9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1

Resubmissions

30/10/2024, 16:26

241030-txqekaymbr 8

09/01/2024, 22:14

240109-15vsksaahp 8

09/01/2024, 22:09

240109-127mzabcf9 7

09/01/2024, 21:52

240109-1q2mksbcb5 7

Analysis

max time kernel
1786s
max time network
1357s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
09/01/2024, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe
Size

5.4MB
MD5

fc5134ba4711406149556e32d47773aa
SHA1

24e23d1ce7273410b778a36aaa8191c3abeedf3e
SHA256

9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1
SHA512

c457b37709914362717b867b88becda3751f2c79ee11a9f6d67a1780308e123a2e2a65ffb5af9431d99f7881a36ae16899d01cfcb8f52a569e3ca69ec78ac965
SSDEEP

98304:wG7cl1155MF19r71Gw5/91TK1IyHZnVD8jSTzpRcUOeCNx1w8vlXWUlCaHKMDqwK:xuQ3j51RK1IyvlvpcestRKMD4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2388	CPUGuardian.exe
4680	InstAct.exe
4760	InstAct.exe
3020	CPUGuardian.exe
1292	updater.exe
1396	CPUGuardian.exe

Loads dropped DLL 61 IoCs

pid	Process
2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe
2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
408	MsiExec.exe
4592	MsiExec.exe
408	MsiExec.exe
2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe
4592	MsiExec.exe
4592	MsiExec.exe
4680	InstAct.exe
4680	InstAct.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
4680	InstAct.exe
4680	InstAct.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
4760	InstAct.exe
4760	InstAct.exe
4760	InstAct.exe
4760	InstAct.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	4300	msiexec.exe
3	4300	msiexec.exe
6	4300	msiexec.exe
7	4300	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	CPUGuardian.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	MsiExec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\F:	CPUGuardian.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\msi.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\dll\msi.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\msi.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\wkernel32.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\DLL\wkernel32.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\tmp\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\tmp\ResourceCleaner.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\dll\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\dll\wntdll.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\symbols\DLL\wkernel32.pdb	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\ResourceCleaner.pdb	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\CPU Guardian\InstAct.exe	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ComponentFactory.Krypton.Toolkit.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\bs-Cyrl-BA\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\th-TH\CPUGuardian.resources.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\CPU Guardian\updater.ini	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Logging.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\th-TH\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\nl\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ru\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\bs-Cyrl-BA\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\he\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\tr-TR\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Setup.dll.config	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\hr-HR\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Uninst000.CA.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\es\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\fr\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\it\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\pt\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sr-Cyrl-RS\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\fil-PH\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ja\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sr-Cyrl-RS\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Helper.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Interop.Shell32.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ar\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ja\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ar\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\da\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sv\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\updater.exe	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\da\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\no\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\tr-TR\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Helper.dll.config	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Interop.IWshRuntimeLibrary.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ru\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\InstAct.exe.config	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sr-Cyrl-RS\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sr-Latn-RS\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\tr-TR\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\es\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\pt\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\ru\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\he\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\hr-HR\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Splash.exe.config	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Uninst000.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\de\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\pt\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Setup.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\Microsoft.Deployment.WindowsInstaller.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sv\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\bs-Latn-BA\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\es\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\bo.dll.config	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe.config	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\fil-PH\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\sr-Latn-RS\Uninst000.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\bs-Latn-BA\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\it\CPUGuardian.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\de\Splash.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\CPU Guardian\nl\Splash.resources.dll	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57ac4d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8FE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD58522B8315A30DC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFB8.tmp	msiexec.exe
File created	C:\Windows\Installer\{87D8CFC2-0E35-4BF0-81BC-C5B3D1652F6D}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5380AE81FBF9B6D5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC841.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{87D8CFC2-0E35-4BF0-81BC-C5B3D1652F6D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID14D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{87D8CFC2-0E35-4BF0-81BC-C5B3D1652F6D}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3F.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ac51.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF21F2550C897D34B1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ac4d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{87D8CFC2-0E35-4BF0-81BC-C5B3D1652F6D}\icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC91E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF891.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1F315CC5BE8EF1E6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID17D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{87D8CFC2-0E35-4BF0-81BC-C5B3D1652F6D}\SystemFoldermsiexec.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\AI_RecycleBin	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AI_RecycleBin	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "7"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6861773b-0000-0000-0000-d01200000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6861773b-0000-0000-0000-f0ff3a000000}	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6861773b-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6861773b-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\AI_RECYCLEBIN\{A71E0C07-F578-4F1B-94E5-A398719E8B41}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AI_RecycleBin\{A71E0C07-F578-4F1B-94E5-A398719E8B41}	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6861773b-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{6861773b-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\ProductIcon = "C:\\Windows\\Installer\\{87D8CFC2-0E35-4BF0-81BC-C5B3D1652F6D}\\icon.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6867B48316010F045B46248378806BA3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\ProductName = "CPU Guardian"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\PackageName = "CPUGuardian.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\CPU Guardian\\CPU Guardian 2.6.1\\install\\1652F6D\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\CPU Guardian\\CPU Guardian 2.6.1\\install\\1652F6D\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CFC8D7853E00FB418CB5C3B1D56F2D6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\Version = "33947649"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CFC8D7853E00FB418CB5C3B1D56F2D6\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\PackageCode = "6E740B912658B6C4BBDEF138DE81424A"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6867B48316010F045B46248378806BA3\2CFC8D7853E00FB418CB5C3B1D56F2D6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CFC8D7853E00FB418CB5C3B1D56F2D6\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4300	msiexec.exe
4300	msiexec.exe
4592	MsiExec.exe
4592	MsiExec.exe
1420	msedge.exe
1420	msedge.exe
4892	msedge.exe
4892	msedge.exe
4692	msedge.exe
4692	msedge.exe
8	identity_helper.exe
8	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	CPUGuardian.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1612	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1612	msiexec.exe
Token: SeSecurityPrivilege	4300	msiexec.exe
Token: SeCreateTokenPrivilege	1612	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1612	msiexec.exe
Token: SeLockMemoryPrivilege	1612	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1612	msiexec.exe
Token: SeMachineAccountPrivilege	1612	msiexec.exe
Token: SeTcbPrivilege	1612	msiexec.exe
Token: SeSecurityPrivilege	1612	msiexec.exe
Token: SeTakeOwnershipPrivilege	1612	msiexec.exe
Token: SeLoadDriverPrivilege	1612	msiexec.exe
Token: SeSystemProfilePrivilege	1612	msiexec.exe
Token: SeSystemtimePrivilege	1612	msiexec.exe
Token: SeProfSingleProcessPrivilege	1612	msiexec.exe
Token: SeIncBasePriorityPrivilege	1612	msiexec.exe
Token: SeCreatePagefilePrivilege	1612	msiexec.exe
Token: SeCreatePermanentPrivilege	1612	msiexec.exe
Token: SeBackupPrivilege	1612	msiexec.exe
Token: SeRestorePrivilege	1612	msiexec.exe
Token: SeShutdownPrivilege	1612	msiexec.exe
Token: SeDebugPrivilege	1612	msiexec.exe
Token: SeAuditPrivilege	1612	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1612	msiexec.exe
Token: SeChangeNotifyPrivilege	1612	msiexec.exe
Token: SeRemoteShutdownPrivilege	1612	msiexec.exe
Token: SeUndockPrivilege	1612	msiexec.exe
Token: SeSyncAgentPrivilege	1612	msiexec.exe
Token: SeEnableDelegationPrivilege	1612	msiexec.exe
Token: SeManageVolumePrivilege	1612	msiexec.exe
Token: SeImpersonatePrivilege	1612	msiexec.exe
Token: SeCreateGlobalPrivilege	1612	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe
Token: SeRestorePrivilege	4300	msiexec.exe
Token: SeTakeOwnershipPrivilege	4300	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
1396	CPUGuardian.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2388	CPUGuardian.exe
2388	CPUGuardian.exe
2388	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
3020	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe
1396	CPUGuardian.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
8	identity_helper.exe
1292	updater.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1612	2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe	79
PID 2352 wrote to memory of 1612	2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe	79
PID 2352 wrote to memory of 1612	2352	9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe	79
PID 4300 wrote to memory of 408	4300	msiexec.exe	86
PID 4300 wrote to memory of 408	4300	msiexec.exe	86
PID 4300 wrote to memory of 408	4300	msiexec.exe	86
PID 4300 wrote to memory of 4592	4300	msiexec.exe	87
PID 4300 wrote to memory of 4592	4300	msiexec.exe	87
PID 4300 wrote to memory of 4592	4300	msiexec.exe	87
PID 4592 wrote to memory of 5112	4592	MsiExec.exe	89
PID 4592 wrote to memory of 5112	4592	MsiExec.exe	89
PID 4592 wrote to memory of 5112	4592	MsiExec.exe	89
PID 4592 wrote to memory of 4268	4592	MsiExec.exe	91
PID 4592 wrote to memory of 4268	4592	MsiExec.exe	91
PID 4592 wrote to memory of 4268	4592	MsiExec.exe	91
PID 4300 wrote to memory of 2388	4300	msiexec.exe	96
PID 4300 wrote to memory of 2388	4300	msiexec.exe	96
PID 4300 wrote to memory of 2388	4300	msiexec.exe	96
PID 4300 wrote to memory of 4680	4300	msiexec.exe	97
PID 4300 wrote to memory of 4680	4300	msiexec.exe	97
PID 4300 wrote to memory of 4680	4300	msiexec.exe	97
PID 4300 wrote to memory of 4760	4300	msiexec.exe	101
PID 4300 wrote to memory of 4760	4300	msiexec.exe	101
PID 4300 wrote to memory of 4760	4300	msiexec.exe	101
PID 3020 wrote to memory of 4892	3020	CPUGuardian.exe	111
PID 3020 wrote to memory of 4892	3020	CPUGuardian.exe	111
PID 4892 wrote to memory of 956	4892	msedge.exe	112
PID 4892 wrote to memory of 956	4892	msedge.exe	112
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114
PID 4892 wrote to memory of 1480	4892	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe
"C:\Users\Admin\AppData\Local\Temp\9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\CPUGuardian.msi" /qn AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\9c1129a7ffa519f670ca67fdec455f2b39a54b00745d06012cccef6e4b5f2ce1.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1612

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D06A620D72A2B3F68D33B7AC5A9B2576
  2⤵
  - Loads dropped DLL
  PID:408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6C0D50D61F68B7D2E8D6E5ED926D4DAA E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{5F1E8410-6081-4BAD-98B8-5F1BCBF99A8D}.bat"
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{5F1E8410-6081-4BAD-98B8-5F1BCBF99A8D}.bat"
    3⤵
    PID:4268
- C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe
  "C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe" true
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2388
- C:\Program Files (x86)\CPU Guardian\InstAct.exe
  "C:\Program Files (x86)\CPU Guardian\InstAct.exe" install 1 0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4680
- C:\Program Files (x86)\CPU Guardian\InstAct.exe
  "C:\Program Files (x86)\CPU Guardian\InstAct.exe" installurl
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4760

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
PID:1932

C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe
"C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http:///
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcbf4a3cb8,0x7ffcbf4a3cc8,0x7ffcbf4a3cd8
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,11426611386132864158,10705938561558280013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http:///
  2⤵
  PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcbf4a3cb8,0x7ffcbf4a3cc8,0x7ffcbf4a3cd8
    3⤵
    PID:2796
- C:\Program Files (x86)\CPU Guardian\updater.exe
  "C:\Program Files (x86)\CPU Guardian\updater.exe" /justcheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1292

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe
"C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57ac50.rbs

Filesize
732KB

MD5
e99e00ab2ab83da64887fd0937be8192

SHA1
643917c791635be8a1ab207a42049ed33e1bb10e

SHA256
1d664ba390cdd0657c9b09035d75b28e5b957f4a2ec5fd28546aa65123f059ab

SHA512
e22bb3becf99852105ac2c994632b0a9445a137a49036f080b5900e9391416a43ea3af9c9afd78e37cd93e83a3faf57fa94ad3d8fbc90ac9f401176b9c361c30

Download Submit
C:\Program Files (x86)\CPU Guardian\CPUGuardian.exe

Filesize
4.9MB

MD5
e6401e23bac056176d4a2497da0f9767

SHA1
0cc148fda90567eb03080647af914c702fc7266f

SHA256
d36125c54ba2df1822f95597323573a8028cd259b1d11c457d538744fb9476ef

SHA512
73e2efe47cad7f19b64e5787fc7770b1e4089a1709f3f6cb1fc19da14c755c591a86001c17694b9adec69580d1622dd4f366b64ed477ad1137200b2ef70db232

Download Submit
C:\Program Files (x86)\CPU Guardian\bo.dll.config

Filesize
227B

MD5
2b501716c1274b0b35543316b410d60c

SHA1
69e370e1522eab2f66ff11238984a3f288eb7a9e

SHA256
b4daa280754f634f0c289eb06538ad00d6f6bff81d48450bfc5d56463b04d382

SHA512
e38523eabe64e4b17cb6d45df7726bdd5b40efc341ef765b56c0b82197581819edec105204d3785bf0f5865cfaa81a23ab03e54b0c2242d1eaa25575254da936

Download Submit
C:\Program Files (x86)\CPU Guardian\updater.ini

Filesize
410B

MD5
f4b6e83d447c62982eccf3fa901516cc

SHA1
e054f7b42271650fd6c84c498b87b03d4e4172da

SHA256
157437b06c27e7b70ec562ab8927c1af91a816bcda348fee6d7a01468f407e4d

SHA512
d7320054bf74ddc0149e050de4cc8ac2480c7c211dcd707341898344e77bfc1f9aafbaf6c461b244783d00fc34e864541a081e156fa268dba8d3d0b577607bd6

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\dcd4q0b2.newcfg

Filesize
455B

MD5
91775721508192c99421f2e4141f4a0e

SHA1
743e69aced7e971288aa9f520166f6a1d00a8a33

SHA256
9f415db60edfb5869016209658ebb15087156b1cd7449f9ca571cead0190b4c1

SHA512
22833c705dd5d2ddb1bdc64914f6179e695269dd3267f34f2e6af94c81207d1fd9fca2502f1bc5d48de695db578afc33a16e940e9d48d466666f3318fd7cd515

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\fenc0zba.newcfg

Filesize
712B

MD5
3e3023cb91c7928bef732a37f72cfc94

SHA1
79a532c457bcbd7e521f270a034060eaf302d7d2

SHA256
a98ea94ab043bc9250910a1882127e50306d0ccf194ec1acb553a6f26d4e3fe0

SHA512
ac2159860c34005d2eeb31dc55bb46dcd302460a0f29e939b3e0abedf191f7b155eff30855eadd6078d97890c64c294a6d025d954c713deb3715d8e0cc776ed3

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\pllynzrw.newcfg

Filesize
584B

MD5
6b0491e45845ce22d1f101442c581d7f

SHA1
b224a76ba2c9a15f8579d8e5fcd9aa22d4b52fba

SHA256
d4aa8312c1d8022760ea48d64035af66c5cf60a61f791604fa54707e87eea3b6

SHA512
0e476510b0dfd35fa5c38994e66dc489e6c13198a40d32ae1c92b5e1d7a98591d0c87f38507a253e8e87088e14362bdf4e342c2e07b30bdeca445949ead15d1a

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\re51bjrw.newcfg

Filesize
967B

MD5
8b1a04ea19aac38ffc88a668e72a8570

SHA1
5cd0df934aec2bf57968cc250d317a6e6a058264

SHA256
2a1c9b960ddee41d83ee85d4ba175117f9917d449a506431aa83a06c1f1a8bd3

SHA512
ca4a845d2914be332d6f3515519dcff75ff10da7fafd89fee772bd60f9144495ca0e01070994f35d4aad4e4b85590d1fdabaa1ec003a8f4db4555e4a0d79ea89

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\tk33djuh.newcfg

Filesize
845B

MD5
25057270047caada794c30c3402d2d2b

SHA1
1cdc36f228812b25fa87a049de875c7bc22c976f

SHA256
730760e689f8646671e75f0d739cd7d33d686095c9a607c65a8dbcc8d501fd1a

SHA512
26213844a78ac2b29c89d2b83805f0c1fda2dd9f1464f1384813b92070f4a8415f48a60bcddfff7746d601db267a805f543e61d5aa303e41c0a7ff98d3ced67a

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\user.config

Filesize
455B

MD5
6a7738aff961ffbc7106de95c5ec0f44

SHA1
1916ace3129265dbdb6778c2a5327903e973c362

SHA256
5e3d694082286a0d19822df45e7e1eb4eface40f0ba05892b65e647393c9f951

SHA512
c1ff7da4da2f2ebaf8be1b8274591bcd8078efeae7033e4593e37d8f55d5f2bcc4c8f4f4d3ee3f0f4e9c88ef58516e8ab94af318a76190348713df4418824119

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\user.config

Filesize
319B

MD5
c3712a40a97b4ca4d23d92e582c3ab19

SHA1
3129333c2c32a7238570e57c348b3e9e9963ca2c

SHA256
e39c48e501f99cf9c50fba3d74c105d55c42fc7666f590532d1bfbb1dfc958dd

SHA512
df184a90728c0f251c10d5db10cdc4f675dcd8e4a67e0d8559e3972084fceb9eb94136427d81ba93f68731ba36cf61eedcd1cba5b2772f6f4f537fc464ef017f

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\user.config

Filesize
844B

MD5
5cf63ed3f988d268c934eb3eaeca089e

SHA1
e8b3d7e284468ca9e480cf239196ab36925a38aa

SHA256
afef20886ecab65a239628e16e6c1cd08721c95ab434ce2106ef946d86d7c8dc

SHA512
fc4e8d048f03bb531b2171eb8cbc9e01ee1dd7972a7e80379de93b8c2f152b4ba0b6dd5348667956aec043f0728406a15058a6b1c990d0858721951a44ad90df

Download Submit
C:\Users\Admin\AppData\Local\CPU_Guardian\CPUGuardian.exe_Url_iwid41inmr3ot3ooc1a1q3rf4b4cgitj\2.6.1.0\vfejskxa.newcfg

Filesize
968B

MD5
8e676114339b10176d77e94d6af0868f

SHA1
496cc75edd366e854cd5073f52d72ab3f39bfe90

SHA256
61b8c0a29c827552a107495a3bf229b2c6ae7e0bf262f6dc55bfe05f05d7b315

SHA512
18444a6a81e60f4a55da880245464a5aa79186f7b7d21e37d87abb03545c59787d94ee1ca51699c574bffa0b23844d499c18c55d642fda191596aaac7e07ba3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92e040d7c1eeb7646714b53e4a95eb91

SHA1
4eaae5706d13b5f0ca9f2e4c994cfca63890dd7d

SHA256
5342d5a6f08451e0f1c54f8e3658dd91eeba2be804f3582ddf8d6a4e2d0c6468

SHA512
e5b4c0ee79b7536679bf2e54f865f91b4957d4f66e498a026b88a6c14a13163f897f54baa9da747c1523eaf20d29cca960b8949a08a7b0ab9b0bbe92478a34f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db6d05b01f1149bf0e70de14f957527b

SHA1
8c27f97d1af20f41b11133443bb413be3879e850

SHA256
c1b1b34b75a96461c26b43c98b57b3b02798475ab7f03ba545538a6f0bebee35

SHA512
afa3a38f81180f74c3f0000d0f3457b207f2fce3ec6e706fee0bb5cdcc570537b42a786aa268ee98b4026ddb6cecb5792c904997c350751a0e5fca94f81a6da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
02f4444bb1df510252eaab2ecdba9ea8

SHA1
91b5ca66a5ea3db3869012f49c822da6d5de4a63

SHA256
8ad293710d86cce349942e83681f8795712c0d563e921738787949cda07d27b2

SHA512
9fb2bbdf122ac34bc9ff1c26b79a4913b2638cbea6628fa14a6b9b9b6a2d5b11e1a2ab77132174c829fe5c9b740093b97addc458291b5f57f239a8a78f7030e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bbcf365b375308aa420865e8d426630b

SHA1
bae9d789be11af580cfd0edabe6eb57d1b05cc7a

SHA256
f9254fd97b9ed1247f5003db5f250bebee529400149997a640bcfa6a91dcb0e8

SHA512
24f7252d05f8d42091a5cb239d285052ae8cea87a873bc4fd3982de8d3f95c2db5d802a4ccbcf0e5e58e27f0576ad7321263f7d01b1aae9551fb4f4f3b7b1e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af895702788e027a5e3654a80061cda8

SHA1
356d276f739b17073036c5840ad4644eeb2516ca

SHA256
9c0ea148383d3ff735eff4645e1e8025a2137afa8c8eee6f90a5f9a3a118cab4

SHA512
cdcad6b71954254516f0f3151ea82f0c50ed9cf56247ed8668ab5de4e4fe4eda9a906bef32acf46930bc55cff4abd926e1633a1922cba159887816926ab00c00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
58e2b179dbb10d049fe23616966bfb2a

SHA1
b4f722b7e798fb6347837b51b05a4314a8219d84

SHA256
cb934e662ce5441a1fec40f63ddb8b828d7cf0f4a532712907064b377d2777c4

SHA512
ef3fbdd259151b0695369fae632106d190d2b9ac20b9854c5d2c23359ffde9469ea1736e7079264fd739ef3a214ac6ac8dbb9ab6c49184e5b5ebf9b8341c0c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
10f8553a37702a9fa278398315fa8ca7

SHA1
9fde99524ee1112d477fe1d8817caaab7c01469b

SHA256
849e03e723c8f84607449747fa9171e996c2cc9491cded41190c0809a33a0d08

SHA512
9ba0f27c26da75f35b70b3cd9520513d428162b4c317f210e8bb7d7f24f1ba843674da2ca1260a5dbeb07c37f7b598c3f9a6838c06a9280d69d971836b243a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2f06056768b5e0f87f8b14483c6bd96b

SHA1
d1d499e34d52adbd6738e0267b6c06b6b3938410

SHA256
714ca881c74eba1bccd601c338614e0fe8b24b42d83b42bc2843e0aec879a5c0

SHA512
1a7f3908b929837bfb5379603a66dde3f522b925d5e46d2ba9733e28c53046eab94ae027dc879666da7752a797e31262c43049e275ae7c1bbaad6bd77a8759c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
644452dbcbc5be02705bac36f4a8e0d8

SHA1
f734e76e74d5c642a44868a9f82d00d799163ecd

SHA256
f4d144cfac5456569f3e8364ef2a668d7863b074ff3257943681fe30b814c68c

SHA512
5d601d94654fffeaa8d8fc7ae7b8dd8075c4174e5c7ea93a7c1198524dde4ca7db7c693fe0e6b4b62e499792ccc29b19fd01c13388383491d0fbade3bbfa9add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_ResourceCleanerLog.txt

Filesize
3KB

MD5
b552d772ee854fa351b3bebeb37d8a2c

SHA1
45ea70744fc4898b5239dd8659374d5ece16556d

SHA256
6a0a2504f176dc7bcab27d297f90c2f0e3c1d1f220d9526ad80794c95e590384

SHA512
cc34377f9de877eab0c8215b4c54d70bfe1d5c6591a891b087ab968c4e95cce0029d26200d4c071a143bb28d014403b91bca883b57ceef2a1020bde8f8db9852

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5F1E8410-6081-4BAD-98B8-5F1BCBF99A8D}.bat

Filesize
90B

MD5
e0f10bc89c698fa252202373500c1460

SHA1
05eceb9eb5bc133c1b146548d76c79478901ae7b

SHA256
5be71fabe028978a05fc12ce8b7727eea3de9ade15846cd4f0418d39d5c42fce

SHA512
d718cf205e24cad3268fb82410e7cc5f71f57c9c9fd3e2edb7d0d1221d9fc16010c7524a1fbc4cef7f8108b43e3c5272006c9932cef0fa3ae4882141a92a258c

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\CPUGuardian.msi

Filesize
1.2MB

MD5
955e3a6f8138f5cffff24ab48109bf5e

SHA1
6bb76d4244d92533a92bd2ffcc3071629408cae8

SHA256
3ba7793a75b91956f9bf347512b16ed79968fb47f4ad18cf0f6aa1efacc50e33

SHA512
d40d85a5719417cbeee2066e0702eff9b7480ba890c56f892a7675764f26063a0cdc061695e6a4f5044e5f2ca2f79f5b52ba97ffb13230cb6e8c86764fd5d78c

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\ComponentFactory.Krypton.Toolkit.dll

Filesize
719KB

MD5
5183596ece306976a669e29f2ff7ad3b

SHA1
56b8ff20b81993acc4d4fef0f7888383a13ded22

SHA256
aedd4d1414202330adb7d28ee7d625310a586bcb8a8b3eed3899e7d2b638f8ed

SHA512
37a9bd7824382419a7fb82032064c266d4b91054dedfe8de3c6d14548989639bc77d9f612d8896914a0c13bf22b81efa65c36e9d707dee8cf01f91546f8625ee

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Helper.dll

Filesize
58KB

MD5
2880c4eccdbce5491ac23d9ac5b45c79

SHA1
ce9376a66620e9e55b2b45b1dfe439b4989a3362

SHA256
23d1cfbb1b628cfb8ead4c452cef6135b1c3053ee6e41f5cfbb66ab49a6d783b

SHA512
887531d74311fb83fbe82af1fd4bc0281f1b5a5d29a2bccfe77a3e855ad2539f61bbd2dafdea14dd44c317b00cb569a2a9ddac1c4f9a9f1367377f100fb35313

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\InstAct.exe

Filesize
15KB

MD5
b0586ee5db1b3b171d28f48af4b5f4cd

SHA1
db47565cec4be55a78aa678e3238ef425acffd50

SHA256
1b8b753dfa929ddd700b3939b1fcf1d53b94e7d8d97c81083aec11ee970d239b

SHA512
9f960c81a953869e78291243690976319b2f72313b0a9dec0341e21e878f7a05e3326d1aedded9b17a8f3e55a6138665edebca671d75a0f418d2fa9615609e60

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Interop.Shell32.dll

Filesize
48KB

MD5
a364f2bbdea952e1479899f32a57ad34

SHA1
1d3603d15dbffd35665253f54becf872aacb84f1

SHA256
9e6ce2ebd72e3bad36710c9b208a658bd8e25c83fa57ebe159152f8e0f774d8e

SHA512
0c755630c22ee7a4ab76070ac568e3b70fd742dbffb3cc8c68cd89f3d6d31c04a18eed6db16785e0d0ac32137862a5d81940888ea64fde3a8364c10228d6cdc5

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Logging.dll

Filesize
8KB

MD5
28b7eb67a7889a46ece863ee6ec6c3bc

SHA1
ba12371be8ce73cf52c3270ca46941b71ff90025

SHA256
b71bed56159a16652075ca90f6c5191b47102c653a2facac7f1823985b141ff6

SHA512
b767676da12d1d8915c956071f81d107c2795add2f8318d7fbe2efe12096612c3d4904f6a4991e1eb1e3170412260226ffbcc4bcaeebc59cdc2ace4f313a15b4

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Microsoft.Deployment.WindowsInstaller.dll

Filesize
180KB

MD5
7d625fe73ab5f25390d5b663b0760bb8

SHA1
5dccf0b59215e47bd477ae563db9fb53fd1970a0

SHA256
20af4ea25c5bfb6cf5ae236d2f213402c6040ebca2e7ab5c0983267d34ca1673

SHA512
a7a12744afb89ff52d7cc5785edc9c42da0c796d3389cd39e7815623d9bdd4735f2410885714bc25e8fdf74e5cba8a1e3e691c0e47b775a2dce05bd0a5662a93

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Microsoft.Win32.TaskScheduler.dll

Filesize
128KB

MD5
b351fdd6ca2b71c9e2310a6e5521d690

SHA1
491538f4f77affa2dbbd8cc5474338abbb895e6d

SHA256
9e21648fbd3e281ff2924904b80f7b9c65b440aef9fecd87d0ca6aabf50e5df4

SHA512
2e3947ad63141b6b92cbd141f889f3a5d104776a93e379ec294b879b510f338641b12e66c3280580db16a945cd5ae57d84649da61947e5572c6c27526dc1dcad

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Setup.dll

Filesize
8KB

MD5
a774435d2c0a7768f4be70b469390b55

SHA1
e0f7ce4e38c5895686cfeff58b4dea58e10233ad

SHA256
3cb9187a144148dc61dd50007dc1e49a4158f01db2557a7e3792b95054da3082

SHA512
11fb6a6262ba6334615bb4c2f0bc5bb455cd03b8354e3f2dedd25aea655cbe8ffa6b7df5b0129b751108d9287be47b3a27b8b421c141d71a3144197121ca1b82

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Splash.exe

Filesize
249KB

MD5
8df371d6c8439aa6225d87ad741c6333

SHA1
230afadb5f2dc84aa7962fa808905efd28b1c21d

SHA256
d8731fa86067ea429244378f81f9dc7e24377f7ef378044d5f46c378424392ae

SHA512
9de82f68cd7430a3ca6cbbd1933e6303ed1497137c08a240e8f6579d4d7dcd56967319525b638cc70f81ce05ef8a3ed4d1a207d4908c17dc5290b19d43479193

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Splash.exe.config

Filesize
230B

MD5
cc5216762e808c8a13b799001fb14d7f

SHA1
d3e0f084903317bd8fa6f2e62746bce3452c5e32

SHA256
a057532608b629756daa45bf136212e2bcc39608213791d5e0dbaf33686eb83a

SHA512
4b4cc1932938762b4e1bd6b8b80c6c4afbf88b37581a92259e570557a33ff001c3a240e89bbdf992338d3c157d0684f346456212567a784055af40ca0070d21d

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Uninst000.CA.dll

Filesize
589KB

MD5
9c8b2eb6e2d8e45fc80116c80a9356a2

SHA1
012b96182d8631d5b10c18382ddb32214e6837da

SHA256
a26695b5929f1e2963c32857e5b7ba2f8c32c22455cf6f803e42b69851f1ae9a

SHA512
ca39c01194fe56c627a4d298f85001968f32c13e1be48630a36ca3b4d6158d941bbe4dfb3e1e1b8fc315aad666998f926d08d5c65970780983daae71fcb2eeec

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\Uninst000.dll

Filesize
270KB

MD5
cbd338291f40c848724e289e1c89b5ed

SHA1
95ff61f915ead00c64b7c71bf084ce9b67c20391

SHA256
983225d7abb49456dab5dc9842ecce4065b4a8c3b4a9e980857bca6cba66ec59

SHA512
bd11299b6fd9da3d8bfb0e46b8b4f0db088655def666f692920da854f467f7b6a0191930678c0096c735eca0c0fcf45c4361cd2033114710bbb9dd651572d4fe

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\ar\Splash.resources.dll

Filesize
5KB

MD5
25b52bf55505b189ffa5ed6dd93cf715

SHA1
cfb36a89678a7c2964e13789b8206d5c8ef1a180

SHA256
955d7172504b8e2a3cee1b6415bef8fdcc144d380a5ccf966cefa3ce6446d937

SHA512
c5b2c6141b8ce3ee349ec843fc3042696d1849882604578ad422e3f9a4990bc94dd3c59805184c2c03128edb0d5339c3f676de950b8478fd0de34781855b2b0a

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\ar\Uninst000.resources.dll

Filesize
7KB

MD5
f6aa66d2f100f44661ba06a27296dcb1

SHA1
b2c0322662cf9ebe90ac4d9e3af538c93e737496

SHA256
64e59c3e98c7e1c596d8fa7fba799c971a51c9697e6103ca8eecf5304eae6c3a

SHA512
ee3857ad4b38f09c4f95d06f4a6159b6a38c805fb0326ca9daf5742675c9021bf7b2dfb1353494f022ef9ff9b5d4e72dc61a430fd9d70fe04beebd0c35697e8d

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\bo.dll

Filesize
8KB

MD5
c57d5679e6a2e2e4b4deb278a1eaf8f4

SHA1
a67de39528104b271531195643fa7cb5243831f3

SHA256
29c716b81ae2b875b772ca6892e3917436d7aab30bb8c8fcc3cd38eb10e42603

SHA512
f1c5afcd424b810d6bdd123b635d976eb4c73fab683b44171d70a87d43e2ea3965c9737f4073e8eeab381f521b3f501e734c84700d2ecd9ca21498225e86decf

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\bs-Cyrl-BA\Splash.resources.dll

Filesize
5KB

MD5
4388d01327e9d1e4b24f083dfeec4ce3

SHA1
977e876838f6960d8d86728a1a61bf1da8629fe8

SHA256
86b1d43f54bf52308f9ec1e636974453e2e1de18dce49fdc2f86180cad5938d1

SHA512
6b166abc1ed290c3bc94268fbe384c5e69c911915cc9cdc3d58aa5739a3e8a9dae09c39f70e14f8fc91fa202bcc69db619af2140d487fe8d008138bda5ac3386

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\bs-Cyrl-BA\Uninst000.resources.dll

Filesize
7KB

MD5
7780e00a60cf36671e45af19984cc9e8

SHA1
629b97953c4480a43af1c99a92e250bc8b91842c

SHA256
5c2f555ead13303430dbeacb02dcd77c5a83fb9aa8eefb895490d2810741ca26

SHA512
7ae0d2345f8f27b6779535ae402cf4546893a455561e9cb2bcd3fe7c362de592973485c15fbfedcceaf46f34786239752ac95e519698681bce6ddb9835393116

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\bs-Latn-BA\Splash.resources.dll

Filesize
5KB

MD5
5ba46b916e39e8c2ed12d24370be7177

SHA1
a9d3589b76f1b8af1ef60a23a8e653f9c81aef0c

SHA256
6685a16c00a4b11107adbe0d2aa79b3298ecf3d100d7577da748da55e0d732b0

SHA512
9e158ea1b787ad373322b50929076ce46e8e9e0ef70e1ce34065dca0a31401ceabb074c84d6fc4cbc742a35607053db73608f89d96e0a63ab426e0b451d8be6d

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\bs-Latn-BA\Uninst000.resources.dll

Filesize
7KB

MD5
91e411aa51bcafcf2ad2318475f21636

SHA1
3f533bcf80efeb0b1f4f630134e8093a51aea0c0

SHA256
4a8797251dd3e3a3e9c2e5c3d8f6c65585f6fe8d8b921b5940cdf36a17328c06

SHA512
2d154f59e7f1a7427723fa1b7a72da27993cff0e45fc12d7bb116afb12d7cf8b25f3258ffdbd91452f1fa8ac8bddc7e0cb64b33fc13bb68c58dfc220f1597838

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\da\Splash.resources.dll

Filesize
5KB

MD5
68b79183233a6c2d19fb606aa49482d6

SHA1
b41005d41ba6ddc888072661b410b23ee17e9233

SHA256
13ba0a16789d435e52df303b1f03373a96c90a15caa3c692b44f50c93fad6529

SHA512
36e8754ebb5ab4e1d95b6154823a3c1b7db55d5b184479c56004cc74c197d381fcbd690b6e72064a91155d959f4d57967023ed1b0493f1b23b9a2d9a262809a2

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\da\Uninst000.resources.dll

Filesize
7KB

MD5
e3d637df0ec98c57fcf706132616e4eb

SHA1
9fc71e5862b20da5d75619ad15679ad394cb8a10

SHA256
f184cf931ab5ac898ef54a5c933f7265becd28557868a0ffd3a5589927bb0901

SHA512
06f5588523209568a78bb73beab6c9c9a24231b2e1f798eda1824879ad63aad08bd44a0385d5bc98b822df829233fef11bd7ee74505f87a190a2a385f7695b16

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\de\Splash.resources.dll

Filesize
5KB

MD5
d58e83f563e2e3dab4ea7e3836ed3b48

SHA1
2e0c5678b1c1a9b2fc156e051b91a0cfcbf07ba1

SHA256
08ebf070f7766323aadedddff748585a9b5bed1b57f109fbfaaab75ff9fee4e1

SHA512
a95206087eadeda4db1108e2a21ec90cbbb1a745503052f3d9c2715e1ff592c7a6bda8433245d8f1c95c770dec948bf7ccfa51208f5c897c7b75838842c169b6

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\de\Uninst000.resources.dll

Filesize
7KB

MD5
842454216446db6c907513f8e60a8338

SHA1
b60e47fc8c361d2274aa02c0bf72136469e777f1

SHA256
8f13e43ddf364efa5a3e6fe515dcc76efbdfdfb16efb210580b16201e242b366

SHA512
4b75d4b2206a1e08efc391b0d629b4fe2f647ee6127dbba1c39af63afa69be8af4d7b3e57e32b69ceb805e48ec12f8353b15703bc3a514830e1d6a4d800081e1

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\es\Splash.resources.dll

Filesize
5KB

MD5
92dffca7da68bdda785b8ed473418c98

SHA1
6eba96893a5ec949640aafce1433a428165a5f3e

SHA256
b555eb57f4905efa8c41dcce27b9b275632ec264bf312ef89d85bc36c3e2d13e

SHA512
5aaf886eab7c763f64c5d92e60b2eea66741f020516372a795c9b1f4f6cc3fd02181a49a2db75faca5ad0126d1a253f07463fecd3a1ae3e4d2a7b1f368cf9654

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\es\Uninst000.resources.dll

Filesize
7KB

MD5
9dd2aa44cb3ce41e4177a2309039f333

SHA1
857bc820ba4bd159fe561f64684a1f83c9b620c5

SHA256
e91e6a08f75da9c00558eb234a91f5b87f48f759bb673138e9312a18ead2f969

SHA512
3e24febf5a4cd923792168471ec13a100c451d580c4df274a5e8f260a09cf243c77bfdf637d2224f97973c1e68f4a575e093888e25cb92a2fbc2c3cf66484efa

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\fil-PH\Splash.resources.dll

Filesize
5KB

MD5
b2590e6421128a931bfb1c8fe4490e27

SHA1
a9e649894b1c905c625d3e729ca3c5d06374fd2f

SHA256
44672b7ae4eaa9826384ecccc2bba501adf3fe3c0c4b893c18d5d48b09b71a9d

SHA512
b18cbe937527258bb2e490c102796238fd72037d1ca1f888e0d5185eb980f69fe4c2fa6415f8ecb63e443a5e78018c67b1fecbeebaee4a3a7a73f3b35555b864

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\fil-PH\Uninst000.resources.dll

Filesize
7KB

MD5
473e378dbb8178cc87cf5aaf5806428e

SHA1
43f383b4ec68fb5b076786f14110900b72a150db

SHA256
ecb7411b6ec421f3d1a249011848f8b186ff4c65940d4ff746f6d0ac66de7826

SHA512
b7ab65ac03084e1d538b530411711b972918a86888a7c2d2994e49dc414a640cbee78c555433a4912220cd34a918351048819453c7f245b330ff80330ea41db8

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\fr\Splash.resources.dll

Filesize
5KB

MD5
7cfa0647bff0d5c32b46351de6a5429e

SHA1
4ad7b3a7028f718595535f97d2e1761fba7eb5ce

SHA256
e3773ce96662882c1601072e72090a4e80976f356c01f1e763bc0ff90c523af5

SHA512
c995b37b5bb8121c06f93f8ffd8532c17cf2ffa1280e48cd3b8586c0c99cca8cb57e50942cb732209b10d78cfb63563e4dce69b90888fa804e9e22782927d39c

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\he\Splash.resources.dll

Filesize
5KB

MD5
5d92c1b07ec32c9a80b0fd560cb1d677

SHA1
bcb3ac48b5cc79b96fabb607392db843611e9f03

SHA256
b24e4d131832b43a165e7408e13a462fce61445ea52adf457dce635b25fbb34f

SHA512
8015ab05fe3d91dfbec83468faa245461237b6e823ccd8d35404f695f2c6256b5db66bd83c71a6cd93bcc7c6c77acb185db2aa47719d479413b0c67fa4ce9109

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\hr-HR\Splash.resources.dll

Filesize
5KB

MD5
a672557ba410f907d3855f7ac8fc2170

SHA1
8a8a406aed928b349c8dc5a100752164ccf92b60

SHA256
1f5f27e759f521715196f5bdb9b527c615cca6b34f97eaa96811dbd7eb6c5ec4

SHA512
3c558f86b8facf10d3b536b922a49057014c2b492f820c16b9d7fca7e7b553da9581ce5a71abe297e14053e1aaa7dd02e1d7679b2fffeef1045a6a679003b284

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\it\Splash.resources.dll

Filesize
5KB

MD5
7d9800dc4070c98011b366cc8678909a

SHA1
d67416e875b59a953347ce727e255d5a195677cb

SHA256
33b7c869131d4526928485de4d35583ca2c1e3e6ecc4884c8e53ce36172135da

SHA512
dd60a119b59301d4b0f192c8f8b474d272c9ec5347de9f267b001351ac3092eceedcec40d0ef1148441f576e8ff744ff1185cb04dc34c0039fc0b4a031f0a293

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\ja\Splash.resources.dll

Filesize
5KB

MD5
f0d9b1401796cfc78f2e88281578b88e

SHA1
8908b6c9b8aaa2087243f809d67174cecc061e8c

SHA256
c0c3d22dec05ad462003f07bac905c94a07be450a84d84f319687b7a4c989b4d

SHA512
a1b4429607842918793a6cddef5b58ccc3dc5daf05c2c3b5b329f7bf9654747a7915f5aafa57bc3d756ceaf253f62dcfe2947f9cc76ec5caf634b3b29acd3ce7

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\nl\Splash.resources.dll

Filesize
5KB

MD5
f11f42363600ec97a28f7cda34cd3d17

SHA1
43c67a53b13ba3e7bd48bc22d85c663f34b92a22

SHA256
6fd0d852a6c75881a9cb892b50108e40686787359733a8ce62e9ca70eea1d76d

SHA512
9b1ba9a28d02b92f4a92f0de980648a726196d62ad14642a5a9e15bb62d6a4b2756e563373516b586c47587429d7f19dfa9347267f4210489b19271ea83738f4

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\no\Splash.resources.dll

Filesize
5KB

MD5
86dfed479dfc45b2823916145dcaa416

SHA1
a5b1783185a3a28361216819afb57f054632e005

SHA256
946ebf7e8616e593bfa935a54524411dff3edb6e7172a0223f85d013a9c3c6f0

SHA512
5bf61bfba7d15a2ece5cf856389a84f19bcebf75b54948682ef8de07b93c4adc622b80e53afefef19ff7a65cde6bc6330aa69a720f3971deef4b11edefcd14e6

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\se-FI\Splash.resources.dll

Filesize
5KB

MD5
91a173b401adb226d0d459aecb7185d6

SHA1
28d8d8dd98b3f1baf7c527a2d3d5d5cb8b70e77e

SHA256
a298b7e2d04b4b56f0eed8ba896f064cea72d9d81b0d5df3c6a7caaa49403cfb

SHA512
59cd3607d6684b8278b29fc75ccbeaf7fea35237fe187edff63171700425d8f999037414b4fd4f69a3232fd5f6a7ec231ae6d1492c50b3c029529c3b21fcbe7c

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\sr-Cyrl-RS\Splash.resources.dll

Filesize
5KB

MD5
cd70d773593c270f0e513aee9bb684d9

SHA1
031c4d1e1971a9fdbc4a8af8e289459fc863366b

SHA256
31b4e37303e012a4d3d44b175b27b910030845c2f138c952b5badaafe59789d4

SHA512
4a8718a89e19c26cd34a246745480769bda42b46183b8f3fa84408025a826e019eb1071d417f27bb55daf68e7700ee9b8dc4cebd0026981075b23c598f27a9e4

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\sr-Latn-RS\Splash.resources.dll

Filesize
5KB

MD5
dbcf2704fb624da8bed5e9f8f5411d7d

SHA1
adfcc4784e8392892aeb630147d01478779b9452

SHA256
48304509f026310a5dc7c78d334b0785fd08f3e2b9c314d179d642581c4ad70a

SHA512
2eb251c61e938521a6d28879c724ce13e329e2fd48ade8f960f134ad48426177cdcd6dac4e6ee6802969d4213d3e714665f1785af202e6091377d7937c2732d6

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\sv\Splash.resources.dll

Filesize
5KB

MD5
2971d47caa85df274b4133d111682f00

SHA1
deaa7a99dc17f4480423e41c4393b594bf66bc2a

SHA256
2bc2986503efbcd0c74ad43109f3b60bf412c53a8c0e578af0c4e585f991f916

SHA512
97f4e146c446efdc110a9b626043ca48854a7c2f2bc59e071bc6c0e32723d3683ffea083994f0b1a8b377991c0d1395eac759f291c3e21a92695b00586bc9e03

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\th-TH\Splash.resources.dll

Filesize
6KB

MD5
4969d48f11e92c1ae109bfcb59d1590b

SHA1
97914e3aa7e397b06ea4c4b3f5ac6cfa94047d13

SHA256
77b59617fdab29cfa36d371ae3e11c2c014bc7751f78bffa9cbfedf5bee34dc2

SHA512
134f1e2f0f36fa71017357e5bb6b697ae23e38601f839749c6cc1a05510fab6c1fb256595d4e7a0f3b53903f66224d3001e0c405df534d5cf995eb12de3c51c0

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\tr-TR\Splash.resources.dll

Filesize
5KB

MD5
5435202b35683f86eb338a24018edb07

SHA1
71d87e1473765492987c70053a8a2400c9db245f

SHA256
3e2fc5979eff712345fd454eec98e2f1c0b09a34a610f5c8e9c5983b42c65e3a

SHA512
cb76d3febd0dbd5d9870658438903a84bfc539b3daa13cd2834c0a9ae5532675538a11f3cc7a6e48fc7502a9a8d5fa310fd162bf7e8b536c17c7db422219a377

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\1652F6D\updater.exe

Filesize
423KB

MD5
55c585039516be3ad631c2c4d7427699

SHA1
31b0c9d42e7919c7801920005c71bf3bb0b8dba5

SHA256
773c09b3dcbd38f08521228d3e0521182ee84e4d8bf22c33f28cc30a0d217f3d

SHA512
72f64f17ff5cdf51ee0116c8fc95c23c2aca5dc360b7abe49108741eee11061320586dddfd478cce75e246c7e91a38419db2b190ee4b0479c59eda9f30bd85e9

Download Submit
C:\Users\Admin\AppData\Roaming\CPU Guardian\CPU Guardian 2.6.1\install\decoder.dll

Filesize
125KB

MD5
e14324092de7df785684c2fc677f0ddf

SHA1
947a50e2d8237df137c78cb329ad2c594a422f94

SHA256
cacb69cc777b1ca7d97e47579f72aa986b2bd307862a722563a9bccffa4dc492

SHA512
2c101de3d99db06911f4ceae588af43cabe8131d0085f9c661987236f210827d1be0dbea0122eec8211b6b79ff793ec94a0346a64949e25ccd8a37dee7474f71

Download Submit
C:\Users\Admin\Documents\CPUGuardian\log.txt

Filesize
7KB

MD5
36e9617953fd0d16b0114d3a3344b70b

SHA1
e6e2110af8ba6288a457e6c423fc4e2ca410092b

SHA256
ef90012908f7365d632d4f9848a797e2eefcc8d10e4595f26360f08f353f1874

SHA512
e236f72c9f149efb9623ef66f6d30a2f8ad9abe9f1787e3e4c40d38f84f60670ef3ba213ca6a6e28899892c6045829078c041bd2966f405cc9da0e37c2f40ff3

Download Submit
C:\Users\Admin\Documents\CPUGuardian\log.txt

Filesize
1KB

MD5
63a988388b3caa50a9c5ce30da2ed82e

SHA1
75d22f6161806a8519adae91fdd0e33758472d6e

SHA256
b4f0b49d288907d0aeef6fc6028c7c46be524149d3d71c019f6dc67183b74e44

SHA512
d3510e4426a8c44187e1e5952ed63bdbafdbc7156b5c7c149e175c52460545e06f2c708646fed8e5c9bfddcf975d2288127781bf6cb7ad129ac320d5e4d14089

Download Submit
C:\Users\Admin\Documents\CPUGuardian\log.txt

Filesize
7KB

MD5
5b1528a9f20ac124e2bbedd82143eb6c

SHA1
6e35202db8202cd734133b57db72cb4e3d16db2e

SHA256
219bed5d86d0c75cc4e6012c7370943fecf83dffc63e20524c2078d08adc3dd6

SHA512
b52730251fcc3feba9b8b01c3ed60abe10f3945205137b71c77ba4351d75a4c7556c62c88813fe16b3c2999318ec993c9f609ff819f2c14e28c0e455d0cbad7c

Download Submit
C:\Windows\Installer\MSIC841.tmp

Filesize
90KB

MD5
61e0d69413e1d3f975d6910fe04cadd8

SHA1
382dc5ab38f75c40430c28affe9146dc583a5909

SHA256
a4d9154276def89a52cfba94aa872c0284a01780d5728a4f57b8b562eaa4a5e0

SHA512
518d04c87818a66825f25d0fd9d79aaf1a6c030b917fb59caed5f7341cfc912b1f635d2544a92dffef04054ef98eba65031978804458ca777d6cc8a6df62e930

Download Submit
C:\Windows\Installer\MSIC8FE.tmp

Filesize
294KB

MD5
36885842c1e86ac026470d3931c1fb16

SHA1
c9264ee7d297d8873651d1b780f2ee40430539c7

SHA256
e760209574843bd3879ff1f631c377df8f4be0a5e2c6c09ffe60c9e52c9a4308

SHA512
c5b831bb08dc9e70e462e6b747fd7be6200a55e51ff4060bc9c4e8f9c0544206194466f9c1e0c3b5a6963b6aee5c9e27f4b968a804fae7339a8334b6f62839c8

Download Submit
C:\Windows\Installer\MSID17D.tmp

Filesize
352KB

MD5
accc5e05c4009b2a44cadf1d093cd07a

SHA1
6b9167b1c61f8dcc9d8ee4dc880f1db90331e89d

SHA256
28d23dfcd76f4b50d5e847b1415a4b193c843bf52b2522a8be83840d77e59d97

SHA512
6cfc01b9abbe4de4cc3afe64aec3bf4ed12f8304cbd6009e39c3301357b26a93ad5a845eef7dba184a3baff3dc8eba664f7ef2d2e8b7f8f0b5f70a5ea54b5b51

Download Submit
C:\Windows\Installer\MSIDE6F.tmp

Filesize
114KB

MD5
df2f203f4d7b1444f7c2a5bd256735d9

SHA1
604dcbf7ee612f2e3af5f78e1f34b45c6b1ae898

SHA256
a4c5b94e72d5b8bd288d3c12afa8ff513565e7043168a5b447d688b0b693fb17

SHA512
252def110c893f22ef52a152e7e1db63b2342158dd34fdfc12c96d21600716da005448e857bf5e5dc295e215017da53f79a1649d2a3aca6a6cbdb34a0372e4ea

Download Submit
F:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
memory/1396-1128-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1133-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1134-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1132-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1131-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1130-0x0000000074390000-0x0000000074B41000-memory.dmp

Filesize
7.7MB

Download
memory/1396-1129-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1119-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1127-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1126-0x0000000005E30000-0x0000000005E40000-memory.dmp

Filesize
64KB

Download
memory/1396-1117-0x0000000074390000-0x0000000074B41000-memory.dmp

Filesize
7.7MB

Download
memory/2352-279-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/2352-0-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/2388-373-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-447-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-360-0x0000000000E70000-0x000000000135A000-memory.dmp

Filesize
4.9MB

Download
memory/2388-637-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/2388-362-0x0000000003710000-0x0000000003718000-memory.dmp

Filesize
32KB

Download
memory/2388-363-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/2388-364-0x0000000006750000-0x0000000006CF6000-memory.dmp

Filesize
5.6MB

Download
memory/2388-370-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-368-0x0000000006D00000-0x0000000006F92000-memory.dmp

Filesize
2.6MB

Download
memory/2388-372-0x0000000007330000-0x000000000733A000-memory.dmp

Filesize
40KB

Download
memory/2388-376-0x0000000008910000-0x0000000008918000-memory.dmp

Filesize
32KB

Download
memory/2388-377-0x00000000095D0000-0x00000000095F6000-memory.dmp

Filesize
152KB

Download
memory/2388-378-0x00000000095A0000-0x00000000095B8000-memory.dmp

Filesize
96KB

Download
memory/2388-624-0x0000000001C90000-0x0000000001CB2000-memory.dmp

Filesize
136KB

Download
memory/2388-380-0x00000000100C0000-0x0000000010417000-memory.dmp

Filesize
3.3MB

Download
memory/2388-392-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-393-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-404-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/2388-405-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-407-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-440-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/2388-606-0x0000000001CE0000-0x0000000001CF0000-memory.dmp

Filesize
64KB

Download
memory/2388-457-0x0000000006260000-0x0000000006270000-memory.dmp

Filesize
64KB

Download
memory/3020-654-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-1116-0x0000000074390000-0x0000000074B41000-memory.dmp

Filesize
7.7MB

Download
memory/3020-638-0x0000000074390000-0x0000000074B41000-memory.dmp

Filesize
7.7MB

Download
memory/3020-640-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-659-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-658-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-641-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-657-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-656-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-655-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-653-0x0000000074390000-0x0000000074B41000-memory.dmp

Filesize
7.7MB

Download
memory/3020-651-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-652-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-647-0x0000000007F00000-0x0000000007F18000-memory.dmp

Filesize
96KB

Download
memory/3020-650-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/3020-649-0x000000000F8B0000-0x000000000FC07000-memory.dmp

Filesize
3.3MB

Download
memory/4680-371-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4680-607-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/4680-369-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/4680-366-0x0000000005470000-0x0000000005502000-memory.dmp

Filesize
584KB

Download
memory/4680-365-0x0000000005070000-0x0000000005078000-memory.dmp

Filesize
32KB

Download
memory/4680-403-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/4680-406-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4680-361-0x0000000004F70000-0x0000000004F86000-memory.dmp

Filesize
88KB

Download
memory/4680-358-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/4680-359-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/4760-608-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download
memory/4760-629-0x00000000728B0000-0x0000000073061000-memory.dmp

Filesize
7.7MB

Download