size 52KB
          • SHA256 e6e7212e87b7796a7d4387728d991c9c3e188f898a7b9efcdcc5c1b13c537b41
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_helper.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\input_helper.h
          • Size 4KB
          • SHA256 05a6728996ca1ad8699b2398b284a11e3749141475d4cb84dd0ac0b124fbc2e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_hook.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\input_hook.c
          • Size 24KB
          • SHA256 ea0e810349be7055e86c183736c5c2692501cfab4b1665698f38066519a0f1ef
          • MD5 SHA1 SHA512 SSDEEP TLSH

          post_event.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\post_event.c
          • Size 8KB
          • SHA256 40119006fd5ed676084cfa5a0a5ff8841ecde15c326917e601513949fbc40c4c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          system_properties.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\windows\system_properties.c
          • Size 6KB
          • SHA256 294dcc832cbb64463fa37e96bf35240a3b9b1814b4dff7d9f79c27c78fad1e3f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_helper.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\input_helper.c
          • Size 125KB
          • SHA256 a540a9b4609cab8db9bd7525a12a3beeb4401e70a49f5e04076cc37c6cec8b16
          • MD5 SHA1 SHA512 SSDEEP TLSH

          input_helper.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\input_helper.h
          • Size 3KB
          • SHA256 4b02b9d69eb7d43b3c9b4db5197c77a36bac50a03c0a7c32abba096bb49c05f8
          • MD5 SHA1 SHA512 TLSH

          input_hook.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\input_hook.c
          • Size 41KB
          • SHA256 fd77ed43059f15c29f9dd14010436ed944b84f1234104b45b70150654d83633f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          post_event.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\post_event.c
          • Size 14KB
          • SHA256 4d37abe0ff1e145b90ae15bdc90339d6268bb77164cbc53214d8c2c0b6948f02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          system_properties.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\libuiohook\src\x11\system_properties.c
          • Size 16KB
          • SHA256 644b6f0f5faf0b948ba6897cd956150579f73dd1940c87ca4fcee9d23dc9e967
          • MD5 SHA1 SHA512 SSDEEP TLSH

          package.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\package.json
          • Size 724B
          • SHA256 250ed80b63037a0ba22327e34e5ff300cd417915ca01c254778bb34acac78cf1
          • MD5 SHA1 SHA512 TLSH

          uiohook-napi.node

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\darwin-arm64\uiohook-napi.node
          • Size 82KB
          • SHA256 f633b05e2065c9075cbe51b052aff6a27361adc1286135b31ecf8bf4bdc4b618
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uiohook-napi.node

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\darwin-x64\uiohook-napi.node
          • Size 57KB
          • SHA256 dae66747946c6be45f67fd1b0ae9fced492ded1d170c1971fa4baea78cdadd3c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uiohook-napi.node

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\linux-x64\uiohook-napi.node
          • Size 68KB
          • SHA256 8725ed2668b6f48e711ed8bb861106bc3b77eebddd76d02226f2c6e8704b687c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uiohook-napi.node

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\win32-arm64\uiohook-napi.node
          • Size 168KB
          • SHA256 0965d13d5e8e92c4e34aeb82e8c425ec1f11997c443614cb96dd5b2747599a42
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uiohook-napi.node

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\prebuilds\win32-x64\uiohook-napi.node
          • Size 169KB
          • SHA256 ee68f046628d2e4406d8aa85c6489ad06578b64a0e19ed64822bd22e7c473b85
          • MD5 SHA1 SHA512 SSDEEP TLSH

          addon.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\addon.c
          • Size 13KB
          • SHA256 e8fbce3d54ecb92cd908832b2c12b5aa2625c62af7566e6f2b01fe3599f63a47
          • MD5 SHA1 SHA512 SSDEEP TLSH

          napi_helpers.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\napi_helpers.c
          • Size 1KB
          • SHA256 04a8f6de366c6f82df91a90b07b8ebc009efc3a5ace2881b86cdc40e69625bea
          • MD5 SHA1 SHA512 TLSH

          napi_helpers.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\napi_helpers.h
          • Size 2KB
          • SHA256 a3fb38e83a34d7978eb700ceee527c6b1e5f1b89cd21e25fc516cfbb08aa7cd8
          • MD5 SHA1 SHA512 TLSH

          uiohook_worker.c

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\uiohook_worker.c
          • Size 5KB
          • SHA256 29083d26828657f5c2d6f7924ae02cd168a11158ca651e0c13eacd73463256b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uiohook_worker.h

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\app.asar.unpacked\node_modules\uiohook-napi\src\lib\uiohook_worker.h
          • Size 262B
          • SHA256 f4dbc36bbaf5ef04d701365ea7e72a0f02f77537e9f517e6cc65ebc2f2776a0b
          • MD5 SHA1 SHA512 TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\snapshot_blob.bin
          • Size 300KB
          • SHA256 7f80294b63fb7cd63b43be498fcbe1e34bb05a8011cad9514c4eb9b29dfa5336
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\v8_context_snapshot.bin
          • Size 641KB
          • SHA256 0b239cf5ab92a27cfa087b49e6dc943e0c674b62cea643cff2130e1c2f8db31c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\vk_swiftshader.dll
          • Size 5.1MB
          • SHA256 6ff65b7a5faf726cf747eca6d6504e885a70664e37dc5e38e0e0cc68bed3bf6d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\7z-out\vulkan-1.dll
          • Size 935KB
          • SHA256 715dca5af441dc220a61fb0f8e66600dc4f9f63ecc106fa43bc683098e00fff8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SpiderBanner.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\SpiderBanner.dll
          • Size 9KB
          • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nsu5177.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          default.dic

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          Network Persistent State

          • Path C:\Users\Admin\AppData\Roaming\helios\Network\Network Persistent State
          • Size 1KB
          • SHA256 bd5851dbf6bb6ed9d9f332eabf8b4f9734df6f8c7462f7e19c27968bdab63b1e
          • MD5 SHA1 SHA512 TLSH

          Network Persistent State~RFe59a1e3.TMP

          • Path C:\Users\Admin\AppData\Roaming\helios\Network\Network Persistent State~RFe59a1e3.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\helios\Preferences
          • Size 57B
          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
          • MD5 SHA1 SHA512 TLSH

          Preferences~RFe58b3ab.TMP

          • Path C:\Users\Admin\AppData\Roaming\helios\Preferences~RFe58b3ab.TMP
          • Size 86B
          • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
          • MD5 SHA1 SHA512 TLSH

          CURRENT

          • Path C:\Users\Admin\AppData\Roaming\helios\Session Storage\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512

          memory/1460-1091-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1085-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1086-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1087-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1092-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1097-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1096-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1095-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1094-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/1460-1093-0x00000231A2F10000-0x00000231A2F11000-memory.dmp

          memory/3448-908-0x00007FFEF8990000-0x00007FFEF8991000-memory.dmp

          memory/3448-907-0x00007FFEF8130000-0x00007FFEF8131000-memory.dmp