675735de9883911fbb74cefcebfd1ccab23391ee93dabe6029c560320c47a7d3

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
parentguard.exe
Size 4.3MB
Sample260813-sr2d7sstcx
SHA256 675735de9883911fbb74cefcebfd1ccab23391ee93dabe6029c560320c47a7d3
MD5 e146000dc75ca6904ef81c6db4ebf813
SHA1 30e838776ca3ec1c8e4192f19aa291433a8f8d48
SHA512 1ccb72ba9058a7cae7e5478315a3e6382c1761a768e06e75e04fb0b49c528f6b3eef0c417c00c8c4dbc3c0761f372a1001ffd0f8a3659542c7c38c8def1876cc
SSDEEP 49152:Vu/ddG3GUyjwGArbg+OO2J25m4Pk88w/P0pd/aTVy+Dro0otgMLlC5J7I7pM:AFU3hJ2Jl4M88Xd6y8GgMLlN7p
TLSH
T10B266D03F6A681EDC0AEC175835A5233EB32B889092076AF6BD41B313F56F606F5D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	parentguard.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_300163752\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1845840287\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1845840287\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_1845840287\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_840810014\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_840810014\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_300163752\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3592_300163752\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	msedgewebview2.exe
3312	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3592	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	parentguard.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3592	1680	parentguard.exe	89
PID 3592 wrote to memory of 2080	3592	msedgewebview2.exe	90
PID 3592 wrote to memory of 2404	3592	msedgewebview2.exe	91
PID 3592 wrote to memory of 2404	3592	msedgewebview2.exe	91
PID 3592 wrote to memory of 2404	3592	msedgewebview2.exe	91
PID 3592 wrote to memory of 2404	3592	msedgewebview2.exe	91
PID 3592 wrote to memory of 1720	3592	msedgewebview2.exe	92
PID 3592 wrote to memory of 1508	3592	msedgewebview2.exe	93
PID 3592 wrote to memory of 1508	3592	msedgewebview2.exe	93
PID 3592 wrote to memory of 1508	3592	msedgewebview2.exe	93
PID 3592 wrote to memory of 1476	3592	msedgewebview2.exe	94
PID 3592 wrote to memory of 1476	3592	msedgewebview2.exe	94
PID 3592 wrote to memory of 1476	3592	msedgewebview2.exe	94
PID 3592 wrote to memory of 1476	3592	msedgewebview2.exe	94
PID 3592 wrote to memory of 1476	3592	msedgewebview2.exe	94
PID 3592 wrote to memory of 5176	3592	msedgewebview2.exe	98
PID 3592 wrote to memory of 5176	3592	msedgewebview2.exe	98
PID 3592 wrote to memory of 5176	3592	msedgewebview2.exe	98
PID 3592 wrote to memory of 5828	3592	msedgewebview2.exe	99
PID 3592 wrote to memory of 5828	3592	msedgewebview2.exe	99
PID 3592 wrote to memory of 5828	3592	msedgewebview2.exe	99
PID 3592 wrote to memory of 3312	3592	msedgewebview2.exe	100
PID 3592 wrote to memory of 3868	3592	msedgewebview2.exe	101
PID 3592 wrote to memory of 3868	3592	msedgewebview2.exe	101
PID 3592 wrote to memory of 3868	3592	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\parentguard.exe
"C:\Users\Admin\AppData\Local\Temp\parentguard.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1680.2856.14800978551509517093 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView /prefetch:4 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ff844e55fd8,0x7ff844e55fe4,0x7ff844e55ff0
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1780 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2104 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2484 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3340 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77 /prefetch:1
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4672 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3312
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView" --webview-exe-name=parentguard.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=1776,i,15928129773841992916,9011709487797855109,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:722a52f7d6b01d918f913dc650f829999692ff77
    3⤵
    PID:3868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 66fbe1a7567c60881d6153f2030db498aa55f65c3b0d95c6cb2d0c678ab7638f
MD5 86929d5184678c5478a05daad9f28ca9
SHA1 9e60d93455e06f7625759886c9f320ffdf46ee37
SHA512 4949f1e81e43d398595e56b552b7ac5281d17d74f379d7005687282982da8d982eb3200d4a63e0450a71e0171dd567eff8efedaf71d83fbe4b2a1e08c4366369
TLSH
T1B5D0121A33811134C01030730053615D1501D10BA1164000542ECA5D1A440E00912443
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ec70f343c5e5fa3d4397ba575b9ed9dead7df7b5374c854bb82410572dd75ec9
MD5 37b9be44f5cc903ce1340758a60519e8
SHA1 b2d62c4442e4b6f77881a2716a18f1b1ad606800
SHA512 215be94fc81a7b90caecbf12e0c408cb9f81c22cfc4efd8621c4b8a646975ffcc1dc2883fa06bc425116ebb3ec74f8a544461c75720869869c6b710f83118eba
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 93b6d5dd28edcc6e3818c7073e65b7b79776523708e82759179d2fe8313eae66
MD5 2cf7523e461015418650538d95b7e9ed
SHA1 6c797c29832aa4333c278a8d554fdb4b39d92c4f
SHA512 70be377b50f6fd0ce7e9c69b76a1cf9eb7a1ba59ac21b7422e616ad38cd6701f4a6197236692727974082ea2faa38a362f98e2a2a3e02a608aa706f788c98ff1
TLSH
T1FAA002157944C49ACB0E13B534D14A4073399D68828B975546B405ACD857784518A0E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595a4b.TMP

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595a4b.TMP
Size 48B
SHA256 fd7493ba9b53c3b92bfc1b9e79b38e5c8219c181ce3ac5c2cbb29a7ed7a17530
MD5 5be30163a6cf166f8b5d1a9e5f452b6f
SHA1 49597061c9b95937440a3f3842b3c214ce087135
SHA512 ff46e08fa11284de726bbefe504e0659342c24ff37e1410dfe5336211d146c58605a2da2566b7e481744c6fc05d1fb54d9e35bdcb6dd6df57d91ef9038c1fe59
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 01d3b0f3ca6b1bcdb424d2e1e90cd0d8e11253b62c298676ac00f5451ad0eb84
MD5 d57e60c748130a3f9cdeb30c90d4e618
SHA1 6e30dd27f0d423ee7df6a0e2383a2ee8d455ef28
SHA512 f17df238436bb3466780f86c1a2379f5d2bc76c5c14b1b45cc24a4c6b89fda86b480bfbd969556b657150ad85c99126ff9969cabc4ffe6b5b2c11c8615af62a6
TLSH
T1B001B6A2C3D4C97D4A4117E467343823CD2E041993243D27CDEDEBDA57E1075D11054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Preferences
Size 6KB
SHA256 c295855bcfd382eace91b7b52dbf01c37883e031975628b3ee7bafd8417168ec
MD5 c70ce1bef7779651aa83939cafcd2ab7
SHA1 90763966dac8bd05f0072a216287d12c3b4da888
SHA512 bd5d69d6e1b1ff3d03d9166069b408d5149f06dbf1fdea52e8ae4d1389db0a0ecd328df7181933669833bfe595969ecd660d057b98b7aa740595fa756f37119d
SSDEEP 96:stp/dXRoYb9ekEo5h16Z0jms7/x+6MhmuecJjHfM1ejeQK+gvL28XM1C7K:stN5+nonjmsV+FdjHfMQj8JLG6K
TLSH
T1B3D186019E2879BB4CC7F519BA29BA17E2F560B261D51D58EBF8491C04DA6CC2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Preferences
Size 6KB
SHA256 1e8e836591440dc002d13b34068837cc40118488dc05111488c65fa7a62db263
MD5 7ccfe80bcdd634d03c9c5399f57edf4a
SHA1 b9b82405a2785fc588f117abe97fd94c4eb01310
SHA512 286509c86e5521fa4af0ec5d01d8e8bbf2c6eb4bce72364c2ca14b5615775c49a643fb1d5c733d04d21566a06d264b31171b53567411dea538dad1b782212255
SSDEEP 96:stp/dXRfGYb9ekEo5h16Z0jms7/x+6MhmuecJjHfM1ejeQK+gv128XM1C7K:stN5gnonjmsV+FdjHfMQj8J1G6K
TLSH
T1DBD1A8029E6879BB4CC7F519BA297E13E3F5A0B261D51D58EBF8491C04DB6CC230791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Local State
Size 15KB
SHA256 df70cb99c2c4cda41dff37f7e6484d1f59ce02fd710669b57413823a07ab5651
MD5 fa0ef93a57a36a16cc14643c71a5e079
SHA1 2edb49cb885f8302a6cec06ae23e430a18e357f2
SHA512 3365f9e82f556ee6280ad1ba4845b6f3211b85a20b8341f9c5071271706aff1fca691d99d2d3eaad5b38cfcc74e6cacb4f91abacee223e6f37d92ff9c98dbb82
SSDEEP 384:W+aQikB+z/xvxjg/qhEwNBSgqXe9dX9zP:h/UxvxjgC+vOLXFP
TLSH
T166729E2BD569BE66E9F7E60579490B4BCBB8D4E2918269784DED5F0902C73980302912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Local State
Size 2KB
SHA256 6d0509dcd232b470a59341914b762128ef8278ac3862e1f680751c0a5e3a56e0
MD5 3eea2cc4a0b2f2de5d74bf9e8805602c
SHA1 3c6d7f8cb55d538ac35437ad5259f59c686372dc
SHA512 5af72b1a67c461d5cf5c2cab546206fe2d2d4599de0c5db4b2ef708e52b9f55d28179b1767c05e51e25725e74ca492cd1d133f190a1017988558e0aaded39034
TLSH
T1D9516433A914AB7AC9F25A49B98B3F139BB590E29A511F109ADD0B1801D665D1301C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Local State
Size 3KB
SHA256 dd179d3279a83bce9c45a8d8dae0736940067682f0c57f5949b74e868b6b1752
MD5 3f011153103802f15ba39ac96a4026f0
SHA1 d8af27bdf096fcc2d689a0357bf0668686f38fac
SHA512 f60acdaf2f04871ead741f0e84b682ff82cea80038436227bac89e77aba97d207abee35a15d4076861acaad7354033407c4f8f55f93779956a32a9304af39991
TLSH
T1C3618437A964EA7B8DF39A45B98A3B07A7A59063E5913F54DAEC0F1C01D738D1341C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe590797.TMP

Path C:\Users\Admin\AppData\Local\fr.parentguard.app\EBWebView\Local State~RFe590797.TMP
Size 1KB
SHA256 3b3dd04ed9ac75672038794907db43fffe0919321ccf73d13bba1d31d16863ce
MD5 b34b736d0545d52aacd3300234a9641f
SHA1 607adff597d007da88c6ce05838495e4a9a4c34f
SHA512 0da373da577748d7a66cbd70eeccb62b1a306b74870515714c3733ecd831af397e6fa75263d8f4859f8adef4e25bce4bddf29054a55320ee51a11d7a57f8650e
TLSH
T121218A72D554AB71ECE15746B28B7F4B5FA090F3C2114E0466DE4B1941DA38E5616C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-184-0x000001F1B9170000-0x000001F1B9286000-memory.dmp

Download

memory/1476-62-0x00007FF8664D0000-0x00007FF8664D1000-memory.dmp

Download

memory/2404-197-0x0000020253990000-0x0000020253AA6000-memory.dmp

Download

memory/2404-211-0x0000020253990000-0x0000020253AA6000-memory.dmp

Download

memory/2404-167-0x0000020253990000-0x0000020253AA6000-memory.dmp

Download

memory/2404-332-0x0000020253990000-0x0000020253AA6000-memory.dmp

Download

memory/2404-24-0x00007FF8664D0000-0x00007FF8664D1000-memory.dmp

Download

memory/3312-295-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-289-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-293-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-298-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-296-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-297-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-287-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/3312-294-0x000001DC3DD60000-0x000001DC3DD61000-memory.dmp

Download

memory/5176-253-0x00007FF866BA0000-0x00007FF866BA1000-memory.dmp

Download

memory/5176-254-0x00007FF866050000-0x00007FF866051000-memory.dmp

Download