Edit tour

Windows Analysis Report
RazerLightInstaller.exe

Overview

General Information

Sample name:	RazerLightInstaller.exe
Analysis ID:	1524425
MD5:	d34cb39a1543239d2b96cf1dddcb677c
SHA1:	71eb3fcb2c48e08c23eab6a55c07357e72236011
SHA256:	664fe521a3c14cd0cddc8036efd187aa2aab886adee339a8c4eaad60d304eed8
Infos:

Detection

Score:	26
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Compliance

Score:	49
Range:	0 - 100

Signatures

.NET source code contains potential unpacker

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64

RazerLightInstaller.exe (PID: 3448 cmdline: "C:\Users\user\Desktop\RazerLightInstaller.exe" MD5: D34CB39A1543239D2B96CF1DDDCB677C)

Razer Axon_6828171.exe (PID: 5720 cmdline: "C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh= MD5: CA3F48930FAC6E4993303ED46B654AAE)

Razer Axon_6828171.tmp (PID: 6180 cmdline: "C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp" /SL5="$140246,203648975,1023488,C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh= MD5: E815E3598EC16171A9AEB71715E530CA)

RazerCentral_v7.16.0.695.exe (PID: 2104 cmdline: "C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe" /S MD5: D98EA6EF1E5FA74AA5E91E567F912CAF)

irsetup.exe (PID: 6096 cmdline: MD5: 06A2E5E560C43A75E3FAD213A293329E)

svchost.exe (PID: 2232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Razer\Razer Axon\is-D65RQ.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Services\Razer Central\NotificationCore.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Axon\is-AF1UQ.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Services\Razer Central\AccountManager.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Axon\is-80VM3.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Services\Razer Central\CommonInternal.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Axon\Manifest\is-4JIJ0.tmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
C:\Program Files (x86)\Razer\Razer Services\Razer Central\SteamKit2.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Services\Razer Central\UpdateManager.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer.RazerInstallerUtility.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Program Files (x86)\Razer\Razer Axon\is-S6ACT.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 6 entries

Sigma Signatures

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2232, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: RazerLightInstaller.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-02 #001.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\RC\RzRC_install.log

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.Apache2.0.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.avro.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.bzip2.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.cefsharp.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.ionc.zip.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.zlib.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.NotifyIcon.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.BouncyCastle.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.jose-jwt.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.WebSocketSharp.txt

PE / OLE file has a valid certificate

Source: RazerLightInstaller.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: RazerLightInstaller.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: C:\projects\cefsharp\CefSharp.Wpf\obj\Release\net462\CefSharp.Wpf.pdb source: irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: irsetup.exe, 00000009.00000003.4093746530.000000000472E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\sourcetree\Cortex PC 10 Toolkits\RazerCortexInstallerLib\Release\RazerCortexInstallerLib.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4636710184.000000006C1FC000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\Kinesis\obj\AWSSDK.Kinesis.Net45\Release\net45\AWSSDK.Kinesis.pdb source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\RazerDev\AxonInstaller\IronSourceReporter\IronSourceReporter\obj\Release\RazerAxonISReporter.pdb4! source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: irsetup.exe, 00000009.00000003.4093746530.000000000472E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Reactive.pdb source: irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\RazerDev\AxonInstaller\IronSourceReporter\IronSourceReporter\obj\Release\RazerAxonISReporter.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\Kinesis\obj\AWSSDK.Kinesis.Net45\Release\net45\AWSSDK.Kinesis.pdbSHA256 source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: `OTHER`TEMP`PACKED<%s return value>hlslFlagshlslTargethlslEntryhlslDefinesinternal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: irsetup.exe, 00000009.00000003.4093746530.000000000472E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: irsetup.exe, 00000009.00000003.4430846778.000000000472C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\RazerDev\AxonInstaller\IronSourceReporter\RazerLightInstaller\bin\Release\RazerLightInstaller.pdb source: RazerLightInstaller.exe, 00000000.00000000.2113547278.0000000000142000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: WebView2Loader.dll.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005D80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\internal\OSExtensions\obj\Release\net462\OSExtensions.pdb source: irsetup.exe, 00000009.00000003.4435339356.0000000004727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256^Y source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\FastSerialization\obj\Release\net462\Microsoft.Diagnostics.FastSerialization.pdb source: irsetup.exe, 00000009.00000003.4434593093.0000000004721000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\internal\OSExtensions\obj\Release\net462\OSExtensions.pdbSHA256 source: irsetup.exe, 00000009.00000003.4435339356.0000000004727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Reactive.pdbSHA256?, source: irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp

Spreading

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Axon\is-D65RQ.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Services\Razer Central\NotificationCore.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Axon\is-AF1UQ.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Services\Razer Central\AccountManager.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Axon\is-80VM3.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Services\Razer Central\CommonInternal.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Services\Razer Central\SteamKit2.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Services\Razer Central\UpdateManager.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer.RazerInstallerUtility.dll, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Razer\Razer Axon\is-S6ACT.tmp, type: DROPPED

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 2.19.126.142 2.19.126.142
Source: Joe Sandbox View	IP Address: 184.28.90.27 184.28.90.27

Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: &https://www.facebook.com/sharer.php?u= equals www.facebook.com (Facebook)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 0https://www.youtube.com/Razer?sub_confirmation=1k equals www.youtube.com (Youtube)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/razer equals www.facebook.com (Facebook)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/razerk equals www.facebook.com (Facebook)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/sharer.php?u= equals www.facebook.com (Facebook)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Razer?sub_confirmation=1k equals www.youtube.com (Youtube)

Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axon-api-170674789.us-east-1.elb.amazonaws.com
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axon-api-170674789.us-east-1.elb.amazonaws.comd
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axon-api.razer.com
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axon-api.razer.comd
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: RazerCentral_v7.16.0.695.exe, 00000008.00000002.4574664543.00000000023F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RazerCentral_v7.16.0.695.exe, 00000008.00000002.4574664543.00000000023F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.r2m02.amazontrust.com/r2m02.crl0u
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: svchost.exe, 00000006.00000002.4580885637.00000281F9800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.r2m02.amazontrust.com/r2m02.cer0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: irsetup.exe, 00000009.00000003.4045283539.000000000393E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dublincore.org/schemas/xmls/qdc/2003/04/02/dc.xsd
Source: irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ejemplo.com
Source: svchost.exe, 00000006.00000003.3625335432.00000281F96B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fb.me/use-check-prop-types
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://feross.org
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://jedwatson.github.io/classnames
Source: RazerCentral_v7.16.0.695.exe, 00000008.00000002.4574664543.00000000023F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.r2m02.amazontrust.com06
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://primer.com
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rzravatar.s3-website-us-east-1.amazonaws.com
Source: irsetup.exe, 00000009.00000003.4045283539.000000000393E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.=
Source: irsetup.exe, 00000009.00000003.4045283539.000000000393E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openx=
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFLCopyright
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFLRazerF5BoldWebfont
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFLRazerF5Thin
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://underscorejs.org/LICENSE
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Font
Source: irsetup.exe, 00000009.00000003.4493224401.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Roboto
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoMedium
Source: irsetup.exe, 00000009.00000003.4490215828.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4484489128.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025CF000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002920000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F41C000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.000000000335F000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4064735220.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4255416176.0000000004728000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4262965184.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4268415816.000000000472B000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4256127592.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: RazerCentral_v7.16.0.695.exe, 00000008.00000002.4574664543.00000000023F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.indigorose.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.razer.com/privacy-policy
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.razer.com/privacy-policyk
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.razer.com/sw-eulak
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.razer.com/terms-of-service
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.razer.com/terms-of-servicek
Source: irsetup.exe, 00000009.00000003.4079402466.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://albedozero.razerdata.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.braintreegateway.com:443
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.sandbox.braintreegateway.com:443
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apps.razer.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://arxiv.org/abs/1706.02515
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets-cn1.hcaptcha.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.braintreegateway.com
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.razerzone.com/razerid/images/avatar_light.jpg
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://authy.com
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatar.razerzone.com
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.000000000299A000.00000004.00000800.00020000.00000000.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/0
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/P
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/index.html
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/index.htmlB#https://axon-api.razer.com/1.7.2.0/P
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/sw.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/sw.jsa
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/1.7.2.0/sw.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/v1
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.000000000299A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/v1/rcis-downloader
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://axon-api.razer.com/v1/rcis-downloader4c
Source: RazerLightInstaller.exe, 00000000.00000000.2113547278.0000000000142000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://axon-api.razer.com/v1vhttps://dl.razerzone.com/drivers/Axon/RazerAxonSetup_SP.exe
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/author/icon/277e057b3c52f0fc4b73257e4f06150f.svg
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/author/icon/eb99bc56c82740a1a744431e8e1bc402.png
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/author/icon/eb99bc56c82740a1a744431e8e1bc402.pngP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/playlist/6e08414dfc15e74d52d7803f9c00b757.jpg
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/preview/7bedf0335da11938acd2f4a5a0301354.webp
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaAI6.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaAI6.js//
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaAI6.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaAI6.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaSDKWS.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaSDKWS.js//
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaSDKWS.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaSDKWS.jsa
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/ChromaSDKWS.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/RazerF5.woffP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/RazerF5.woffwOFFOTTO
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/Roboto-Bold.ttf
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/Roboto-Bold.ttfP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/Roboto-Medium.ttf
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/Roboto-Medium.ttfP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/Roboto-Regular.ttf
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/Roboto-Regular.ttfP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razer_about_insider.svg
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razer_about_insider.svgP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razer_code_img.png
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razer_code_img.pngP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razerf5-bold-webfont.ttf
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razerf5-bold-webfont.ttfP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razerf5-thin.otfOTTO
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/assets/razerf5-thin.otfP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.css
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.css.gz
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.css.gzP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.cssP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.js.gz
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.js.gzP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/axon.6d137568f45370acfce1.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/components.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/components.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/components.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/components.jsvar
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/tf.min.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/tf.min.js/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/tf.min.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/static/prod/1.7.2.0/tf.min.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/020a1d26-7fd9-44aa-864f-b03d207127fc/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/08c52e6d-c5ae-4558-9ea9-85948703967c/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/0a51de78-ae16-48a3-9905-dd5a36da5b54/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/18273453-0930-4188-917e-6d1bf7faa5c5/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/18d6413e6fdd97675ccb8546fc25b873.svg
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/18d6413e6fdd97675ccb8546fc25b873.svgP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/19b1b2ac-aefe-45c9-a981-495989bcdd7b/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/1ca3a9fb-d032-4bbb-a237-d2c4c162f35a/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/1f23af75-4088-4d1a-a5a3-c2a34f631786/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/200f14dd-b658-4a4f-b046-f19ab130441d/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/45436ddc-9197-4505-bb60-97e783c099a8/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/59c83775-bcac-4ecd-8e2c-5dbba8216cff/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/60744ebb-e3e3-46eb-b5eb-137c4b65594c/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/626048e5-9c6b-4564-8fe8-019072f8c34e/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/6a21db47-3877-4340-8913-190b983ba4c9/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/6ac2e788-5e97-4fa6-918a-3927e2eab442/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/7e81cc0d-c123-4b0a-bf80-286a388e09ff/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/a5aae8f9-8bb3-4b1e-8b52-51001e96aa7c/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/aabd8c5f-d9de-459b-960c-7a2078b6a195/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/c6ef97fc-1198-49e6-a0d1-f19e734ffc0d/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/df749c8f-2510-4930-b948-dced6f09bdf6/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/e8296487c2e8d97cdd0f401d0ae1bad5.jpg
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon-assets-cdn.razerzone.com/thumbnail/ebe55d57-cae6-4832-82c0-fcb63c22cb5d/1.0.0/Thumbnail
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://axon.razer.com/wallpaper/sharingpage?w=10038&u=87WYUZ4r6zVwz4sQwhjQw7eu5ogzBzquOsrnAkHAcdCJk
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://braintree.github.io/braintree-web/3.40.0/ThreeDSecure.html)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://braintree.github.io/braintree-web/current/module-braintree-web_three-d-secure.html#.create
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://c.paypal.com/da/r/fb.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cardinaldocs.atlassian.net/wiki/spaces/CC/pages/1409568/Configurations#Configurations-Loggin
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cardinaldocs.atlassian.net/wiki/spaces/CC/pages/1409568/Configurations#Configurations-Paymen
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cardinaldocs.atlassian.net/wiki/spaces/CC/pages/1409568/Configurations#Configurations-RootLe
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cardinaldocs.atlassian.net/wiki/spaces/CC/pages/98315/Response
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-apac.onetrust.com/consent/6f9a4656-5252-48ca-b960-2134761d3130/OtAutoBlock.js
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn-apac.onetrust.com/scripttemplates/otSDKStub.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.leonardo.ai/users/e7e72899-9c52-417b-8ab0-b4b7c35495cc/generations/811fd5ea-7230-4478-92
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.leonardo.ai/users/e7e72899-9c52-417b-8ab0-b4b7c35495cc/generations/ed9f9501-223c-4333-b3
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chroma.razer.com/ChromaAI/jszip.min.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromasdk.io:54236/razer/chromasdk
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=af&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=afKortpad
Source: irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=el
Source: irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=el&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419&category=theme81https://myactivity.google.com/myactivit
Source: irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=es-419Se
Source: irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=esSe
Source: irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=fr&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=frRaccourci
Source: irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=idPintasan
Source: irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=kn
Source: irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=kn&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=lv&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=lvSa
Source: irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=msPintasan
Source: irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=no&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=noSnarveien
Source: irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sl&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=slBli
Source: irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=sv&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=svGenv
Source: irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=th
Source: irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=th&category=theme81https://myactivity.google.com/myactivity/?u
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cn1.hcaptcha.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://deals-assets-cdn.razerzone.com/rating-modal/index.min.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API)c
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise#Methods
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.paypal.com/braintree/docs/guides/3d-secure/migration/javascript/v3).
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.paypal.com/braintree/docs/guides/paypal/testing-go-live#linked-paypal-testing
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://developer.paypal.com/braintree/docs/reference/request/payment-method-nonce/find).
Source: RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002559000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.razerzone.com
Source: RazerLightInstaller.exe, 00000000.00000000.2113547278.0000000000142000.00000002.00000001.01000000.00000003.sdmp, RazerLightInstaller.exe, 00000000.00000002.4579552493.0000000002511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.razerzone.com/drivers/Axon/RazerAxonSetup_SP.exe
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duo.com/product/trusted-users/two-factor-authentication/duo-mobile
Source: irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ejemplo.com.Se
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://feross.org/opensource
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fs.razersynapse.com
Source: svchost.exe, 00000006.00000003.3625335432.00000281F9723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.3625335432.00000281F96B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamestore.razer.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RazerOfficial/HTML5ChromaSDK
Source: irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cefsharp/CefSharp/wiki/Trouble-Shooting#log-file
Source: irsetup.exe, 00000009.00000003.4430846778.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: irsetup.exe, 00000009.00000003.4430846778.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/reactive
Source: irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/reactive0
Source: irsetup.exe, 00000009.00000003.4493224401.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/googlefonts/robotomono)Roboto
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/promises-aplus/promises-spec#the-promise-resolution-procedure
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tfjs-node
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tfjs/issues
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tfjs/issues/1735
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/tfjs/issues/5447
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zloirock/core-js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.29.1/LICENSE
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zloirock/core-jsm
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gold.razer.com
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gold.razer.com/account-summary
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gold.razer.com/gold/promotions/bonusrazergold?utm_source=razergearpurchase&utm_medium=insert
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://help.braintreepayments.com/
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imgs-cn1.hcaptcha.com
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://insider.razer.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://insider.razer.com/index.php?pages/categories/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://insider.razer.com/index.php?pages/categories/k
Source: Razer Axon_6828171.exe, 00000004.00000000.3599220257.0000000000991000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/client.min.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/client.min.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/client.min.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/hosted-fields.min.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/hosted-fields.min.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/hosted-fields.min.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/paypal-checkout.min.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/paypal-checkout.min.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/paypal-checkout.min.jsa
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/paypal-checkout.min.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/three-d-secure.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/three-d-secure.js(function(f)
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/three-d-secure.jsP
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/three-d-secure.jsaDb
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.braintreegateway.com/web/3.97.1/js/three-d-secure.jsg
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://js.foundation/
Source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://kinesis.us-gov-east-1.amazonaws.com
Source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://kinesis.us-gov-west-1.amazonaws.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://leonardo.ai/terms-of-service/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lodash.com/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lodash.com/license
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysupport.razer.com/
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysupport.razer.com/app/answers/detail/a_id/3773
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysupport.razer.com/app/answers/detail/a_id/548/
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mysupport.razer.com/app/warranty-support
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://npms.io/search?q=ponyfill.
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oauth2.razer.com
Source: irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.com
Source: irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comAkaun
Source: irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comAkun
Source: irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comCompte
Source: irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comCuenta
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle
Source: irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle-kontoLagrede
Source: irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle-kontoSparade
Source: irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comGoogle-rekeningGestoorde
Source: irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comRa
Source: irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comcuenta
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://payments.braintree-api.com/graphql
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://payments.sandbox.braintree-api.com/graphql
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://primer.com.Uporaba
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pubsub-api.razerapi.com
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razer-otptoken-service.razer.com
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/18.ae5eee5c.chunk.js
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/18.ae5eee5c.chunk.jsaD
Source: irsetup.exe, 00000009.00000003.4486635503.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/24.0b7e9fcb.chunk.js
Source: irsetup.exe, 00000009.00000003.4486635503.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/24.0b7e9fcb.chunk.jsaD
Source: irsetup.exe, 00000009.00000003.4488991084.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/34.576263b2.chunk.jsP
Source: irsetup.exe, 00000009.00000003.4477535169.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/47.0722483f.chunk.js
Source: irsetup.exe, 00000009.00000003.4477535169.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/47.0722483f.chunk.jsaD
Source: irsetup.exe, 00000009.00000003.4475333025.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/59.eac0967a.chunk.js
Source: irsetup.exe, 00000009.00000003.4475333025.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/js/59.eac0967a.chunk.jsaD
Source: irsetup.exe, 00000009.00000003.4480144848.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/RazerF5-Regular.d12785b2.woff2wOF2
Source: irsetup.exe, 00000009.00000003.4491398599.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/Roboto-Bold.2b389797.woffP
Source: irsetup.exe, 00000009.00000003.4491398599.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/Roboto-Bold.2b389797.woffwOFF
Source: irsetup.exe, 00000009.00000002.4581221437.0000000004720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/Roboto-Italic.06db94b5.woff2P
Source: irsetup.exe, 00000009.00000003.4490407181.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/Roboto-LightItalic.fbf36901.woffP
Source: irsetup.exe, 00000009.00000003.4490407181.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/Roboto-LightItalic.fbf36901.woffwOFF
Source: irsetup.exe, 00000009.00000003.4485046937.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/Roboto-MediumItalic.f9ca3454.woff2wOF2
Source: irsetup.exe, 00000009.00000003.4493224401.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/RobotoMono-Light.df831128.ttfP
Source: irsetup.exe, 00000009.00000003.4484489128.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/chevron-right-gray.7583988f.svg
Source: irsetup.exe, 00000009.00000003.4484489128.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/chevron-right-gray.7583988f.svgP
Source: irsetup.exe, 00000009.00000003.4480440361.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/comp-insider-gray.4c24ed99.svg
Source: irsetup.exe, 00000009.00000003.4480440361.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/comp-insider-gray.4c24ed99.svgP
Source: irsetup.exe, 00000009.00000003.4491218506.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/ekyc-wte-good.5bfec7d3.svg
Source: irsetup.exe, 00000009.00000003.4491218506.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/ekyc-wte-good.5bfec7d3.svgP
Source: irsetup.exe, 00000009.00000003.4490215828.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/google-2.34c1b423.svg
Source: irsetup.exe, 00000009.00000003.4490215828.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/google-2.34c1b423.svgP
Source: irsetup.exe, 00000009.00000003.4485382373.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/google.2df8a5e8.svg
Source: irsetup.exe, 00000009.00000003.4485382373.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/google.2df8a5e8.svgP
Source: irsetup.exe, 00000009.00000003.4483711239.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/razer-ths.4a25bea9.svg
Source: irsetup.exe, 00000009.00000003.4483711239.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/razer-ths.4a25bea9.svgP
Source: irsetup.exe, 00000009.00000003.4478493739.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid-assets.razerzone.com/static/media/sword_silver.c15af303.jpgP
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid.razer.com/ekyc/identity-verification
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://razerid.razer.com/ekyc/verify-singpass
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reportapi-cn1.hcaptcha.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rzr.to/QRVZ0m
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rzr.to/QRVZ0mk
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rzr.to/RazerAxonD
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rzr.to/RazerAxonDk
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rzr.to/RazerAxonIGD
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://rzr.to/RazerAxonIGDk
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://service.weibo.com/share/share.php?url=
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://songbird.cardinalcommerce.com/edge/v1/songbird.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://songbirdstag.cardinalcommerce.com/edge/v1/songbird.js
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/2348597/why-doesnt-this-javascript-rgb-to-hsl-code-work/54071699
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/2353211/hsl-to-rgb-color-conversion
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.fossilgroup.com/s/article/Standard-Limited-Warranty-Smartwatch-1616590590657
Source: Razer Axon_6828171.tmp, 00000005.00000002.4573433461.000000000107D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/analytics/answe
Source: Razer Axon_6828171.exe, 00000004.00000002.4574274034.0000000002D37000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3600187141.0000000003250000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000003.3612859170.0000000003C30000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4580607790.0000000003CE0000.00000004.00000020.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4576515672.0000000002C8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/analytics/answer/6004245?hl=en
Source: irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/?p=block_warn
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869?hl=es
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.razer.com
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.razer.com/contact-support
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.razer.com/contact-us
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thirdparty-gdpr.razerapi.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/intent/follow?screen_name=Razer
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/intent/follow?screen_name=Razerk
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/intent/tweet?url=
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wcri-log.razerapi.com
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webauthn.razer.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: irsetup.exe, 00000009.00000003.4277407059.000000000472E000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4296805163.0000000004724000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4319037886.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: irsetup.exe, 00000009.00000003.4280820877.0000000004721000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlAdministrado
Source: irsetup.exe, 00000009.00000003.4304713956.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlAdministreres
Source: irsetup.exe, 00000009.00000003.4269162616.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlBestuur
Source: irsetup.exe, 00000009.00000003.4293921938.000000000472D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlDikelola
Source: irsetup.exe, 00000009.00000003.4303797709.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlDiurus
Source: irsetup.exe, 00000009.00000003.4287645002.0000000004727000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlG
Source: irsetup.exe, 00000009.00000003.4281865676.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlGestionado
Source: irsetup.exe, 00000009.00000003.4315222400.0000000004726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlHanteras
Source: irsetup.exe, 00000009.00000003.4300059930.000000000503F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlP
Source: irsetup.exe, 00000009.00000003.4313505247.000000000472C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlUpravlja
Source: Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F12B000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.0000000003250000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000000.3607064673.0000000000251000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: RazerLightInstaller.exe, 00000000.00000000.2113547278.0000000000142000.00000002.00000001.01000000.00000003.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/checkoutnow/error
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js?
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4581712612.0000000003F68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/axon
Source: Razer Axon_6828171.exe, 00000004.00000003.3600187141.0000000003250000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000003.3612859170.0000000003C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/axon4https://www.razer.com/axon4https://www.razer.com/axon
Source: Razer Axon_6828171.tmp, 00000005.00000003.3612859170.0000000003C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/axoncE
Source: Razer Axon_6828171.exe, 00000004.00000002.4574274034.0000000002D96000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4576515672.0000000002D46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/axonpf
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/chromar(
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/cortex
Source: Razer Axon_6828171.tmp, 00000005.00000002.4573433461.000000000107D000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal/axon-open-source-software-notices
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal/axon-open-source-software-noticesk
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal/cookies
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal/customer-privacy-policy
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal/general-terms-of-use
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/legal/services-and-software-terms-of-use
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/razerstore-support
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/rewardsforthefaithful
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/sg-en/my-account/orders
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/store/rewards
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/warranty
Source: irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.razer.com/warranty#who-is-authorized-to-sell-razer-products
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/submit?type=LINK&title=
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/submit?url=
Source: Razer Axon_6828171.exe, 00000004.00000003.3602464291.000000007F12B000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.exe, 00000004.00000003.3601486594.0000000003250000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000000.3607064673.0000000000251000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp, Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sandbox.paypal.com
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000003F80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.shadertoy.com/view/4djSRW
Source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000004980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Razer?sub_confirmation=1k
Source: irsetup.exe, 00000009.00000003.4488324586.000000000472F000.00000004.00000020.00020000.00000000.sdmp, irsetup.exe, 00000009.00000003.4493616331.000000000472F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yeelight.com

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a raw input device (often for capturing keystrokes)

Source: irsetup.exe, 00000009.00000003.4160551562.0000000004722000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_8f36a0c4-c

System Summary

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

Process Stats: CPU usage > 49%

Creates files inside the system directory

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	File created: C:\Windows\Installer\Razer	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	File created: C:\Windows\Installer\Razer\Installer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Windows\Fonts\is-RH40R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\RC\
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\RC\RzRC_install.log
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\uniF679.tmp
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\uniF679.tmp
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\uninstall.dat
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall.exe
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\lua5.1.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\uninstall.xml
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\IRIMG1.JPG
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\IRIMG2.JPG
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\IRZip.lmd

Deletes files inside the Windows folder

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File deleted: C:\Windows\Installer\Razer Central\RCUninstall\uniF679.tmp

PE file contains executable resources (Code or Archives)

Source: Razer Axon_6828171.tmp.4.dr

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

PE file contains more sections than normal

Source: Razer Axon_6828171.exe.tmp.0.dr	Static PE information: Number of sections : 11 > 10
Source: Razer Axon_6828171.tmp.4.dr	Static PE information: Number of sections : 11 > 10

Sample file is different than original file name gathered from version info

Source: RazerLightInstaller.exe, 00000000.00000002.4572650173.00000000006BE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs RazerLightInstaller.exe

Uses 32bit PE files

Source: RazerLightInstaller.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus26.troj.evad.winEXE@7/1848@0/4

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

File created: C:\Program Files (x86)\Razer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

File created: C:\Users\user\AppData\Local\Razer

Jump to behavior

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Mutant created: \Sessions\1\BaseNamedObjects\F1B77BCD-89DA-4556-841E-EF3B0BAFEE88

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe.tmp

Jump to behavior

Source: RazerLightInstaller.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: RazerLightInstaller.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RazerLightInstaller.exe "C:\Users\user\Desktop\RazerLightInstaller.exe"
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe "C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=
Source: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp "C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp" /SL5="$140246,203648975,1023488,C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe "C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe" /S
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Process created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe "C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=	Jump to behavior

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: lua5.1.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Section loaded: sfc_os.dll

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

Window found: window name: TMainForm

Jump to behavior

Uses Rich Edit Controls

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

PE / OLE file has a valid certificate

Source: RazerLightInstaller.exe

Static PE information: certificate valid

PE file contains a COM descriptor data directory

Source: RazerLightInstaller.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Submission file is bigger than most known malware samples

Source: RazerLightInstaller.exe

Static file information: File size 1197104 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: RazerLightInstaller.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: RazerLightInstaller.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\projects\cefsharp\CefSharp.Wpf\obj\Release\net462\CefSharp.Wpf.pdb source: irsetup.exe, 00000009.00000003.4089471513.000000000472B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdb source: irsetup.exe, 00000009.00000003.4093746530.000000000472E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\sourcetree\Cortex PC 10 Toolkits\RazerCortexInstallerLib\Release\RazerCortexInstallerLib.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4636710184.000000006C1FC000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\Kinesis\obj\AWSSDK.Kinesis.Net45\Release\net45\AWSSDK.Kinesis.pdb source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\RazerDev\AxonInstaller\IronSourceReporter\IronSourceReporter\obj\Release\RazerAxonISReporter.pdb4! source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D3DCompiler_47.pdbGCTL source: irsetup.exe, 00000009.00000003.4093746530.000000000472E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Reactive.pdb source: irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\RazerDev\AxonInstaller\IronSourceReporter\IronSourceReporter\obj\Release\RazerAxonISReporter.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\JenkinsWorkspaces\trebuchet-stage-release\AWSDotNetPublic\sdk\src\Services\Kinesis\obj\AWSSDK.Kinesis.Net45\Release\net45\AWSSDK.Kinesis.pdbSHA256 source: irsetup.exe, 00000009.00000002.4572167326.00000000004DE000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: `OTHER`TEMP`PACKED<%s return value>hlslFlagshlslTargethlslEntryhlslDefinesinternal error: failed to write debug data to pdb streaminternal error: failed to add section contributioninternal warning: PDB Error string is "%S"internal error: failed to close debug infointernal error: failed to close PDBinternal error: failed to open PDB for writing in streaminternal error: failed to create debug info in PDBinternal error: failed to add code section to debug infointernal error: failed to add module to debug infointernal error: failed to create type info in PDBinternal error: failed to create inline type info in PDBinternal error: failed to create source file store in PDBinternal error: failed to close source file store in PDBinternal error: failed to close module in debug infointernal error: failed to commit type info in PDBinternal error: failed to commit inline type info in PDBinternal error: failed to add section header to debug infointernal error: failed to append section header to pdbinternal error: failed to close section header in debug infointernal error: failed to close debug info in PDBinternal error: failed to commit PDBinternal error: PDB data too largeinternal error: PDB stream truncatedinternal error: failed to close source file storeinternal error: failed to close type infointernal error: pdb append failedfxl_4_0too many arguments to target TXtoo many outputs to target TXclip not supported in texture shadersinvalid reference to input semantic '%s%d'invalid reference to output semantic '%s%d'0123456789abcdef.pdbVPosSV_ViewportArrayIndexColorFailed to log error, redirecting to debug output: source: irsetup.exe, 00000009.00000003.4093746530.000000000472E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: irsetup.exe, 00000009.00000003.4430846778.000000000472C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\RazerDev\AxonInstaller\IronSourceReporter\RazerLightInstaller\bin\Release\RazerLightInstaller.pdb source: RazerLightInstaller.exe, 00000000.00000000.2113547278.0000000000142000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: WebView2Loader.dll.pdb source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005D80000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\internal\OSExtensions\obj\Release\net462\OSExtensions.pdb source: irsetup.exe, 00000009.00000003.4435339356.0000000004727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256^Y source: Razer Axon_6828171.tmp, 00000005.00000002.4585482507.0000000005380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\FastSerialization\obj\Release\net462\Microsoft.Diagnostics.FastSerialization.pdb source: irsetup.exe, 00000009.00000003.4434593093.0000000004721000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\internal\OSExtensions\obj\Release\net462\OSExtensions.pdbSHA256 source: irsetup.exe, 00000009.00000003.4435339356.0000000004727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Reactive.pdbSHA256?, source: irsetup.exe, 00000009.00000003.4432087696.0000000004729000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: RazerLightInstaller.exe, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: RazerLightInstaller.exe, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor

Yara detected Costura Assembly Loader

Source: Yara match

File source: C:\Program Files (x86)\Razer\Razer Axon\Manifest\is-4JIJ0.tmp, type: DROPPED

Binary contains a suspicious time stamp

Source: is-OK4FL.tmp.5.dr

Static PE information: 0xB34CC1BF [Tue Apr 28 13:46:39 2065 UTC]

PE file contains sections with non-standard names

Source: Razer Axon_6828171.exe.tmp.0.dr	Static PE information: section name: .didata
Source: Razer Axon_6828171.tmp.4.dr	Static PE information: section name: .didata

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-BP4O3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4GA7L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-U89DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-I4186.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HNOEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-07QIR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-VTQ05.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-JLHUN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-K4K2N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-NVPNT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-1QBKN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-9S73M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-51Q8D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-NU09U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-U24O2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-S9U8H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-1N0PK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-16SH7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-PNQ1M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-B2NM9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-QGIN4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-EV62U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-10SAM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TI9D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-P7G4L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VLR0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7MJ7R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3B37D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-H1KE9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-VNSR2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-G71S5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-9K067.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-IHQ9O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-LV6AL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-3JRQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-N04UV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-EDJJT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-B56FE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-AUBBK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TFLVB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-5CHF5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-QCCD9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PGE4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-QKDBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-NQGP6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-QP1MC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-EM9F2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-Q2MEF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-87IQ1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-NOUOE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-CUKKF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-0L96T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-QISDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-JLK4N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-80VM3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-THH6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-DNR24.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-DH59T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-56077.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1TU3D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-KOHNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-5HEBM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-P9RFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TEOGO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-P0PSR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-S6VU7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-G4HNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-MVE55.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-RNVN8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-01KDG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-O96L6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-DBT09.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-P9447.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-AFRT4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-RF82F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-G3D7S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-BOVUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4L0UU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-A9DSA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-6INOF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-BF3DQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-UMLK1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BE0PF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-9N6M4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-LUE1J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-LPUDC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-A3NOM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-0DGRP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-PNNT7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-7GSMH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-K6I4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-0SD31.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-BIDUN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-QI6AS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-CB8F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-U512K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-15B38.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-NLA2I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HHKVA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-NO254.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3CNSH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-A0LS6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7O0CQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-6VREH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-P13MR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-ODHNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BK5A4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4BKO7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-20CG3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-O2S02.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BD1OQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3N45D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3FKUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-31173.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-22TLR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1NF6S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-K3HTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-5UOR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-NML5G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BP4BF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-TPGC9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-6QN27.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-RF2L2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-8VD0K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-L0EF8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-L2A88.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-0LF1K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-DI28E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-774T5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-2AVCA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-KDTG7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-G1QH7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-26D5S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-KKH2H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-N3PGB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-4NLPO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1VC7B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-BSVBG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-DSDTI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-38PQN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-0JG9I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BFHCD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-V4PMM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-LR12R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-JTQ8G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-KQTHI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3RRVH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-B741D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-NL2KL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-CFE8N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-KOENE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PLRLD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-MD7I9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-UI7DT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BUPFA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-D3M6N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-13VNG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-LT64Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-AAMKU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4HS3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-8KN8H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-TAMRN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-I83U0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1988Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-AKT4J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-MK5GU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-90BDR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-OPLDA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-NSVPQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PMLDG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3JAF0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BH08C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-64SOI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-LJF16.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-R0ET0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-IV9D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-IVRH6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-OK4FL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-GQKQB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-J479T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-M50BK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-98B1F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-2TUCL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-RCO6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-Q48QQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-HN0G8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-O5M75.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-76R3E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-H5EIE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3VD9T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-U3266.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-M7TD4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-0T6CN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-0M8PR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-QHQKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-P0SSD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PHDO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-9HUQ8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-E51E4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TGSD9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-FI122.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-CNOAH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-RVI1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HVT9Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7N6NF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-SV4AV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-H1GFI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-2AJ0L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-SJKIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-R3V8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-JHN2N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-MI7JH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-F2E8M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-589FL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-DM6O9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-FUS3N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-GF553.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-T0C3V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-DT3GI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-GM101.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-2AKMC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-ADHV7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-V0AAP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-LMIRR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-S2QFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-D0H3N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-FOK6F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TL2HC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-EH1Q5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-FUEO1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1F3D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-94DF9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-EF1DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-KEVI3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-IKU2T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-DSSE8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-PUJ98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BMEFU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-B31RF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-58T1J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HUHH7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VR8EE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TMTCQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-PF4K4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-RJSRI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-D697N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PDHOD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4ENO0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-2O0S3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-6BFD6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-KSA35.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-1IA8P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-9PFB7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-JFG9N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-9FJ6C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3CMRP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-OGNN8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-654RH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-JDD4N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-UM2J3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-SSS4T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-7SB3M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-8RPA7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-S7BOR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-88AQO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-0N49N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VU353.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-V0IAM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-IAFR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BC4QO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-9C9SI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-63FSN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7H5VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-I1PE2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-EO2BN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-2R342.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-R1CED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-H14TF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-DA67M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-59LSP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-OKUJ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-NM9F6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-5IM2E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-DSPN1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-1P2Q5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-LCNA0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-4G9FC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PQAM8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-VHLA7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-MDOIF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VT0F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TA2M0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-08LSA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-MIT0E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-547QO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-K4A4G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-EBHRP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-MOQ84.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-656H2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-QHOTO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-L4O2F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-G902A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-6K2LG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-8I2ON.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-26745.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-DQ7P8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-UPSDV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-GB45M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-UL9CL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-AB2SA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-MCQGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1L7OO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-FJN00.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4PHV3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-LT0TA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-B7B0A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-DIPQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-B40L6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-DVJVT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-I4043.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-E01VA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4LTHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-AF1UQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-OEM11.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-885IO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-A54R8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-ROA5V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-GD55U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-QVDBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BO0B6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-NNNIB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-763BL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-B07CH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-55I01.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-Q6GTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-SMLON.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-0NCIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4N3IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-T3LSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-JS8AH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-3RCQJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-LS6NA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-F4P43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-V5B4J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-2MMO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-U8JL0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-UJ4HA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-4L29F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-1UMGJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-O0Q28.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-MFG90.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-05JS1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-EVV0N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-M5LA6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\runtimes\win-x64\native\is-615VK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-5K9MQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-3LIMP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TMS2K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-M5H88.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-QF4H0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCortexInstallerLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-OAH5T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-HR85S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-OFCKB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-HU7H2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7CD0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-1BKRL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-JGHSO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-OLA4T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-V8LFG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-P08DM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-R9GJL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-H9VJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-CGALL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-5L2G8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-GE99D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-ADVJE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-1LUQ4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-CVUN8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HHJ09.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-UDO1H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-57N97.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-O9LSM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-K7SJH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-545NO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-BSEB9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-UPTMG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7NL0D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-QPQOU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-2GRL9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-T9BF3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-DHU5O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-0B37A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HT8RL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe	File created: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-0O91H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-9DUJS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-PNOG3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-GNNTG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-MQP2E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-BD72U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-B6GDA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-ACEQE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-5IIEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-BUATB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-41G52.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-7LE2Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-FDAE1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\is-GER6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-KH6CI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-DHHIB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VG8UM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-0DCPI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-Q6LTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-89847.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-JJHVQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TUMHM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-HKFDB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-SCBG0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-PO7FK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-IMDN3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-OLQ7S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-F7JR0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-E95NF.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-A4IAD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-CR7HR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-V875E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-FFH1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-2VLG5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VS3U0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-8AA9S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-Q5BLA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-ACUK3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-GCIQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ru\is-8RA6B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-1D96M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-DOA1C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-O4E86.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-EUCDT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ja\is-EONCM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-0L47Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-OTIQT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-CEP4B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\win32\is-DVJGN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-IHQJL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-9F7MT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-D1C2D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-36P0K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-J5OT1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-S7J2F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BC2PI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-245EQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-C208O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-MGOLE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-M4SGM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BCJ00.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-QSNJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HV8A8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-3914L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-RVRL4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pl\is-DUNNR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-2M8RT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-KRJIJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-GBA93.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-K8LD8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-18U6B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-03GS5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-75DII.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-MGFVJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-EOJ0A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-6IHNR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-69AH0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-F3T3L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-88ULH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-5PEQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-HQT5J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\it\is-D81KD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-UH1H6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-MKBQ4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-TPG1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-1NL5C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\es\is-K84PB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BKQUO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\tr\is-AV24H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\fr\is-7TI30.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-F4IT6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-GL6RJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-BHF9C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-91LO6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\de\is-Q1TRI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-77SAL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-U723M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-VUBE7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-JAFMP.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\is-042VR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\cs\is-HGQ29.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Program Files (x86)\Razer\Razer Axon\ko\is-NLQ19.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\IRZip.lmd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\lua5.1.dll	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\Razer Central\RCUninstall\IRZip.lmd			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd			Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\Users\user\AppData\Local\Temp\Setup Log 2024-10-02 #001.txt			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Windows\Installer\{0CD55593-F275-4aea-92B2-9170B5A14644}\RC\RzRC_install.log

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.Apache2.0.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.avro.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.bzip2.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.cefsharp.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.ionc.zip.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.zlib.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.NotifyIcon.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.BouncyCastle.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.jose-jwt.txt
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File created: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Licenses\License.WebSocketSharp.txt

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer Axon			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer Axon\Razer Axon.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Memory allocated: 2480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Memory allocated: 4510000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598312	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Window / User API: threadDelayed 6253			Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Window / User API: threadDelayed 3642			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.Binder.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Threading.Tasks.Parallel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-BP4O3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-U89DB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Web.HttpUtility.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HNOEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-07QIR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-VTQ05.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-K4K2N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-crt-string-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-1QBKN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-NVPNT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-9S73M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-51Q8D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\fr\is-NU09U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-S9U8H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-1N0PK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\es\is-B2NM9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-PNQ1M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-F0US5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\msvcp140_clr0400.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\SQLite-net.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\System.Memory.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-2JMMA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-EV62U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-10SAM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-DT658.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\GameManagerClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Data.DataSetExtensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-7MJ7R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VLR0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Prism.Unity.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-H1KE9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Runtime.Serialization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.Tokens.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pl\is-G71S5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\es\is-9K067.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-LV6AL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.WallpaperPlayerManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-3JRQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Resources.Writer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-N04UV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Net.WebProxy.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-AUBBK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TFLVB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3U57Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\mscordbi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-JA33G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-QCCD9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationFramework.Luna.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PGE4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\CefSharp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QKDBI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QP1MC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Razer.RazerInstallerUtility.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\ActionServiceCommon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QAV6E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\AccountManagerCommon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-P0E2U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Private.CoreLib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-Q2MEF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-synch-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PQMTJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.ServiceProcess.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\clretwrc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-CUKKF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Manifest\is-4JIJ0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.VisualBasic.Forms.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\clrjit.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QISDN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\NotificationUiClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Net.Mail.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-35HHA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-80VM3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HQOUV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-DNR24.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\RzServiceUninstallController.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-56077.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-KOHNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-5HEBM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TEOGO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\UICommon.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-G4HNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-02S2K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-RNVN8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-01KDG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-O96L6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.EnvironmentManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\e_sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Prism.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-P9447.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-RF82F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PocoFoundation64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\WindowsFormsIntegration.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Razer.HardwareDetector.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-BOVUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-E6C7C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-6INOF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-BF3DQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-crt-utility-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.Reporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Threading.Timer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-9N6M4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-P5T5P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-errorhandling-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-5V45O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Net.Http.Formatting.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Diagnostics.StackTrace.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-LPUDC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Web.WebView2.Wpf.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-478NB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pl\is-0DGRP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Text.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-JFJ8C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-K6I4U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\fr\is-BIDUN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QI6AS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Security.Cryptography.ProtectedData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-U512K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\SQLitePCLRaw.nativelibrary.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\api-ms-win-crt-stdio-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\de\is-NLA2I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Win32.Registry.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\CChromaEditorLibrary64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-7O0CQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.DataAcquisition.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\es\is-P13MR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Windows.SDK.NET.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.CSharp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-182R7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-BD1OQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-G46JK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Razer.WebP.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3N45D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3FKUD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\CefSharp.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Reflection.TypeExtensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-K3HTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-datetime-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.ComponentModel.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-5UOR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-TPGC9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-6QN27.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Transactions.Local.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-RF2L2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\WinRT.Runtime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-L0EF8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3TGC3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Configuration.ConfigurationManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-2AVCA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-774T5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-KDTG7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-G1QH7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Options.ConfigurationExtensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\vcruntime140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\UpdateUiClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationNative_cor3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Runtime.Numerics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.IWallpaperManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1VC7B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.IO.Compression.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-DSDTI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.AppContext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.ISettingManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-file-l1-2-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-38PQN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\is-0JG9I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-file-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-BFHCD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-V4PMM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.IO.Pipes.AccessControl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Security.SecureString.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-LR12R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-4B64O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\fr\is-KOENE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-CFE8N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Microsoft.Practices.Unity.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-13VNG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-LT64Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\hostfxr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\UpdateManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-8KN8H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-I83U0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1988Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-AKT4J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-MK5GU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-90BDR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.ILogger.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Security.Principal.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-NSVPQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TEM1G.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-D65RQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PMLDG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3JAF0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-BH08C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-6A9VI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-64SOI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Reflection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationFramework.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-LJF16.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-IV9D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-M50BK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\UIAutomationClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-crt-conio-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pl\is-98B1F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-2TUCL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Options.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\CefSharp.BrowserSubprocess.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-RCO6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\msvcp140_atomic_wait.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-HN0G8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\es\is-O5M75.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-9R452.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationFramework.Royale.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\msquic.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-F7JQS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\mscorlib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.IO.FileSystem.AccessControl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PH3CL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3VD9T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-U3266.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\es\is-0T6CN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-M7TD4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-0M8PR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QHQKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1O7GP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\UIAutomationProvider.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Diagnostics.DiagnosticSource.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PHDO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-8061I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-E51E4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QM70C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-CNOAH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-RVI1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Xml.Serialization.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.VisualBasic.Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HVT9Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-SV4AV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-2AJ0L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-R3V8J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-589FL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\NacClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\msvcp140_codecvt_ids.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-FUS3N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\AccountManagerClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\fr\is-GF553.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Threading.Tasks.Extensions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-O8QVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VLEGS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Text.RegularExpressions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-ADHV7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-S2QFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-NAU69.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TL2HC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-FOK6F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Console.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Windows.Forms.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-FUEO1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1F3D0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\api-ms-win-crt-heap-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-94DF9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TSQPD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-KEVI3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.Logging.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-IKU2T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pl\is-DSSE8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Http.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Net.WebHeaderCollection.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-B31RF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Security.AccessControl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\api-ms-win-crt-math-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HUHH7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-FN4IQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-synch-l1-2-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-PF4K4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\de\is-RJSRI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PDHOD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Win32.Registry.AccessControl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.CommonUtility.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-6BFD6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\hostpolicy.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-9PFB7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-JFG9N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\coreclr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3CMRP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-654RH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\NotificationClient.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Buffers.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-SSS4T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-7SB3M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-9696U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-0N49N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Hosting.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VU353.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-memory-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationFramework-SystemData.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-IAFR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-9C9SI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.Logger.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-7H5VG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-63FSN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\log4net.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-profile-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-R1CED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-2R342.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-DA67M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-59LSP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-OKUJ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-5IM2E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-NM9F6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.IO.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-1P2Q5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-4G9FC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VVL6F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.Reporter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Microsoft.Practices.Unity.Interception.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-PQAM8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3EF32.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pl\is-MDOIF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VT0F5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TA2M0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-08LSA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-sysinfo-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Security.Claims.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-05BO1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Runtime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1RVE5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-libraryloader-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-D8I6B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-MOQ84.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.Json.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\es\is-QHOTO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\NotificationCore.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\CommonInternal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-GB45M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Microsoft.Practices.Unity.Interception.Configuration.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\fr\is-UL9CL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\mscorrc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-MCQGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-KKUS1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-crt-private-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-4PHV3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-NJN0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\cs\is-FJN00.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-B7B0A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-DIPQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-CTCJD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-I4043.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HF553.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-NUMNH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-AF1UQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-4LTHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-OEM11.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.IDownloadManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\msvcp120.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.JsonWebTokens.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\is-A54R8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-ROA5V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Text.Encodings.Web.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-NNNIB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Net.Ping.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\UpdateCommon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-763BL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-MSTO2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-B07CH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-localization-l1-2-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\RcClientBase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pl\is-0NCIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-crt-environment-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\Hardcodet.Wpf.TaskbarNotification.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-T3LSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-EQ9RC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-3RCQJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Collections.Specialized.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-JS8AH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-F4P43.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-M8M19.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Collections.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-V5B4J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HMBKC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\CefSharp.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.IWebviewWindowManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.IO.IsolatedStorage.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-MFG90.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Resources.Reader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-interlocked-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-EVV0N.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-M5LA6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\runtimes\win-x64\native\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\runtimes\win-x64\native\is-615VK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-5K9MQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\WindowsBase.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\tr\is-3LIMP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VER3H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-OAH5T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.Player.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HARMC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1OUDI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hant\is-HR85S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-JKOD2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-LVFNF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-OFCKB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VF70P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-7CD0H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-1BKRL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\is-JGHSO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-V8LFG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-H9VJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Diagnostics.TraceSource.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationFramework.Aero2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-5L2G8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Xml.XmlSerializer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-8I8M9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-ADVJE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Security.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HHJ09.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-87A0O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\fr\is-57N97.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-O9LSM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-K7SJH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-7NL0D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-QPQOU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-2GRL9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-B718Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.IPlayListManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Management.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-K38AA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\de\is-DHU5O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxonISReporter.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\websocket-sharp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\pt-BR\is-0B37A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\api-ms-win-crt-string-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-TEN1S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Configuration.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-0FPCV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.UserManager.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.FileProviders.Abstractions.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Net.Quic.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.ComponentModel.TypeConverter.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\createdump.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-GNNTG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-BD72U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-HUP2T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\is-B6GDA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-ACEQE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-5IIEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\RcClientBase.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-21Q5H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\MicrosoftEdgeWebview2Setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Diagnostics.TextWriterTraceListener.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Runtime.CompilerServices.Unsafe.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-KH6CI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\AWSSDK.Kinesis.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Collections.Concurrent.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Drawing.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-DHHIB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Services\Razer Central\AccountManagerClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-OPOI9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-0DCPI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\PresentationFramework.AeroLite.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-AQCVS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\zh-Hans\is-Q6LTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ja\is-IMDN3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-OLQ7S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.Private.Uri.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-core-processthreads-l1-1-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\de\is-V875E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\api-ms-win-crt-filesystem-l1-1-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-VS3U0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-2AL76.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\System.ComponentModel.Annotations.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-Q5BLA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\win32\is-GCIQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Razer.Analytics.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ru\is-8RA6B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\is-DOA1C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\it\is-1D96M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.Console.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\mscordaccore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Razer\Razer Axon\ko\is-EUCDT.tmp	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 6968	Thread sleep count: 6253 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 6764	Thread sleep count: 3642 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99754s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -98844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -98733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99636s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99306s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -99075s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -98749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe TID: 1680	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 516	Thread sleep time: -30000s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99754	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99625	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99406	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 98844	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 98733	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99636	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99527	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99421	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99306	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 99075	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 98749	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Thread delayed: delay time: 598312	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe	File opened: C:\Users\user\AppData

Source: Razer Axon_6828171.tmp, 00000005.00000002.4580607790.0000000003CE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000006.00000002.4575817500.00000281F422B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@w
Source: RazerLightInstaller.exe, 00000000.00000002.4572650173.00000000006F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000006.00000002.4581418298.00000281F9854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RazerLightInstaller.exe, 00000000.00000002.4572650173.00000000006F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\RazerLightInstaller.exe

Process created: C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe "C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=

Source: C:\Users\user\Desktop\RazerLightInstaller.exe	Queries volume information: C:\Users\user\Desktop\RazerLightInstaller.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	32 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner
C:\Program Files (x86)\Razer\Razer Axon\AWSSDK.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\AWSSDK.Kinesis.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Accessibility.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\AccountManagerClient.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\ActionServiceCommon.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\CChromaEditorLibrary64.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\D3DCompiler_47_cor3.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\DirectWriteForwarder.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Ionic.Zip.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Manifest\AxonManifestRepair.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Manifest\is-4JIJ0.tmp	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.AspNetCore.Http.Features.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.CSharp.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.DiaSymReader.Native.amd64.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.Binder.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.CommandLine.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.EnvironmentVariables.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.FileExtensions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.Json.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.UserSecrets.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Configuration.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.DependencyInjection.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.FileProviders.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.FileProviders.Physical.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.FileSystemGlobbing.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Hosting.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Hosting.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Http.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.Configuration.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.Console.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.Debug.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.EventLog.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.EventSource.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Logging.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Options.ConfigurationExtensions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Options.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Extensions.Primitives.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.Abstractions.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.JsonWebTokens.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.Logging.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.IdentityModel.Tokens.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Toolkit.Uwp.Notifications.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.VisualBasic.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.VisualBasic.Forms.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.VisualBasic.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Web.WebView2.Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Web.WebView2.WinForms.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Web.WebView2.Wpf.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Win32.Primitives.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Win32.Registry.AccessControl.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Win32.Registry.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Win32.SystemEvents.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Microsoft.Windows.SDK.NET.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\MicrosoftEdgeWebview2Setup.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\Newtonsoft.Json.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Razer\Razer Axon\PenImc_cor3.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://underscorejs.org/LICENSE	0%	URL Reputation	safe
https://npms.io/search?q=ponyfill.	0%	URL Reputation	safe

IP	Domain	Country	ASN	ASN Name	Malicious
2.19.126.142	unknown	European Union	16625	AKAMAI-ASUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
52.0.18.96	unknown	United States	14618	AMAZON-AESUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524425
Start date and time:	2024-10-02 19:00:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	RazerLightInstaller.exe
Detection:	SUS
Classification:	sus26.troj.evad.winEXE@7/1848@0/4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Time	Type	Description
13:00:59	API Interceptor	9024605x Sleep call for process: RazerLightInstaller.exe modified
13:03:30	API Interceptor	2x Sleep call for process: svchost.exe modified
19:05:14	Task Scheduler	Run new task: AxonLaunchTask path: "C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.exe" s>-istask
19:05:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RazerAxon "C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.exe" -autorun
19:05:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RazerAxon "C:\Program Files (x86)\Razer\Razer Axon\RazerAxon.exe" -autorun

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
2.19.126.142	http://steam.csworkshoparts.com/filedetails/sharedfile/ak47-DeadRose/	Get hash	malicious	HTMLPhisher	Browse
	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse
	https://gtm.you1.cn/app/1361510/images	Get hash	malicious	Unknown	Browse
	https://gtm.you1.cn/profiles/76561198013673010	Get hash	malicious	Unknown	Browse
	AgHiy5gaGp.exe	Get hash	malicious	Amadey, PureLog Stealer	Browse
	SecuriteInfo.com.Win64.DropperX-gen.20168.7257.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar, zgRAT	Browse
	UmMgwOUPt5.exe	Get hash	malicious	PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse
184.28.90.27	moba-24.2-installer_M64ZB-1.exe	Get hash	malicious	PureLog Stealer	Browse
	Message_2477367.eml	Get hash	malicious	Unknown	Browse
	MagicUtilities-Setup-3.1.4.5-Win10.exe	Get hash	malicious	Unknown	Browse
	Macabacus-9.7.2.msi	Get hash	malicious	Unknown	Browse
	042258835-17458857786.docx	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_sp2_2.0.0.0(10).eml	Get hash	malicious	HTMLPhisher	Browse
	You have a held messages (dawie@ddebeer.co.za).msg	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/inbound-mail-attachments-prod/0cbecb77-b573-4b3b-8c97-8b461d262d51?GoogleAccessId=distribution-controller-prod@inbound-mail-attachments.iam.gserviceaccount.com&Expires=1758806989&Signature=teNXGJRcW9uuEoVVvD0bLb%2BTGBorxpSu89OlgLR0AZpo8aoMl3JFsBDoXmLnj9QMk%2BAPu8iGsKTPrT4i0XSxxzRmtCLdsbDi23%2FFHfN4OpU3mOnUXtbZ81e7h5Ax%2FIygnxvogL7iGUXrqQUBZEnVkPmXcpAMmBTX7%2Bj4kVf57xBQo4WA9yGdv5Df4b9nDGZMXEYZVxWjPtOk4%2FXapMoV5bYJLgpB%2BR%2F1LUE0IwT1d3wuv1q6TONtaWwducy4mc1%2FJvGqxFuxuW9Y6Ojq%2B7a%2FqCW4DaFdd42O6ViY63C8G7dPbTe9LtxhwHcAk9xg3n5kXh2Z75tDAkK2Ak5mKneP6g%3D%3D	Get hash	malicious	Unknown	Browse
	https://storage.googleapis.com/inbound-mail-attachments-prod/0cbecb77-b573-4b3b-8c97-8b461d262d51?GoogleAccessId=distribution-controller-prod@inbound-mail-attachments.iam.gserviceaccount.com&Expires=1758806989&Signature=teNXGJRcW9uuEoVVvD0bLb%2BTGBorxpSu89OlgLR0AZpo8aoMl3JFsBDoXmLnj9QMk%2BAPu8iGsKTPrT4i0XSxxzRmtCLdsbDi23%2FFHfN4OpU3mOnUXtbZ81e7h5Ax%2FIygnxvogL7iGUXrqQUBZEnVkPmXcpAMmBTX7%2Bj4kVf57xBQo4WA9yGdv5Df4b9nDGZMXEYZVxWjPtOk4%2FXapMoV5bYJLgpB%2BR%2F1LUE0IwT1d3wuv1q6TONtaWwducy4mc1%2FJvGqxFuxuW9Y6Ojq%2B7a%2FqCW4DaFdd42O6ViY63C8G7dPbTe9LtxhwHcAk9xg3n5kXh2Z75tDAkK2Ak5mKneP6g%3D%3D	Get hash	malicious	Unknown	Browse
	CSV Account Verification Upload Folder (1).zip	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	18.214.158.31
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	52.73.253.16
	novo.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	54.156.155.101
	novo.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	54.18.3.77
	novo.ppc440fp.elf	Get hash	malicious	Mirai, Moobot	Browse	18.208.7.116
	Iir6rxs8r6.exe	Get hash	malicious	Rhysida	Browse	52.5.13.197
	novo.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	54.133.143.33
	novo.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	198.136.165.108
	novo.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	44.199.29.4
	yakov.x86.elf	Get hash	malicious	Mirai	Browse	54.27.151.237
AKAMAI-ASUS	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	184.28.163.53
	novo.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	104.65.167.25
	novo.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	23.204.25.166
	Iir6rxs8r6.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	Setup.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.102.49.254
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	http://view.flodesk.com/emails/66fd2053af85c99dd55d1461	Get hash	malicious	Unknown	Browse	2.19.126.198
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	test.exe	Get hash	malicious	Babadeda	Browse	23.223.209.207
	kuly.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
AKAMAI-ASUS	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	184.28.163.53
	novo.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	104.65.167.25
	novo.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	23.204.25.166
	Iir6rxs8r6.exe	Get hash	malicious	Rhysida	Browse	96.17.64.189
	Setup.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.102.49.254
	66fb252fe232b_Patksl.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.102.49.254
	http://view.flodesk.com/emails/66fd2053af85c99dd55d1461	Get hash	malicious	Unknown	Browse	2.19.126.198
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	test.exe	Get hash	malicious	Babadeda	Browse	23.223.209.207
	kuly.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

Process:	C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1570504
Entropy (8bit):	5.337344367761135
Encrypted:	false
SSDEEP:	12288:mQ79RfLk4aUhqWVyUNjohbPVJX2Tph8ljCDfgfGgxZvJ4Vt4f2tqxUWIoK7EemX6:mOxaUhqWVDSs8pcgYX
MD5:	280F09B527F1191E414BC35CB321480A
SHA1:	BD531714D912EF3AB210FC68079920785DA3DA98
SHA-256:	D8304003FF3A8D5E90286349BBF6C168177C8A8109A5742AB54813EDC3714E2F
SHA-512:	0D0509FFFC5720D7852E9E14CFCFECA424AF34C7882CA16AE873A885037247C2554DD2F4A29E06296D176CD76607E1DDDBD991BEFE39C723D254237B19F7DA02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,............." ..0.................. ........... .......................@....../.....`.....................................O........................&... ..........T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H...........H...........(.................................................(].....-.r...pr...ps^...z.-.ri..pr{..ps^...z..o_...(....2.s`...(......-.r...pr...ps^...z.(....(a...r...pr...pob.....-.r...pr...ps^...z.-.ri..pr...ps^...z..o_...(....2.s`...(........0..{........-.r...pr...ps^...z.......... .#Eg}...... ....}...... ...}...... vT2.}......+.....(......@X....i.@Y1.....i.Y...ij.jZ(....*..0...........@........(c.........(d..... .......8/.....8.(d.......(....+%....(.....@

Process:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1876128
Entropy (8bit):	5.363908993977671
Encrypted:	false
SSDEEP:	12288:fNCox7rt4YZIrvS92QEkvZ0sJqmvjC0eEL8P5PbNFkEkEkE3kauRp+HpD88vJZPy:fNCoZt/WvSIQEW0WqmfqbNYL+JDhK
MD5:	0A540D4D964BE671E0B359A6DF1BDDA3
SHA1:	35A3A95EE3CE802328EA0334ABCDA110CBD4A7C9
SHA-256:	8F0CD4EE8B8B590DD3E9A0AF236B4CBA2E99016603FFA8897F12BBBFEB36FB08
SHA-512:	B3E15FDA68B63D9604049799F23E54B5362851CFCDE6915870059BD9C75AC8C5330A3312A07C92B23FCF7D474F8E4A05CDA2FC21E60D65AB5CCB3C5B02CFD9D5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W\............" ..0..h............... ........... ....................................`.....................................O....................r..................T............................................ ............... ..H............text....f... ...h.................. ..`.rsrc................j..............@..@.reloc...............p..............@..B.......................H........H.. +...........t...... .........................................(W.....-.r...pr...psX...z.-.ri..pr{..psX...z..oY...(....2.sZ...(......-.r...pr...psX...z.(....([...r...pr...po\.....-.r...pr...psX...z.-.ri..pr...psX...z..oY...(....2.sZ...(........0..{........-.r...pr...psX...z.......... .#Eg}...... ....}...... ...}...... vT2.}......+.....(......@X....i.@Y1.....i.Y...ij.jZ(....*..0...........@........(].........(^..... .......8/.....8.(^.......(....+%....(.....@

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x305ff80a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585960028897053
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	FF6C4493FA3D795BDE92EE4D49B4D31A
SHA1:	A4759ADEAE965B91F39DB6136CA2F07EC7FA3044
SHA-256:	98D50A9293030AE39A21512FD5C3F9ABBBF4F56267537160D193985D27FD1344
SHA-512:	4EBBED422DE4A0D47C0A064B436273BFA7C84CC97826995A1DF91C55977B626D530410B7D3EFCCCECAEC1C99B725E53E289B18E283F23E0766A678CDCEF63821
Malicious:	false
Preview:	0_..... ...............X\...;...{......................0.z..........{.......\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................c......\|..................=].......\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Desktop\RazerLightInstaller.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	204723880
Entropy (8bit):	7.9990557438597145
Encrypted:	true
SSDEEP:
MD5:	CA3F48930FAC6E4993303ED46B654AAE
SHA1:	7C0C2814CB3CA68B6AF75B231765307025B952C6
SHA-256:	2D8FF949500B5D521CFDC7EAAF39CD6C12BEC2696372CE9DF6B4B9B6353D9572
SHA-512:	FA5C62473B5589BDE3789AF7853C62F9E77A2812172E5D5E4F190F23A7D3055133B13813198E626F747C33427F2C0C37D328B0F4A0FCBED8295BF4228F9BABEA
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...&....................@..................................R4...@......@...................p..q....P......................`.3.HK...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

Process:	C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1399608
Entropy (8bit):	7.918252678764315
Encrypted:	false
SSDEEP:
MD5:	06A2E5E560C43A75E3FAD213A293329E
SHA1:	02B5DA8171120F4DF2A9D9F58072AD282430E906
SHA-256:	4782E7B9C070385E6E16820E60E93867FD88D5DF333185B2B6719E8E054F771A
SHA-512:	B10EEAC723A1F41D977F713A8676F4094A8DAFB19A3BC554CFDED033B152DC4539C2900FF3184A220804850C8C2ACCFF9EE3DD44339D012E572E0B38AB706074
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a+..%Jj.%Jj.%Jj.J<..TJj.,2.$Jj....$Jj.,2.5Jj.>...Jj.J<...Jj..j`.'Jj.,2...Jj.%Jk..Ij.>....Jj.>...YHj.>...$Jj.>...$Jj.Rich%Jj.................PE..L...&V.\.........................@)...=..P)...>...@...........................>......I....@..................................{>.......>..{...........4..8'....>............................................................. .4.`...................UPX0.....@).............................UPX1.........P).....................@....rsrc.........>.....................@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

Process:	C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3554464
Entropy (8bit):	6.552250971049067
Encrypted:	false
SSDEEP:
MD5:	E815E3598EC16171A9AEB71715E530CA
SHA1:	DB1CD8E4A6D7780DB7A71EE57B86AA5395F11C52
SHA-256:	676337AA5696FB00B9011EBF27844E7985629E3BEF645E969FCD33E95F06C626
SHA-512:	FBAA87529139BB1647E3F162948A2A18E0AAB36ACD72A3FD99AEB8A06C9995F46285302FB9A471AEF16F730C7ACAEEE4B75B78FD5CD2018A75E0E58E4AA727E6
Malicious:	false
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................p6.......6...@......@...................P,.n.....,.j:...P0. .............5.......,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc... ....P0......./.............@..@.............04......`3.............@..@................

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.741171143309972
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RazerLightInstaller.exe
File size:	1'197'104 bytes
MD5:	d34cb39a1543239d2b96cf1dddcb677c
SHA1:	71eb3fcb2c48e08c23eab6a55c07357e72236011
SHA256:	664fe521a3c14cd0cddc8036efd187aa2aab886adee339a8c4eaad60d304eed8
SHA512:	b8d8289505c0b438749a03de7ba83a03fe1928615d50bcab07fb5ed35360e17369a2e41bfb7113d72292eda79795b93479c91034f22242a83fbcc4ef7c56eda8
SSDEEP:	12288:/uw4npxwx7sDgfOyI/XCn+tLZsDdfxu/RkBtbQ4MGlh29n5BAahk:/uw4pCfOLCn+NGdJSRaQ4MG7yn5a4k
TLSH:	5145B103E3B44E53D19FE3F5A57181A14BE1AC05E59DEB4AAFC4999B28877C0C92433E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.d.................N...........l... ........@.. .......................`............@................................

Entrypoint:	0x4e6cbe
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64DB4509 [Tue Aug 15 09:27:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	26/01/2022 01:00:00 27/02/2025 00:59:59
Subject Chain	CN=Razer USA Ltd., O=Razer USA Ltd., L=Irvine, S=California, C=US
Version:	3
Thumbprint MD5:	FE1E46391A1C799CABEEC9A17DA785B8
Thumbprint SHA-1:	0F31C62F9E9A852C87553E7E672DBC9A00026366
Thumbprint SHA-256:	13037B6948D7C84D765496C41071DD08C89D1D442EF0605CE1FBC52C87837726
Serial:	06C3E30F101B62FE0A499EB1189012EA

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe6c64	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe8000	0x3a1d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11f400	0x5030
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe6bc8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe4cc4	0xe4e00	52e92efe41ec09f0c5a748cad15321f2	False	0.3606891725832878	data	5.752470607370719	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe8000	0x3a1d4	0x3a200	684c15ac49e3991b9017b36154ac392a	False	0.12932207661290324	data	3.8660800630685763	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0xc	0x200	4ea75212166817e8406ec5c8f666fb38	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RazerLightInstaller.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Razer\Razer Axon\AWSSDK.Core.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\AWSSDK.Kinesis.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\Accessibility.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\AccountManagerClient.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\AccountManagerCommon.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\ActionServiceCommon.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\Axon.ico (copy)

C:\Program Files (x86)\Razer\Razer Axon\CChromaEditorLibrary64.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\D3DCompiler_47_cor3.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\DefaultScreenSaver.html (copy)

C:\Program Files (x86)\Razer\Razer Axon\DirectWriteForwarder.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\ICSharpCode.SharpZipLib.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\Ionic.Zip.dll (copy)

C:\Program Files (x86)\Razer\Razer Axon\Languages\common.de.xml (copy)

C:\Program Files (x86)\Razer\Razer Axon\Languages\common.en.xml (copy)

C:\Program Files (x86)\Razer\Razer Axon\Languages\common.es.xml (copy)

C:\Program Files (x86)\Razer\Razer Axon\Languages\common.fr.xml (copy)

C:\Program Files (x86)\Razer\Razer Axon\Languages\common.ja.xml (copy)

Windows Analysis Report
RazerLightInstaller.exe

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xe84f0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.4189024390243902
RT_ICON	0xe8b58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.5161290322580645
RT_ICON	0xe8e40	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.5942622950819673
RT_ICON	0xe9028	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.6182432432432432
RT_ICON	0xe9150	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.23853944562899787
RT_ICON	0xe9ff8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.23871841155234658
RT_ICON	0xea8a0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.25806451612903225
RT_ICON	0xeaf68	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.22471098265895953
RT_ICON	0xeb4d0	0x1f68	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9890547263681592
RT_ICON	0xed438	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.04359399029930202
RT_ICON	0xfdc60	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.06445764137061173
RT_ICON	0x107108	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.07609022556390978
RT_ICON	0x10d8f0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.08729205175600739
RT_ICON	0x112d78	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.07239017477562588
RT_ICON	0x116fa0	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 14880	0.10770777479892761
RT_ICON	0x11a9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.12811203319502074
RT_ICON	0x11cf90	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	0.15857988165680473
RT_ICON	0x11e9f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.16463414634146342
RT_ICON	0x11faa0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.27581967213114755
RT_ICON	0x120428	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	0.3325581395348837
RT_ICON	0x120ae0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.34131205673758863
RT_GROUP_ICON	0x120f48	0x12c	data	0.6
RT_VERSION	0x121074	0x36c	data	0.3972602739726027
RT_MANIFEST	0x1213e0	0xdf4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.4496080627099664

Target ID:	0
Start time:	13:00:58
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\RazerLightInstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RazerLightInstaller.exe"
Imagebase:	0x140000
File size:	1'197'104 bytes
MD5 hash:	D34CB39A1543239D2B96CF1DDDCB677C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	13:03:27
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=
Imagebase:	0x990000
File size:	204'723'880 bytes
MD5 hash:	CA3F48930FAC6E4993303ED46B654AAE
Has elevated privileges:
Has administrator privileges:
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	13:03:28
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-0UE70.tmp\Razer Axon_6828171.tmp" /SL5="$140246,203648975,1023488,C:\Users\user\AppData\Local\Temp\Razer Axon_6828171.exe" /SP- /VERYSILENT /SUPRESSMSGBOXES /NORESTART /psh=
Imagebase:	0x250000
File size:	3'554'464 bytes
MD5 hash:	E815E3598EC16171A9AEB71715E530CA
Has elevated privileges:
Has administrator privileges:
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	13:03:29
Start date:	02/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6a5670000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	13:04:09
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-J1S3T.tmp\RazerCentral_v7.16.0.695.exe" /S
Imagebase:	0xe00000
File size:	124'421'608 bytes
MD5 hash:	D98EA6EF1E5FA74AA5E91E567F912CAF
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	9
Start time:	13:04:10
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0xb30000
File size:	1'399'608 bytes
MD5 hash:	06A2E5E560C43A75E3FAD213A293329E
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre