Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2023, 04:24

General

  • Target

    Razer_Synapse_Framework_V1.18.17.22533.exe

  • Size

    53.2MB

  • MD5

    b1a9b88aa04186bc82c531ffd34188d8

  • SHA1

    66ff8b1136c7ade6273f63ae3befa6b810f65998

  • SHA256

    261e91b02c52ad7f228d0af2aae403a694daf312b72c1afa292b2d3bc6a9f7c6

  • SHA512

    b2d4e3ed8402d5fe89a4d61cfa1d866bdbe2fdcda8c00775918d762df261c8905116a8c3e0e2c262ff74a5130553ecc0c3fe4d5a176240ccdf7ea026dd7b66b8

  • SSDEEP

    1572864:Z0pomZnY/0KL709NXHersAUAzJn5nUl2lA4pjs9x:Z0lnY/0Kn0XHRJ45n3lfpjqx

Malware Config

Signatures

  • Detect PureLogs payload 7 IoCs
  • PureLogs

    PureLogs is an infostealer written in C#.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 44 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 63 IoCs
  • Drops file in Windows directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 10 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Razer_Synapse_Framework_V1.18.17.22533.exe
    "C:\Users\Admin\AppData\Local\Temp\Razer_Synapse_Framework_V1.18.17.22533.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:304
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{C8F5DEDB-CEC8-43E5-B980-F4E9E90D94AD}\Razer Synapse 2.0.msi" TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\{C8F5DEDB-CEC8-43E5-B980-F4E9E90D94AD}\1033.MST" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="Razer_Synapse_Framework_V1.18.17.22533.exe"
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
        "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe" -launch
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        • Modifies system certificate store
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2460
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C78E12C089CF745CC1B2A463A85F0338 C
      2⤵
      • Loads dropped DLL
      PID:2680
    • C:\Windows\Installer\MSIF9C.tmp
      "C:\Windows\Installer\MSIF9C.tmp" -rf "C:\ProgramData\Razer\Synapse"
      2⤵
      • Executes dropped EXE
      PID:2496
    • C:\Windows\Installer\MSI19EA.tmp
      "C:\Windows\Installer\MSI19EA.tmp" -rf "C:\ProgramData\Razer\Synapse"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:2124
    • C:\Windows\Installer\MSI2456.tmp
      "C:\Windows\Installer\MSI2456.tmp"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\SysWOW64\regsvr32.exe" /S rzdevinfo.dll
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2568
    • C:\Windows\Installer\MSI2689.tmp
      "C:\Windows\Installer\MSI2689.tmp" /S
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\ProgramData\Razer\Synapse\Devices\SetReg.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:576
        • C:\Windows\SysWOW64\regini.exe
          regini SetReg.txt
          4⤵
            PID:2932
        • C:\ProgramData\Razer\Synapse\Devices\Merger\RazerMerger.exe
          "C:\ProgramData\Razer\Synapse\Devices\Merger\RazerMerger.exe"
          3⤵
          • Executes dropped EXE
          PID:2776
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:2052
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A8" "00000000000005B0"
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:2304

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Config.Msi\f76f72e.rbs

        Filesize

        59KB

        MD5

        ab1c987bc06bc75e96e31519142e3ddb

        SHA1

        69f30dfdeeb886a83e0e3321311230b5d04b8d8d

        SHA256

        c3d5e39475e1d2af1f7edbafd8f7f34777fd8814bc754e568c6141cdd7c36751

        SHA512

        5ca4c01f238ae42a1b0db990c5d9f2c3dfac0d4202788a06434e6795a42faef5d178edeea747f9f77ca419c15a79d6380cc02dbfa3668fcf4739c9dab8337049

      • C:\Program Files (x86)\Razer\Synapse\Ionic.Zip.dll

        Filesize

        451KB

        MD5

        6ded8fcbf5f1d9e422b327ca51625e24

        SHA1

        8a1140cebc39f6994eef7e8de4627fb7b72a2dd9

        SHA256

        3b3e541682e48f3fd2872f85a06278da2f3e7877ee956da89b90d732a1eaa0bd

        SHA512

        bda3a65133b7b1e2765c7d07c7da5103292b3c4c2f0673640428b3e7e8637b11539f06c330ab5d0ba6e2274bd2dcd2c50312be6579e75c4008ff5ae7dae34ce4

      • C:\Program Files (x86)\Razer\Synapse\RzCommon.dll

        Filesize

        110KB

        MD5

        1619e5994e2c0a8bf6c03700e782f69b

        SHA1

        fa5978b94ec8a44807e0cfd59248cc45e3281c63

        SHA256

        b58575cd4fc9e45bfbfcba4d8051e50fb51f8446ab7e1e57206558da7a80c334

        SHA512

        98814869b593ea1046bb7c459d30618672d1d87ac3764293e247df1507d854bac236cc041d74850b30588b0fdcf31af4be09b94f76c0cc9b0127175b316e8329

      • C:\Program Files (x86)\Razer\Synapse\RzStorage.dll

        Filesize

        308KB

        MD5

        430f8e6430db594ddd848a85462148d6

        SHA1

        d8daf565a401778361e9824501aca695d125bb9a

        SHA256

        572fc9f351df9521f9247c220ec231c903a024e665a4a7891cc151c933c8b450

        SHA512

        877f3f21ff7bc675b780a2abcce7b9dc4f41b6bcca4276dd168e7496b957bdcbb7b5c460f54f1649f41a0e1bdf81329813b046ae30ea52c556545baf521374f5

      • C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

        Filesize

        571KB

        MD5

        03e281a271d1dc3ff2ddd9a9c8e33c88

        SHA1

        2c4b15d597eedb79ec2cb31481ddc452c33df7a3

        SHA256

        878e281ce439ccacf4ca9bd8b273b6a9671c46c67469580e4437ae8a9287ab23

        SHA512

        2daade35c33aa3500f1fddc2e3dba93cb10a6367f76b4170226a454da3e95f7a184942501914eda4e94a691eca3dfdcac144ef3e3ac3c2344b5ee4bb54f71318

      • C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

        Filesize

        571KB

        MD5

        03e281a271d1dc3ff2ddd9a9c8e33c88

        SHA1

        2c4b15d597eedb79ec2cb31481ddc452c33df7a3

        SHA256

        878e281ce439ccacf4ca9bd8b273b6a9671c46c67469580e4437ae8a9287ab23

        SHA512

        2daade35c33aa3500f1fddc2e3dba93cb10a6367f76b4170226a454da3e95f7a184942501914eda4e94a691eca3dfdcac144ef3e3ac3c2344b5ee4bb54f71318

      • C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe.config

        Filesize

        3KB

        MD5

        5945e6ac5d0003638a9ef0fee06edad8

        SHA1

        d6ba9ded6e2a49c5bb0953c0e223ed765dd7187e

        SHA256

        8bfda28dac43f224dd060334ac42c1f17c523967c58f3a7a789387af2873afef

        SHA512

        18edc35029bd5b90252704d43bd7fa5cd4ce89a1e8d1f6ac2c337e4a39ca57a8bbb6144e6f1dc171e275e2169bdae13eb5878973137de8528b570ae179fdc806

      • C:\Program Files (x86)\Razer\Synapse\RzSynapseLoginUI.dll

        Filesize

        2.5MB

        MD5

        643726156ad8800849e0905a813f7516

        SHA1

        b7ccc40788116a3f8e2b5c84897966da1fefcfe6

        SHA256

        e6b614c037cdb88e6ce606c6bb40556a09cbd274f59af5730eaddbcadb0315c0

        SHA512

        9b4a22b2d6c15f5427420a77f3bd749eb239bf33c157ce828171dba3ae76567c29b144c1bad276731d68ca079855e683d12a481461b64e441afa03ea023f1277

      • C:\Program Files (x86)\Razer\Synapse\RzTrayMgr.dll

        Filesize

        44KB

        MD5

        44aab7590a0e76379c50a1f6ae4b16f8

        SHA1

        0094e3c7f68009f213d18d5ac86bb79f300597b8

        SHA256

        dbfa085e880f3bb3c202f3895c242bcbe355edbd20f20651b1bdc48f43c981eb

        SHA512

        401c7357f491ba3c4815d8576432ebcc9ff05cd126c22cb958706005d99b5cc84168bea944afd0f6a988d30468b7daaf19704c7ad0ca2df26517386c89cff919

      • C:\Program Files (x86)\Razer\Synapse\RzUpdate.dll

        Filesize

        79KB

        MD5

        3f5159095c9f3bfc67e54c0857282067

        SHA1

        275fe9a08a3549088b49c673b6aa80329dc903a4

        SHA256

        910528664cef416cdb59bb5e040debef3b069fea625a84c8ba0fe150272cfda2

        SHA512

        21dd0c22ca5efa1557a424da1e238710afb63df726f715c9ef4833c9cf236702c366fa180f8bbe1f005964f4ef4b0a9ace0ef61bf17ba473bba851dae865b2c2

      • C:\Program Files (x86)\Razer\Synapse\config.log4net

        Filesize

        869B

        MD5

        4deb7380efea18de30b0cb2d0dd2669e

        SHA1

        5dc4999720bb8cabb36561348fd8db88d14afa33

        SHA256

        29e05e5e9b52d9108fca9a4a2686b8637f61b9ed1785d01dee7edd4606c40211

        SHA512

        6f22ad5eab6e6df8747b31793f8db4dd4ec93188466bd27c25d72ecaaa270a9cd4a084df496c98f94149b1d7148a8b8613d45cadcb6438c00d0756315b3b9f86

      • C:\Program Files (x86)\Razer\Synapse\log4net.dll

        Filesize

        264KB

        MD5

        b89cb7f3f1a1e2807e708f5435deb13d

        SHA1

        82cde65a7514c0e465ee0d505be56c56639ff0b1

        SHA256

        27d26aab42f7cab35bf51d0536c67ed553fc97b670226b868805e7c6927e5c87

        SHA512

        0bd0da0cc01eb62ba1dea21666bccf76db6c7dcb2ddfa608bea61da0ffa230a60a66e91449b2664de006066eb63d26daafb3bf7b932c8a22ccd347dbd707e68b

      • C:\ProgramData\Razer\Synapse\Devices\Merger\RazerMerger.exe

        Filesize

        29KB

        MD5

        78426e40cd34ff3de3c01009e3310d4c

        SHA1

        da8168dfa49824a1020585f54d7c470aac96d7e1

        SHA256

        2382450b16823f4099b85370586b0b1df06b711b3840292e9e3276bb550eb236

        SHA512

        479a22950613498247e1e46c2cd0a45305a8878fcaf3eb9c6ced9835add48caf0816926cba358d75dd16cdd4b97cf0597ec2119ae921e7044103cfb5423dec8b

      • C:\ProgramData\Razer\Synapse\Devices\Merger\RazerMerger.exe

        Filesize

        29KB

        MD5

        78426e40cd34ff3de3c01009e3310d4c

        SHA1

        da8168dfa49824a1020585f54d7c470aac96d7e1

        SHA256

        2382450b16823f4099b85370586b0b1df06b711b3840292e9e3276bb550eb236

        SHA512

        479a22950613498247e1e46c2cd0a45305a8878fcaf3eb9c6ced9835add48caf0816926cba358d75dd16cdd4b97cf0597ec2119ae921e7044103cfb5423dec8b

      • C:\ProgramData\Razer\Synapse\Devices\SetReg.bat

        Filesize

        51B

        MD5

        febaf310f2e4dc139090aab42b8cd922

        SHA1

        f51dda3b309e28fd72a8c87f0f7a7bf81187a36d

        SHA256

        e2f8ab5ac87828d8a841185ad3c632d13588a3cb7c8fe6a0fb5d6fa81b8b7a65

        SHA512

        ae025128d940df57d1a3ed64886707e562ef46bbac81eac0b898fa35b8c86aecbc687b58afc32615031c45977ff6966cd0d95da9486946536ade00af5a9b2834

      • C:\ProgramData\Razer\Synapse\Devices\SetReg.bat

        Filesize

        51B

        MD5

        febaf310f2e4dc139090aab42b8cd922

        SHA1

        f51dda3b309e28fd72a8c87f0f7a7bf81187a36d

        SHA256

        e2f8ab5ac87828d8a841185ad3c632d13588a3cb7c8fe6a0fb5d6fa81b8b7a65

        SHA512

        ae025128d940df57d1a3ed64886707e562ef46bbac81eac0b898fa35b8c86aecbc687b58afc32615031c45977ff6966cd0d95da9486946536ade00af5a9b2834

      • C:\ProgramData\Razer\Synapse\Devices\SetReg.txt

        Filesize

        96B

        MD5

        394b528b2fec22f1d4dc7657e0b038cb

        SHA1

        a9580e5e642845c640b6b37415a92eaf30885b72

        SHA256

        be5e6258c44a29ab8015f3f92b4103f6566e5d5cfb27da7a3bf4e1aa6604ba20

        SHA512

        5499dd82807ddfe77d3868f29f95a81cbf22b8b38a96d5e1b8eef228d3b729b4d2347f15433c58585cc215c1b1e09ed9b998f05cb5add6a7bc1f1c1eb19e2911

      • C:\ProgramData\Razer\Synapse\Devices\skins\RAZER11_BW2_Selector.png

        Filesize

        171KB

        MD5

        f2e5520c0d36b4861a6843608908d0e6

        SHA1

        1b81fe40734e54b9ed54ae27691d7c27a1f97319

        SHA256

        2c2ff837a416895be1d97f204a0f5048210b38a4c03122b1889ba0e1cc503c3f

        SHA512

        23c50a0eea31ea8c5dcf5be3504b770f151a6ecd32bcb862326ad4c662b262450f778f952d5a9068f9e158232b7217c2db2f0e04c100f26d5503243a85f5d7b5

      • C:\ProgramData\Razer\Synapse\Devices\skins\RAZER11_NOSTROMO_Selector.png

        Filesize

        171KB

        MD5

        7590146fe05b8cfb0d400fcc297606b6

        SHA1

        8551aac517611c8e1d2bdd124ee54cece8aefcd9

        SHA256

        0aa28f6f7f3c74c7ccafce1f3d5db82ccacc11dd92c502c28e7cb6dc6ac4758a

        SHA512

        52b8541ef810888bead43a4f40abb77df5f1b4e725ded015a3af2ed354786422a64dfddfa7f2b30d57581a20be6c9beca1447a9f50d5cfd8e0d982eb5151b89d

      • C:\ProgramData\Razer\Synapse\Devices\skins\VAD_speaker_F_mask.png

        Filesize

        201B

        MD5

        ec2c19f2b6294cf78f7d9267b6c8ea4a

        SHA1

        d3e97d2c4407ec3e4fb4d96ac9c3c5c7c06a0bff

        SHA256

        ebfc709058e98ac7c7a322ac7cbdbbd4a3b6abbda81d0551410970b354431891

        SHA512

        401196da85651c20965dc49046752a2d411203b8d7c300eb3189322420d0aa7322fbf1696cab187f26cf07b53073a5767a7aee70d37db5596f3ac2ce85cd2abb

      • C:\ProgramData\Razer\Synapse\Logs\Synapse_Admin.log

        Filesize

        2KB

        MD5

        03e35fcea069098be9d8cb92bac23da4

        SHA1

        508bb7f1f3b1aa614046ab50ef0cc2eaef6e2d9f

        SHA256

        826f905d09f482259e9c9ed8a0937dc205e2f5656f74049bb80a7e47ce1ed16a

        SHA512

        b84ed78195f169c112dea5f0d225eaf3e7ffecb831aa9a4c3be45a0a359b9d7855404b79559abe5ef20502197b4c6924c0b0d8ec66d313db708a11f0839a4154

      • C:\ProgramData\Razer\Synapse\Logs\Synapse_Admin.log

        Filesize

        4KB

        MD5

        f03c8dfc88f0fef446051c74df468737

        SHA1

        109768145e6e05b43f02b64f3c30bb8dbb77b632

        SHA256

        f9a3dfcb3f0e8075cfadb73980444b67106158726ef4e9ae2a2a70ddc8047f22

        SHA512

        f6e634182d8cdb2eabca1ec3ec971eacb0f6e90e46be71d516bb1b164bd36cb2985f871a45ce803e2d10d1746bc34f10a28d2ea4bece5fb1de1fb9fa17d77f81

      • C:\ProgramData\Razer\Synapse\Modules\SystemInfo\ModuleInfo.xml

        Filesize

        433B

        MD5

        9f693b81eb90f38fbc1e343178916471

        SHA1

        574c7c68491c7315bf72b4c094a6d419a8586e32

        SHA256

        dbca02960bdc4a23104a6ae174855fa0719afe517e6aad011cd3929aa22561ce

        SHA512

        6dd6c68466caee92da76e5077600a37458f76e19edff5544ebe3e87ccb49c2ce91d36350bb00cb6d54f966bc0a52828a1d72e1ac656831c8724227d3f34ea2c0

      • C:\ProgramData\Razer\Synapse\Modules\SystemInfo\RzSystemInfo.dll

        Filesize

        24KB

        MD5

        980a514a7927a5d97b49f66ae30d6b18

        SHA1

        a5a942a6dc2beecaa59ba041038b8a2de3163c3a

        SHA256

        73c0df65852a4de20ed2d9d6b123ae24f731b861b283bd0b3dc9056ce0d1ed0f

        SHA512

        0f14c28c7a2ed7fe870897f03dde39dacf3675d858bec4a7f6fc96115a76dab9c71033d3e83e6e259b4898a4999be9bc8fe216e20a31d9a2a46a71bf1ada4ea4

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        65KB

        MD5

        ac05d27423a85adc1622c714f2cb6184

        SHA1

        b0fe2b1abddb97837ea0195be70ab2ff14d43198

        SHA256

        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

        SHA512

        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      • C:\Users\Admin\AppData\Local\Razer\Synapse\Accounts\RazerLoginData.xml

        Filesize

        294B

        MD5

        f914beb4b2cbbb0a24772d4294f2d3f9

        SHA1

        8e4d0d6a4ba8681d5c2d339bb8dcbae7783748f2

        SHA256

        ac8c75148aed1737774aa2b8b5421ee2a0274f614ea4997986e587727d0f4332

        SHA512

        0ba2bff2b3b755cc0a1d409b76653fcd236a622bfaa4bfb7a4f6c82fd7a0c7baeec235edc13635f156809ce8abf2f05e99abaf3162694f9637e8caab503d8921

      • C:\Users\Admin\AppData\Local\Temp\MSI79C2.tmp

        Filesize

        122KB

        MD5

        2c65cc2f1516e8eed2f01ee5efa60c93

        SHA1

        fa8ace92bdf6cb522357384b352389d08b0464de

        SHA256

        1af4d7548834c516d02c04e13f446dfb528e01f3352eabe8a6c7528e4caffeca

        SHA512

        f5a55023883795a0c27020ffcf6b4a33c37faefa808e45afbeea1f1b8eb07c4b6a82ef4dfc729d66d8cf93f8f7ffaf3f36e0c7c1cd7cddd76934b23380567f03

      • C:\Users\Admin\AppData\Local\Temp\Tar8750.tmp

        Filesize

        171KB

        MD5

        9c0c641c06238516f27941aa1166d427

        SHA1

        64cd549fb8cf014fcd9312aa7a5b023847b6c977

        SHA256

        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

        SHA512

        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

      • C:\Users\Admin\AppData\Local\Temp\_is55CC.tmp

        Filesize

        1KB

        MD5

        b0840974c25813bb9c98fe6303fda3d7

        SHA1

        174cd7001937313af45c9e9530cf61248ef85d68

        SHA256

        2afa2c4ad2773aaec0c801afcb8a389446c027aa6ad5e4a0f1a2e450265ac1e5

        SHA512

        559c20b4e20160c40990fa501543531a4716534ef81a36d9f8cf8a39c3557f202e2abc889e8a27866121e92e56c6033bf42e388f19def24e7f0de4ede858bd05

      • C:\Users\Admin\AppData\Local\Temp\_is562D..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • C:\Users\Admin\AppData\Local\Temp\nsj2888.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        052a077ee8b519aadbcf29e6b5e710a4

        SHA1

        b3ab29d0ebdbdca63e4dffd2fd2e6b9188ffae4b

        SHA256

        9a1a5c6f598247bfa52624cd793b9ef4fb85863cc9dfd69eb7ef671cacc906c9

        SHA512

        cb11cba331b85122dcc2d57171ce20382af0a9fdf0a85a30155404d975901a313c9285eb9445e51979c6ec8416ccdf97fdeaf1bd2203c9395ad046a385a90009

      • C:\Users\Admin\AppData\Local\Temp\nso259B.tmp\System.dll

        Filesize

        11KB

        MD5

        c17103ae9072a06da581dec998343fc1

        SHA1

        b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

        SHA256

        dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

        SHA512

        d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

      • C:\Users\Admin\AppData\Local\Temp\{C8F5DEDB-CEC8-43E5-B980-F4E9E90D94AD}\0x0409.ini

        Filesize

        21KB

        MD5

        be345d0260ae12c5f2f337b17e07c217

        SHA1

        0976ba0982fe34f1c35a0974f6178e15c238ed7b

        SHA256

        e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

        SHA512

        77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

      • C:\Users\Admin\AppData\Local\Temp\{C8F5DEDB-CEC8-43E5-B980-F4E9E90D94AD}\1033.MST

        Filesize

        20KB

        MD5

        bc91daf38334b54269c35e81feec97e5

        SHA1

        4ceece5e8c59e79327bd8108927c21285657de1f

        SHA256

        d40ebee64c6d32a1facbf79c2f2490fd24cf9910258a5de340bd056ef940687f

        SHA512

        8c9f27dc2d1881e5819ba70549f0221115dc28c6fa0248b09d25f72f1713030e9f3f445ba0bee95260d228522210116b82a51dace90f6b9c477e5902dfbd30f5

      • C:\Users\Admin\AppData\Local\Temp\{C8F5DEDB-CEC8-43E5-B980-F4E9E90D94AD}\Razer Synapse 2.0.msi

        Filesize

        52.6MB

        MD5

        0df259c64db38c32020796c76e233abf

        SHA1

        c828fef27b052f89a43ef8ee2d1bc1adc5ba4fed

        SHA256

        1565f8e9d3542419c1655a07057593639b4f909d7ed26db4ef5de08dce139518

        SHA512

        e8eae9d4b76cb809b616a08f936fd25b130837472f81313c032aceefc68e74db25d9b3c874d00bba83f696996a0ab8dba3f40653dba9e9cd7fb3af490b41d37a

      • C:\Users\Admin\AppData\Local\Temp\{C8F5DEDB-CEC8-43E5-B980-F4E9E90D94AD}\_ISMSIDEL.INI

        Filesize

        20B

        MD5

        db9af7503f195df96593ac42d5519075

        SHA1

        1b487531bad10f77750b8a50aca48593379e5f56

        SHA256

        0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

        SHA512

        6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

      • C:\Users\Admin\AppData\Local\Temp\~55B9.tmp

        Filesize

        6KB

        MD5

        41c2c4d683f4ce58713b58f038e6ebb9

        SHA1

        5465d0eb5cceedadabbf2ef2cafad0278e29dbed

        SHA256

        896996f4b38e883c29e1f81e12ba7594460de61f95a69443687cce6e9c8acc08

        SHA512

        573afb5011b68426aa43a89e83d4f62846eb196d8712b568a99b4d06aa0cb513eab2d0f96dad6d1757240ce684c95a9162052185f8e813dc13cd33fd8161fa15

      • C:\Windows\Installer\MSI19EA.tmp

        Filesize

        31KB

        MD5

        ef7a73791d063c577cc9cd6e584bcd96

        SHA1

        280134bfc5e19ab7d1b848818a4a466660dace20

        SHA256

        555904db79954127733fb69f2dfd2d016911bef20ce7d7615320c864fb7b7d65

        SHA512

        f96ed3cc1f6fa8351eec4eb8f09706a2aef51c00f17a3a3b64db98b760498d768750f38761ec09647f7232ee4599aced65c22cd1ad1a56ed95ff5eaf418d0fb4

      • C:\Windows\Installer\MSI19EA.tmp

        Filesize

        31KB

        MD5

        ef7a73791d063c577cc9cd6e584bcd96

        SHA1

        280134bfc5e19ab7d1b848818a4a466660dace20

        SHA256

        555904db79954127733fb69f2dfd2d016911bef20ce7d7615320c864fb7b7d65

        SHA512

        f96ed3cc1f6fa8351eec4eb8f09706a2aef51c00f17a3a3b64db98b760498d768750f38761ec09647f7232ee4599aced65c22cd1ad1a56ed95ff5eaf418d0fb4

      • C:\Windows\Installer\MSI2456.tmp

        Filesize

        80KB

        MD5

        d7da13c220b21eaad543d90bbd1d1b9c

        SHA1

        dec99fadf104968bd3d61c185478dad8cab26bfd

        SHA256

        9211377dac845cba6d9271d2a4b4adac1d5c9bcf036b7c1ebc227039234df8f9

        SHA512

        fefdac9e91d388348d67705fe2a5782b9eb3e35a01b0a00edbe2a0f54fece30db855e08f396098faeceb068e29e3de3adeefb3bd53fc2d47ce51d06703981687

      • C:\Windows\Installer\MSI2456.tmp

        Filesize

        80KB

        MD5

        d7da13c220b21eaad543d90bbd1d1b9c

        SHA1

        dec99fadf104968bd3d61c185478dad8cab26bfd

        SHA256

        9211377dac845cba6d9271d2a4b4adac1d5c9bcf036b7c1ebc227039234df8f9

        SHA512

        fefdac9e91d388348d67705fe2a5782b9eb3e35a01b0a00edbe2a0f54fece30db855e08f396098faeceb068e29e3de3adeefb3bd53fc2d47ce51d06703981687

      • C:\Windows\Installer\MSI2689.tmp

        Filesize

        43.5MB

        MD5

        e232ea9e638ad97c631513acec01f977

        SHA1

        0807435e2df7deb722d12ef40d50b19f805d1ec0

        SHA256

        5a6ccf2ce051cfca593a0d60269b6c820eaf843965909b8b9b607c04d8ebc44c

        SHA512

        9784c855ea191581368a89a98630f050fcc1029e734c392012c7227cb435bbbbd14a5f2de53ed2314c45cda1400e9ae9b27174915028ac0e0009a2e9f4afba58

      • C:\Windows\Installer\MSI2689.tmp

        Filesize

        43.5MB

        MD5

        e232ea9e638ad97c631513acec01f977

        SHA1

        0807435e2df7deb722d12ef40d50b19f805d1ec0

        SHA256

        5a6ccf2ce051cfca593a0d60269b6c820eaf843965909b8b9b607c04d8ebc44c

        SHA512

        9784c855ea191581368a89a98630f050fcc1029e734c392012c7227cb435bbbbd14a5f2de53ed2314c45cda1400e9ae9b27174915028ac0e0009a2e9f4afba58

      • C:\Windows\Installer\MSIF9C.tmp

        Filesize

        5KB

        MD5

        4a0b41588e26516f010f8de08966823b

        SHA1

        796adfc2bd1d8b8fd978b2a7171649bdba1f4dc4

        SHA256

        b7185f8a715772237806ba3d7b0996eb3ceb86066172dee7fcc277aeb77158f3

        SHA512

        86fe4911293aa13a65d5989c00afea5f91cab2390521baf53d8f3f1fa9149f49f81351082f880ae5fdc734169ae7b37d42dd6e971e24dc28bf4f3a51e7c1b8fc

      • C:\Windows\Installer\MSIF9C.tmp

        Filesize

        5KB

        MD5

        4a0b41588e26516f010f8de08966823b

        SHA1

        796adfc2bd1d8b8fd978b2a7171649bdba1f4dc4

        SHA256

        b7185f8a715772237806ba3d7b0996eb3ceb86066172dee7fcc277aeb77158f3

        SHA512

        86fe4911293aa13a65d5989c00afea5f91cab2390521baf53d8f3f1fa9149f49f81351082f880ae5fdc734169ae7b37d42dd6e971e24dc28bf4f3a51e7c1b8fc

      • C:\Windows\Installer\f76f72b.msi

        Filesize

        52.6MB

        MD5

        0df259c64db38c32020796c76e233abf

        SHA1

        c828fef27b052f89a43ef8ee2d1bc1adc5ba4fed

        SHA256

        1565f8e9d3542419c1655a07057593639b4f909d7ed26db4ef5de08dce139518

        SHA512

        e8eae9d4b76cb809b616a08f936fd25b130837472f81313c032aceefc68e74db25d9b3c874d00bba83f696996a0ab8dba3f40653dba9e9cd7fb3af490b41d37a

      • C:\Windows\Installer\f76f72c.mst

        Filesize

        20KB

        MD5

        bc91daf38334b54269c35e81feec97e5

        SHA1

        4ceece5e8c59e79327bd8108927c21285657de1f

        SHA256

        d40ebee64c6d32a1facbf79c2f2490fd24cf9910258a5de340bd056ef940687f

        SHA512

        8c9f27dc2d1881e5819ba70549f0221115dc28c6fa0248b09d25f72f1713030e9f3f445ba0bee95260d228522210116b82a51dace90f6b9c477e5902dfbd30f5

      • C:\Windows\SysWOW64\rzdevinfo.dll

        Filesize

        87KB

        MD5

        45ccb1638a429c3cb4ce43f5b11a9816

        SHA1

        b19ead5a8c402154e4ec6ec02630881c2b383fc7

        SHA256

        ed4b28e637c7ad4574fe968c879f9eb38e8b8765724fd8cac81b6f8803735b93

        SHA512

        393d8cc78aa81128e4d017189752ecf6ce599c3e233290851846d7474bde137434d6a6dda88a06793965007a9d4f1c8c1d7ed303b5993f4c672af5078448cebc

      • \Program Files (x86)\Razer\Synapse\RzCommon.dll

        Filesize

        110KB

        MD5

        1619e5994e2c0a8bf6c03700e782f69b

        SHA1

        fa5978b94ec8a44807e0cfd59248cc45e3281c63

        SHA256

        b58575cd4fc9e45bfbfcba4d8051e50fb51f8446ab7e1e57206558da7a80c334

        SHA512

        98814869b593ea1046bb7c459d30618672d1d87ac3764293e247df1507d854bac236cc041d74850b30588b0fdcf31af4be09b94f76c0cc9b0127175b316e8329

      • \Program Files (x86)\Razer\Synapse\RzCommon.dll

        Filesize

        110KB

        MD5

        1619e5994e2c0a8bf6c03700e782f69b

        SHA1

        fa5978b94ec8a44807e0cfd59248cc45e3281c63

        SHA256

        b58575cd4fc9e45bfbfcba4d8051e50fb51f8446ab7e1e57206558da7a80c334

        SHA512

        98814869b593ea1046bb7c459d30618672d1d87ac3764293e247df1507d854bac236cc041d74850b30588b0fdcf31af4be09b94f76c0cc9b0127175b316e8329

      • \Program Files (x86)\Razer\Synapse\RzCommon.dll

        Filesize

        110KB

        MD5

        1619e5994e2c0a8bf6c03700e782f69b

        SHA1

        fa5978b94ec8a44807e0cfd59248cc45e3281c63

        SHA256

        b58575cd4fc9e45bfbfcba4d8051e50fb51f8446ab7e1e57206558da7a80c334

        SHA512

        98814869b593ea1046bb7c459d30618672d1d87ac3764293e247df1507d854bac236cc041d74850b30588b0fdcf31af4be09b94f76c0cc9b0127175b316e8329

      • \Program Files (x86)\Razer\Synapse\RzCommon.dll

        Filesize

        110KB

        MD5

        1619e5994e2c0a8bf6c03700e782f69b

        SHA1

        fa5978b94ec8a44807e0cfd59248cc45e3281c63

        SHA256

        b58575cd4fc9e45bfbfcba4d8051e50fb51f8446ab7e1e57206558da7a80c334

        SHA512

        98814869b593ea1046bb7c459d30618672d1d87ac3764293e247df1507d854bac236cc041d74850b30588b0fdcf31af4be09b94f76c0cc9b0127175b316e8329

      • \Program Files (x86)\Razer\Synapse\RzStorage.dll

        Filesize

        308KB

        MD5

        430f8e6430db594ddd848a85462148d6

        SHA1

        d8daf565a401778361e9824501aca695d125bb9a

        SHA256

        572fc9f351df9521f9247c220ec231c903a024e665a4a7891cc151c933c8b450

        SHA512

        877f3f21ff7bc675b780a2abcce7b9dc4f41b6bcca4276dd168e7496b957bdcbb7b5c460f54f1649f41a0e1bdf81329813b046ae30ea52c556545baf521374f5

      • \Program Files (x86)\Razer\Synapse\RzStorage.dll

        Filesize

        308KB

        MD5

        430f8e6430db594ddd848a85462148d6

        SHA1

        d8daf565a401778361e9824501aca695d125bb9a

        SHA256

        572fc9f351df9521f9247c220ec231c903a024e665a4a7891cc151c933c8b450

        SHA512

        877f3f21ff7bc675b780a2abcce7b9dc4f41b6bcca4276dd168e7496b957bdcbb7b5c460f54f1649f41a0e1bdf81329813b046ae30ea52c556545baf521374f5

      • \Program Files (x86)\Razer\Synapse\RzSynapse.exe

        Filesize

        571KB

        MD5

        03e281a271d1dc3ff2ddd9a9c8e33c88

        SHA1

        2c4b15d597eedb79ec2cb31481ddc452c33df7a3

        SHA256

        878e281ce439ccacf4ca9bd8b273b6a9671c46c67469580e4437ae8a9287ab23

        SHA512

        2daade35c33aa3500f1fddc2e3dba93cb10a6367f76b4170226a454da3e95f7a184942501914eda4e94a691eca3dfdcac144ef3e3ac3c2344b5ee4bb54f71318

      • \Program Files (x86)\Razer\Synapse\RzSynapse.exe

        Filesize

        571KB

        MD5

        03e281a271d1dc3ff2ddd9a9c8e33c88

        SHA1

        2c4b15d597eedb79ec2cb31481ddc452c33df7a3

        SHA256

        878e281ce439ccacf4ca9bd8b273b6a9671c46c67469580e4437ae8a9287ab23

        SHA512

        2daade35c33aa3500f1fddc2e3dba93cb10a6367f76b4170226a454da3e95f7a184942501914eda4e94a691eca3dfdcac144ef3e3ac3c2344b5ee4bb54f71318

      • \Program Files (x86)\Razer\Synapse\RzSynapseLoginUI.dll

        Filesize

        2.5MB

        MD5

        643726156ad8800849e0905a813f7516

        SHA1

        b7ccc40788116a3f8e2b5c84897966da1fefcfe6

        SHA256

        e6b614c037cdb88e6ce606c6bb40556a09cbd274f59af5730eaddbcadb0315c0

        SHA512

        9b4a22b2d6c15f5427420a77f3bd749eb239bf33c157ce828171dba3ae76567c29b144c1bad276731d68ca079855e683d12a481461b64e441afa03ea023f1277

      • \Program Files (x86)\Razer\Synapse\RzSynapseLoginUI.dll

        Filesize

        2.5MB

        MD5

        643726156ad8800849e0905a813f7516

        SHA1

        b7ccc40788116a3f8e2b5c84897966da1fefcfe6

        SHA256

        e6b614c037cdb88e6ce606c6bb40556a09cbd274f59af5730eaddbcadb0315c0

        SHA512

        9b4a22b2d6c15f5427420a77f3bd749eb239bf33c157ce828171dba3ae76567c29b144c1bad276731d68ca079855e683d12a481461b64e441afa03ea023f1277

      • \Program Files (x86)\Razer\Synapse\RzTrayMgr.dll

        Filesize

        44KB

        MD5

        44aab7590a0e76379c50a1f6ae4b16f8

        SHA1

        0094e3c7f68009f213d18d5ac86bb79f300597b8

        SHA256

        dbfa085e880f3bb3c202f3895c242bcbe355edbd20f20651b1bdc48f43c981eb

        SHA512

        401c7357f491ba3c4815d8576432ebcc9ff05cd126c22cb958706005d99b5cc84168bea944afd0f6a988d30468b7daaf19704c7ad0ca2df26517386c89cff919

      • \Program Files (x86)\Razer\Synapse\RzTrayMgr.dll

        Filesize

        44KB

        MD5

        44aab7590a0e76379c50a1f6ae4b16f8

        SHA1

        0094e3c7f68009f213d18d5ac86bb79f300597b8

        SHA256

        dbfa085e880f3bb3c202f3895c242bcbe355edbd20f20651b1bdc48f43c981eb

        SHA512

        401c7357f491ba3c4815d8576432ebcc9ff05cd126c22cb958706005d99b5cc84168bea944afd0f6a988d30468b7daaf19704c7ad0ca2df26517386c89cff919

      • \Program Files (x86)\Razer\Synapse\RzUpdate.dll

        Filesize

        79KB

        MD5

        3f5159095c9f3bfc67e54c0857282067

        SHA1

        275fe9a08a3549088b49c673b6aa80329dc903a4

        SHA256

        910528664cef416cdb59bb5e040debef3b069fea625a84c8ba0fe150272cfda2

        SHA512

        21dd0c22ca5efa1557a424da1e238710afb63df726f715c9ef4833c9cf236702c366fa180f8bbe1f005964f4ef4b0a9ace0ef61bf17ba473bba851dae865b2c2

      • \Program Files (x86)\Razer\Synapse\RzUpdate.dll

        Filesize

        79KB

        MD5

        3f5159095c9f3bfc67e54c0857282067

        SHA1

        275fe9a08a3549088b49c673b6aa80329dc903a4

        SHA256

        910528664cef416cdb59bb5e040debef3b069fea625a84c8ba0fe150272cfda2

        SHA512

        21dd0c22ca5efa1557a424da1e238710afb63df726f715c9ef4833c9cf236702c366fa180f8bbe1f005964f4ef4b0a9ace0ef61bf17ba473bba851dae865b2c2

      • \Program Files (x86)\Razer\Synapse\log4net.dll

        Filesize

        264KB

        MD5

        b89cb7f3f1a1e2807e708f5435deb13d

        SHA1

        82cde65a7514c0e465ee0d505be56c56639ff0b1

        SHA256

        27d26aab42f7cab35bf51d0536c67ed553fc97b670226b868805e7c6927e5c87

        SHA512

        0bd0da0cc01eb62ba1dea21666bccf76db6c7dcb2ddfa608bea61da0ffa230a60a66e91449b2664de006066eb63d26daafb3bf7b932c8a22ccd347dbd707e68b

      • \Program Files (x86)\Razer\Synapse\log4net.dll

        Filesize

        264KB

        MD5

        b89cb7f3f1a1e2807e708f5435deb13d

        SHA1

        82cde65a7514c0e465ee0d505be56c56639ff0b1

        SHA256

        27d26aab42f7cab35bf51d0536c67ed553fc97b670226b868805e7c6927e5c87

        SHA512

        0bd0da0cc01eb62ba1dea21666bccf76db6c7dcb2ddfa608bea61da0ffa230a60a66e91449b2664de006066eb63d26daafb3bf7b932c8a22ccd347dbd707e68b

      • \Program Files (x86)\Razer\Synapse\log4net.dll

        Filesize

        264KB

        MD5

        b89cb7f3f1a1e2807e708f5435deb13d

        SHA1

        82cde65a7514c0e465ee0d505be56c56639ff0b1

        SHA256

        27d26aab42f7cab35bf51d0536c67ed553fc97b670226b868805e7c6927e5c87

        SHA512

        0bd0da0cc01eb62ba1dea21666bccf76db6c7dcb2ddfa608bea61da0ffa230a60a66e91449b2664de006066eb63d26daafb3bf7b932c8a22ccd347dbd707e68b

      • \Program Files (x86)\Razer\Synapse\log4net.dll

        Filesize

        264KB

        MD5

        b89cb7f3f1a1e2807e708f5435deb13d

        SHA1

        82cde65a7514c0e465ee0d505be56c56639ff0b1

        SHA256

        27d26aab42f7cab35bf51d0536c67ed553fc97b670226b868805e7c6927e5c87

        SHA512

        0bd0da0cc01eb62ba1dea21666bccf76db6c7dcb2ddfa608bea61da0ffa230a60a66e91449b2664de006066eb63d26daafb3bf7b932c8a22ccd347dbd707e68b

      • \ProgramData\Razer\Synapse\Devices\Merger\RazerMerger.exe

        Filesize

        29KB

        MD5

        78426e40cd34ff3de3c01009e3310d4c

        SHA1

        da8168dfa49824a1020585f54d7c470aac96d7e1

        SHA256

        2382450b16823f4099b85370586b0b1df06b711b3840292e9e3276bb550eb236

        SHA512

        479a22950613498247e1e46c2cd0a45305a8878fcaf3eb9c6ced9835add48caf0816926cba358d75dd16cdd4b97cf0597ec2119ae921e7044103cfb5423dec8b

      • \Users\Admin\AppData\Local\Temp\MSI79C2.tmp

        Filesize

        122KB

        MD5

        2c65cc2f1516e8eed2f01ee5efa60c93

        SHA1

        fa8ace92bdf6cb522357384b352389d08b0464de

        SHA256

        1af4d7548834c516d02c04e13f446dfb528e01f3352eabe8a6c7528e4caffeca

        SHA512

        f5a55023883795a0c27020ffcf6b4a33c37faefa808e45afbeea1f1b8eb07c4b6a82ef4dfc729d66d8cf93f8f7ffaf3f36e0c7c1cd7cddd76934b23380567f03

      • \Users\Admin\AppData\Local\Temp\_is562D..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is562D..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is5739..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is5739..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is5874..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is5874..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is5960..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is5960..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is59FE..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\_is59FE..dll

        Filesize

        2.2MB

        MD5

        0ce4d3bd306da6d1f6f233c403f5b667

        SHA1

        15dd2e31c5e9dc223befc5cfb6ca01737b262412

        SHA256

        6428ad0bd3732a2038cd372a06563e84f33dcdab4e2b203b3f75be678690dcad

        SHA512

        4275103c2148945e0ea7afc666402c3fa37b6443fb298fb40d668269694057b394fc23e1aeac99236e3ffee1a05ecb3ae2d394df9ad219bc7b6bd67412670ae9

      • \Users\Admin\AppData\Local\Temp\nsj2888.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        052a077ee8b519aadbcf29e6b5e710a4

        SHA1

        b3ab29d0ebdbdca63e4dffd2fd2e6b9188ffae4b

        SHA256

        9a1a5c6f598247bfa52624cd793b9ef4fb85863cc9dfd69eb7ef671cacc906c9

        SHA512

        cb11cba331b85122dcc2d57171ce20382af0a9fdf0a85a30155404d975901a313c9285eb9445e51979c6ec8416ccdf97fdeaf1bd2203c9395ad046a385a90009

      • \Users\Admin\AppData\Local\Temp\nsj2888.tmp\nsExec.dll

        Filesize

        6KB

        MD5

        052a077ee8b519aadbcf29e6b5e710a4

        SHA1

        b3ab29d0ebdbdca63e4dffd2fd2e6b9188ffae4b

        SHA256

        9a1a5c6f598247bfa52624cd793b9ef4fb85863cc9dfd69eb7ef671cacc906c9

        SHA512

        cb11cba331b85122dcc2d57171ce20382af0a9fdf0a85a30155404d975901a313c9285eb9445e51979c6ec8416ccdf97fdeaf1bd2203c9395ad046a385a90009

      • \Users\Admin\AppData\Local\Temp\nso259B.tmp\System.dll

        Filesize

        11KB

        MD5

        c17103ae9072a06da581dec998343fc1

        SHA1

        b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

        SHA256

        dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

        SHA512

        d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

      • \Windows\SysWOW64\rzdevinfo.dll

        Filesize

        87KB

        MD5

        45ccb1638a429c3cb4ce43f5b11a9816

        SHA1

        b19ead5a8c402154e4ec6ec02630881c2b383fc7

        SHA256

        ed4b28e637c7ad4574fe968c879f9eb38e8b8765724fd8cac81b6f8803735b93

        SHA512

        393d8cc78aa81128e4d017189752ecf6ce599c3e233290851846d7474bde137434d6a6dda88a06793965007a9d4f1c8c1d7ed303b5993f4c672af5078448cebc

      • memory/2124-342-0x0000000000E90000-0x0000000000E9E000-memory.dmp

        Filesize

        56KB

      • memory/2124-343-0x0000000072580000-0x0000000072C6E000-memory.dmp

        Filesize

        6.9MB

      • memory/2124-371-0x0000000072580000-0x0000000072C6E000-memory.dmp

        Filesize

        6.9MB

      • memory/2460-1239-0x00000000005E0000-0x00000000005FA000-memory.dmp

        Filesize

        104KB

      • memory/2460-1229-0x0000000004840000-0x0000000004880000-memory.dmp

        Filesize

        256KB

      • memory/2460-1243-0x0000000004300000-0x0000000004354000-memory.dmp

        Filesize

        336KB

      • memory/2460-1534-0x0000000004190000-0x000000000419A000-memory.dmp

        Filesize

        40KB

      • memory/2460-1421-0x0000000004840000-0x0000000004880000-memory.dmp

        Filesize

        256KB

      • memory/2460-1226-0x0000000000460000-0x00000000004A6000-memory.dmp

        Filesize

        280KB

      • memory/2460-1221-0x00000000002A0000-0x00000000002C2000-memory.dmp

        Filesize

        136KB

      • memory/2460-1217-0x0000000000C40000-0x0000000000CD2000-memory.dmp

        Filesize

        584KB

      • memory/2460-1425-0x0000000000AF0000-0x0000000000B02000-memory.dmp

        Filesize

        72KB

      • memory/2460-1533-0x0000000004840000-0x0000000004880000-memory.dmp

        Filesize

        256KB

      • memory/2460-1429-0x0000000006AD0000-0x0000000006D4C000-memory.dmp

        Filesize

        2.5MB

      • memory/2460-1532-0x0000000072580000-0x0000000072C6E000-memory.dmp

        Filesize

        6.9MB

      • memory/2460-1463-0x0000000000C10000-0x0000000000C1C000-memory.dmp

        Filesize

        48KB

      • memory/2460-1460-0x0000000004190000-0x000000000419A000-memory.dmp

        Filesize

        40KB

      • memory/2460-1433-0x0000000006090000-0x0000000006108000-memory.dmp

        Filesize

        480KB

      • memory/2460-1443-0x0000000004190000-0x000000000419A000-memory.dmp

        Filesize

        40KB

      • memory/2460-1444-0x0000000004190000-0x000000000419A000-memory.dmp

        Filesize

        40KB

      • memory/2460-1222-0x0000000072580000-0x0000000072C6E000-memory.dmp

        Filesize

        6.9MB

      • memory/2460-1455-0x0000000004840000-0x0000000004880000-memory.dmp

        Filesize

        256KB

      • memory/2460-1458-0x0000000072580000-0x0000000072C6E000-memory.dmp

        Filesize

        6.9MB

      • memory/2460-1459-0x0000000004190000-0x000000000419A000-memory.dmp

        Filesize

        40KB

      • memory/2496-336-0x0000000072C70000-0x000000007335E000-memory.dmp

        Filesize

        6.9MB

      • memory/2496-335-0x0000000072C70000-0x000000007335E000-memory.dmp

        Filesize

        6.9MB

      • memory/2496-334-0x0000000001230000-0x0000000001238000-memory.dmp

        Filesize

        32KB

      • memory/2776-1194-0x0000000072C70000-0x000000007335E000-memory.dmp

        Filesize

        6.9MB

      • memory/2776-1192-0x0000000000D00000-0x0000000000D0E000-memory.dmp

        Filesize

        56KB

      • memory/2776-1193-0x0000000072C70000-0x000000007335E000-memory.dmp

        Filesize

        6.9MB