fef63584edd7821742c7d27e998140e27e70f09fc499cd9f206bd5eb28516c76

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
geohelper.exe
Size 5.5MB
Sample260510-sydaysa16x
SHA256 fef63584edd7821742c7d27e998140e27e70f09fc499cd9f206bd5eb28516c76
MD5 0c46d25e9bd3fabe2d91cf4546c27720
SHA1 57936c3e78f1086a755184f6fa50952d19c1bc2c
SHA512 129bdc9b605cff1405c6b5845235f4c73a23f3c197c51867f32a9ee1a71963a10a71f3a22529bb9b2a0e6767a0b28fd14bdc4a66af67e9acdbf22498a1806da9
SSDEEP 98304:GCnuKXDLkIn/YK8LRKSW0sVvIKsm5a8On+53i:h0sTVvXsrjG3i
TLSH
T1EE466A07F69581E8C09DC078835BA637EB33B88D4921B29F6BE44B122F26F506F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	geohelper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\passwords.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_269106962\crs.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-ES	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_269106962\ct_config.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\male_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\ranked_dicts	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\model.markov	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-NL	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_269106962\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\female_names.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_269106962\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_269106962\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\surnames.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\adblock_snippet.js	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\Part-RU	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\test.txt	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\manifest.fingerprint	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	geohelper.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	geohelper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229007126687957"	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	geohelper.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
760	msedgewebview2.exe
760	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5188	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4748	geohelper.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 5188	4748	geohelper.exe	85
PID 5188 wrote to memory of 5872	5188	msedgewebview2.exe	86
PID 5188 wrote to memory of 3140	5188	msedgewebview2.exe	87
PID 5188 wrote to memory of 3140	5188	msedgewebview2.exe	87
PID 5188 wrote to memory of 3140	5188	msedgewebview2.exe	87
PID 5188 wrote to memory of 3992	5188	msedgewebview2.exe	88
PID 5188 wrote to memory of 3248	5188	msedgewebview2.exe	89
PID 5188 wrote to memory of 3248	5188	msedgewebview2.exe	89
PID 5188 wrote to memory of 4000	5188	msedgewebview2.exe	90
PID 5188 wrote to memory of 4000	5188	msedgewebview2.exe	90
PID 5188 wrote to memory of 4000	5188	msedgewebview2.exe	90
PID 5188 wrote to memory of 5076	5188	msedgewebview2.exe	112
PID 5188 wrote to memory of 5076	5188	msedgewebview2.exe	112
PID 5188 wrote to memory of 228	5188	msedgewebview2.exe	113
PID 5188 wrote to memory of 228	5188	msedgewebview2.exe	113
PID 5188 wrote to memory of 760	5188	msedgewebview2.exe	114
PID 5188 wrote to memory of 6012	5188	msedgewebview2.exe	115
PID 5188 wrote to memory of 6012	5188	msedgewebview2.exe	115

C:\Users\Admin\AppData\Local\Temp\geohelper.exe
"C:\Users\Admin\AppData\Local\Temp\geohelper.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4748.4856.2225341242234833141
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffcbe5ab078,0x7ffcbe5ab084,0x7ffcbe5ab090
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2356,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:8
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4508,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4560,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4612,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView" --webview-exe-name=geohelper.exe --webview-exe-version=0.12.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4176,i,11378737479945618227,13793387213445525781,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
    3⤵
    PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5188_1055872725\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5188_269106962\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

english_wikipedia.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\english_wikipedia.txt
Size 269KB
SHA256 ff105c5b6e65386cd0af95272607eca296c5b8b786c2f0bb4a9ffef20b4cd4f1
MD5 c5b5e739e99f368b294af5d6341d79ab
SHA1 ac32ffdb158540338cee54b3e1c1bcd883b97e99
SHA512 93887a641de44647a191cacdd4b720b4091e4bb5463c0f1ff81bc53b361173b577dcc3717ee9281cf77d27d24576582f89a4008edfd6904e92df32dc8081cc0a
SSDEEP 6144:Uarig5YkFuhe6bke9u8avUdUhWn5dXbcsHqkFnghZwKTZ+oP8:nrd5YkKe+BNavUdUhWn3I+qYngnzx8
TLSH
T14F440A70EA54353BDB9B139F88942F824568D5321F2574A4F69D068A040BFCE877EF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5188_317975767\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3afe70bdcba119a1f7a189ad2e211a3a8f52134679bc016ad12612416d0a31e5
MD5 d3fff23c1276c562b9d2a95da88c9362
SHA1 cbd13dafa942e4216cf02026790871f7a757dea7
SHA512 5eb85e0058d902aed6d968b0f7357f3c6124a19ae381d046a2c3d67a18896b7d7d32579821ee7e171aa4efbd61455a3c3eb62c40b7874820aadd594afdbe043c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a2b2f9c766b65b204c478554b2892448fa675da99d83b761091ccab23ee0ad92
MD5 16690f6eb5e4dbba44f1d0f35e9e7d0f
SHA1 b48abf5e0a51983a42267da71d5afcdc97cfbb9c
SHA512 a63a3103254dd9757f956583a6b536f468eeb4d2500416fcc8fc6fd9ecc471001b378cbb14ef48a7ce5583b1c926c662a122d21edfa92df2f95567629c028e02
TLSH
T122D0123277410134C01025373402A2280841D10B400D4204D82BD65E1A042D01943486
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a7ff61028523491c5f5db7dcf7b9b80d5f1df41e7cc12aab2e262f09e1412b7b
MD5 3fa696a58108eb32e4f28cdd1254a075
SHA1 bcf43ae0e8799db25065b51dec9836677ab441d9
SHA512 b9f63f3968dfb47df49b33c28f148e9cee048b7b17a1c08f4e0b4e00c29a781ee7517527f353325420cac0af3f3825cdc86f9f8b0c63e87529dbdde3a1ceb454
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 517a91429b86649f120e3aaafa907e4a2f4d3a680ab316f7d81ec91c73bfdb87
MD5 0e185a3556d36c100158895d60bfa7d3
SHA1 624be426f060c75f5f61c368bb1749b3a77b9c61
SHA512 b960ff87be99cac0b9260d3ce091b4aa4e5669c6bd17b32c8409d61c734e881bddbe81dee42a0e76977164658f382277a2d1065d795ff049397e26f5cc9fc00a
TLSH
T111A002A44649B002C2900B73D4C2C981363C5C1047030B0A4295B164DB55B4886C114F
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Network\Network Persistent State
Size 364B
SHA256 af5de44c7b4ae68f35b251ffb1b43eeab50515143c1a6c328a4caae6da289306
MD5 ab42f2e286c3581d3b7b2f0b61576037
SHA1 2d82a11b387e682f26bb6ce6d64cb578692cb1ac
SHA512 c964c908294e8858ba270038c44767506193d472b813c108f98d5d6ea5fe9672f4bf6a21fc28dee5721013959353ef6c5a28be779cfdc837e6766018c346b1eb
TLSH
T1D6E0CA66C2D0857E474003A126242E53C63D0406921C5E16DED5777D57D1478D12044F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5972a6.TMP

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Network\Network Persistent State~RFe5972a6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 3a2a9eef8181aed63ae09ff5e83892d7272602c90064906d804c7aed3c44bb12
MD5 e4cd0da9c0b15639e1b0eb8e048529b3
SHA1 069697d8e4cea3b511702751c283be960b08ffdc
SHA512 f090875e59f0ddd35797b44edeb0bb7653d5772fb3b2b50d0cd54f0cd133751c14f88f61021faad9f8d44c442b4be42946b9f54cd54dc48ee2379812a36ce4ea
SSDEEP 192:stZ0dKtfBZ8pap+G/S+WiTdnx3wdcbnjMC:stKdKt8yz/Vpx3w4gC
TLSH
T1A2D18702AE686DB78CC7F6197E35BB12E2F5106362D50E58ABFC861C05DA6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f9bd.TMP

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Preferences~RFe58f9bd.TMP
Size 6KB
SHA256 f746979d77d47b6494c55a214738f56b68e0a59a1cd78d65303b4930392da0de
MD5 9a5251a4d9c654faa38f61fbe8e01ba2
SHA1 35dce08a1be244eb779350522b9f690add6f5724
SHA512 57f3458f4244493fc48e868533502d0ed1ecb59595d14599d66ae75e4adfce87f39dcca472ab1f06c85d795e3c2d1147083b6f416ca4bc4fd7673bc99fe925e0
SSDEEP 192:stZ0dKvfBZ8pap+G/S+WiTdnx3wdcbpjM8:stKdKv8yz/Vpx3w4K8
TLSH
T10FD19702AF686D778CC7E619BE35BB12D2F5106262D50E58EBFC861C08DA6DD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Local State
Size 1KB
SHA256 6a286b0a4220b6e0eff5a1a0314512259d42d91b68e35fe9f75b5d08fe022ed8
MD5 85943ba25276b0fb45af6e5373251727
SHA1 0cb4e9a081d71fe53794c596cb0e2040ba5d3efc
SHA512 ebf183ec0fff9fc2b593c66645d102524234a6f110c09992f2cc7e8c8c99b46f0c1cb39bfceee258a66610daae1ea3c2b4305a83dc5311d9475d6683aa57d413
TLSH
T13B316073A4A02F73DDD2A54376532AA72D3141AAC2404E88A2DD0B0C02DF2EC6622C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Local State
Size 2KB
SHA256 26d1f4b04b5c7a05adea01af553717503ef2213390537dc3f7cba6c3cdbd552f
MD5 f0a9218117d4820992944c51296bda29
SHA1 044ff8e4c1a3937db036f5ddf9f7cd117eff6ead
SHA512 c6fa0bb5ea181b64dad0393a14405b68a678073e498a581177e7b22922b37a251502c9fb961450098505fd87e1d24bddccfa9510521135dfc3ebbb82acc747cc
TLSH
T15C518473B8545B77CDE39945794A3F23A93651A686512FA095DD0B0C01DF2AC3302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Local State
Size 3KB
SHA256 5bcd3fce41e4859386dcd80cab6d3e11f9988476085e59cc8a3c2bd40c2baef0
MD5 abb2954275d33587e9d9b4bfb77db858
SHA1 66fe35adb034b5e1f7b76559a233f39c32c360e1
SHA512 e8b2331e5545caa0a385a5fcf1f00b70f9c58155b54e73274098163cfea195108cec551954fca583e4457e9d145b30537679d0bd0f01488471b6d29ee5cfe96a
TLSH
T14D719533A864AA778EE3D902B9862B16B6A54167D2903FA4D5EC0F0C01DF3D82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Local State
Size 16KB
SHA256 f9a3a686e14c2a403eb5e49166933a66c2e653b8e05a8349f78ea2ae1938058f
MD5 6468685faeffa983e61e72d3cedf1c61
SHA1 b60b6c50a6fc6d917848e3e9bb72beb3a79b471a
SHA512 c0df9d0980d7d651528cf58a2561323fe39e6eb83e03a5e41ac010448bb91edeed09a377b0acb2267ce01470f4e8aff45250448036c6a1581bafeca52398b1b5
SSDEEP 384:zdvsrvyOiyp4+IWA1eUVWGfvvLhNbLR9Ee7p9cu6T:Z0raxyp4sQe6WGfvLR9H3m
TLSH
T1E6729EB219745A77DDE6AC47BC4B3A177E9990A6C9D02F84A4D96F0E024B2CC2706C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585aec.TMP

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Local State~RFe585aec.TMP
Size 1KB
SHA256 06e9cc0bd7c75973230956ffbe61f37a17a6d295b580cc1ecbb614a31c551c2a
MD5 24389fdb8c823b3b5d34c08b88478ee6
SHA1 831e215ba1d2eefbd2595cc1b2a4d8a1099629f7
SHA512 826222c89cfe05fa63acc825410d52a8f2284c9ca16dcd94b87809f2132141cc64b4c45285146bdf43234cb685fc9e2e4307ca37f939045b9b90772e810e94b7
TLSH
T10E211033D4A42A77EED2A552B6537A972D7141AA82504B48A1DD070C029F5E86672C33
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\dev.geohelper.desktop\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-507-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-505-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-510-0x000001C78D310000-0x000001C78D365000-memory.dmp

Download

memory/760-504-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-508-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-509-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-506-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-499-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-498-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-497-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/760-503-0x000001C78D650000-0x000001C78D651000-memory.dmp

Download

memory/3140-25-0x00007FFCDA4E0000-0x00007FFCDA4E1000-memory.dmp

Download

memory/3248-50-0x00007FFCD9320000-0x00007FFCD9321000-memory.dmp

Download

memory/3248-51-0x00007FFCD9AB0000-0x00007FFCD9AB1000-memory.dmp

Download

memory/4000-128-0x00007FFCDA4E0000-0x00007FFCDA4E1000-memory.dmp

Download

memory/4000-234-0x000001FA584D0000-0x000001FA5853B000-memory.dmp

Download

memory/4748-212-0x0000021854A70000-0x0000021854AC5000-memory.dmp

Download

memory/5188-213-0x00000285129A0000-0x00000285129F5000-memory.dmp

Download

memory/5188-217-0x000002851BC60000-0x000002851BC9B000-memory.dmp

Download

memory/5188-216-0x000002851BB80000-0x000002851BBA7000-memory.dmp

Download

memory/5188-215-0x0000028514C10000-0x0000028514C1C000-memory.dmp

Download

memory/5188-214-0x0000028514BE0000-0x0000028514C0C000-memory.dmp

Download