1988e9a4716e60e5b6fd98a3c9dc1d599ff5052f47ae223ebb1f57dc746b3388

Analysis

max time kernel
301s
max time network
297s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f827.exe
Size

7.1MB
MD5

77dc41db519fab01bc4a5824b53cc341
SHA1

4686b44d75ef755be47310a4ec93e92287958565
SHA256

1988e9a4716e60e5b6fd98a3c9dc1d599ff5052f47ae223ebb1f57dc746b3388
SHA512

c02b34a322ea6a5971eacd854f079880cf7d842a8d6e0d19148b63f199247edbb89b46104b554ea123367bda188ebad324672e5484955362bc41306ccddf77bb
SSDEEP

98304:wST/lfZzFcaeYZ0kc2Jo2Tb45Tb7Nkf/OCDm9sv+xUrA6Mv3WFKKTj2un60T28TK:w6Zh1I2JFTb45TPaf/vmOvo5KVBTZsr

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1144	Syncro.Installer.exe
1224	Syncro.Service.Runner.exe
960	Syncro.App.Runner.exe
952	tmp1E45.tmp.SyncroLive.Installer-latest.exe
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1480	7za.exe
1096	7za.exe
588	7za.exe
1168	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
692	SyncroLive.Agent.Runner.exe
1752	Syncro.Overmind.Service.exe
1716	Syncro.Overmind.Service.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SyncroLive\ImagePath = "\"C:\\Program Files\\RepairTech\\LiveAgent\\SyncroLive.Service.Runner.exe\" -displayname \"SyncroLive\" -servicename \"SyncroLive\""	SyncroLive.Service.Runner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SyncroOvermind\ImagePath = "\"C:\\ProgramData\\Syncro\\bin\\Syncro.Overmind.Service.exe\" -displayname \"SyncroRecovery\" -servicename \"SyncroOvermind\""	Syncro.Overmind.Service.exe

Loads dropped DLL 9 IoCs

pid	Process
952	tmp1E45.tmp.SyncroLive.Installer-latest.exe
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
692	SyncroLive.Agent.Runner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	SyncroLive.Agent.Runner.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	Syncro.Service.Runner.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	Syncro.Service.Runner.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	Syncro.Service.Runner.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_52894DBA51C2BA5ACE3EE5577FB04C4C	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_52894DBA51C2BA5ACE3EE5577FB04C4C	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	Syncro.Service.Runner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\RepairTech\LiveAgent\unins000.dat	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\cs-CZ\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Flurl.Http.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\nl-NL\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\unins000.msg	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Squirrel.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SyncroLive.Service.exe.config	7za.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\fr-FR\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\ICSharpCode.SharpZipLib.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\ru-RU\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\is-S2T30.tmp	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Cassia.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Destructurama.Attributed.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\RollbarSharp.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Serilog.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\pt-BR\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\System.Threading.Tasks.Extensions.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\websocket-sharp.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\ja\System.Spatial.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\Microsoft.Win32.TaskScheduler.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\pt-BR\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\fr\System.Spatial.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\Images\kabuto-logo.ico	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Interop.IWshRuntimeLibrary.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Service.Configuration.dll.config	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\System.Spatial.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\SystemWrapper.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\zh-CHS\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\zh-Hans\Microsoft.Data.Services.Client.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Itenso.TimePeriod.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\Microsoft.Data.OData.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\nl-NL\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\FluentCommandLineParser.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SharpDX.DXGI.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SyncroLive.Service.Runner.exe	7za.exe
File created	C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\RepairTech.Common.Tools.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Microsoft.Web.XmlTransform.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SharpDX.Direct3D11.dll	7za.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\ar-SA\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\de\Microsoft.Data.Services.Client.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.InstallState	InstallUtil.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Microsoft.Bcl.AsyncInterfaces.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.Sinks.File.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\System.Security.Cryptography.Encoding.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\de\Microsoft.Data.Edm.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\de\System.Spatial.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\Splat.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Destructurama.Attributed.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Microsoft.Data.OData.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SharpDX.Direct3D11.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SystemWrapper.dll	7za.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\es\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\ko\System.Spatial.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\Microsoft.Data.OData.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SharpCompress.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Splat.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SyncroLive.Agent.exe	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\UrlCombineLib.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\de\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.167\ja\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Contracts.dll.config	Syncro.Installer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	Syncro.Installer.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
864	sc.exe
1464	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SyncroLive.Agent.Runner.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Syncro.Overmind.Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = b806000090fee7867cd3d801	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SyncroLive.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SyncroLive.Agent.Runner.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	Syncro.Service.Runner.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1"	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Syncro.Overmind.Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Syncro.Overmind.Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 767f610f910b41098256bc3ad4ee3a32662d32c3d94f9bb3eb68ddeeafdb3337	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Syncro.Overmind.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Syncro.Overmind.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Syncro.Service.Runner.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	SyncroLive.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Syncro.Overmind.Service.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Syncro.Service.Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Syncro.Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Syncro.Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Syncro.Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Syncro.Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Syncro.Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Syncro.Service.Runner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Syncro.Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Syncro.Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Syncro.Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Syncro.Installer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1144	Syncro.Installer.exe
1144	Syncro.Installer.exe
1224	Syncro.Service.Runner.exe
1224	Syncro.Service.Runner.exe
960	Syncro.App.Runner.exe
960	Syncro.App.Runner.exe
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp
1224	Syncro.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
692	SyncroLive.Agent.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1224	Syncro.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1224	Syncro.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
692	SyncroLive.Agent.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1716	Syncro.Overmind.Service.exe
1716	Syncro.Overmind.Service.exe
1716	Syncro.Overmind.Service.exe
1716	Syncro.Overmind.Service.exe
1964	SyncroLive.Service.Runner.exe
692	SyncroLive.Agent.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
1964	SyncroLive.Service.Runner.exe
692	SyncroLive.Agent.Runner.exe
1964	SyncroLive.Service.Runner.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	Syncro.Installer.exe
Token: SeDebugPrivilege	1224	Syncro.Service.Runner.exe
Token: SeSecurityPrivilege	1224	Syncro.Service.Runner.exe
Token: SeSecurityPrivilege	1224	Syncro.Service.Runner.exe
Token: SeDebugPrivilege	960	Syncro.App.Runner.exe
Token: SeRestorePrivilege	1480	7za.exe
Token: 35	1480	7za.exe
Token: SeSecurityPrivilege	1480	7za.exe
Token: SeSecurityPrivilege	1480	7za.exe
Token: SeRestorePrivilege	1096	7za.exe
Token: 35	1096	7za.exe
Token: SeSecurityPrivilege	1096	7za.exe
Token: SeSecurityPrivilege	1096	7za.exe
Token: SeRestorePrivilege	588	7za.exe
Token: 35	588	7za.exe
Token: SeSecurityPrivilege	588	7za.exe
Token: SeSecurityPrivilege	588	7za.exe
Token: SeDebugPrivilege	1964	SyncroLive.Service.Runner.exe
Token: SeDebugPrivilege	692	SyncroLive.Agent.Runner.exe
Token: SeDebugPrivilege	1716	Syncro.Overmind.Service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
960	Syncro.App.Runner.exe
1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1144	1504	f827.exe	26
PID 1504 wrote to memory of 1144	1504	f827.exe	26
PID 1504 wrote to memory of 1144	1504	f827.exe	26
PID 1144 wrote to memory of 1284	1144	Syncro.Installer.exe	28
PID 1144 wrote to memory of 1284	1144	Syncro.Installer.exe	28
PID 1144 wrote to memory of 1284	1144	Syncro.Installer.exe	28
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 364	1284	cmd.exe	30
PID 1284 wrote to memory of 864	1284	cmd.exe	31
PID 1284 wrote to memory of 864	1284	cmd.exe	31
PID 1284 wrote to memory of 864	1284	cmd.exe	31
PID 1284 wrote to memory of 1464	1284	cmd.exe	32
PID 1284 wrote to memory of 1464	1284	cmd.exe	32
PID 1284 wrote to memory of 1464	1284	cmd.exe	32
PID 1224 wrote to memory of 960	1224	Syncro.Service.Runner.exe	34
PID 1224 wrote to memory of 960	1224	Syncro.Service.Runner.exe	34
PID 1224 wrote to memory of 960	1224	Syncro.Service.Runner.exe	34
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 1224 wrote to memory of 952	1224	Syncro.Service.Runner.exe	35
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 952 wrote to memory of 1720	952	tmp1E45.tmp.SyncroLive.Installer-latest.exe	36
PID 1720 wrote to memory of 1480	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	37
PID 1720 wrote to memory of 1480	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	37
PID 1720 wrote to memory of 1480	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	37
PID 1720 wrote to memory of 1480	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	37
PID 1720 wrote to memory of 1096	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	39
PID 1720 wrote to memory of 1096	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	39
PID 1720 wrote to memory of 1096	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	39
PID 1720 wrote to memory of 1096	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	39
PID 1720 wrote to memory of 588	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	41
PID 1720 wrote to memory of 588	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	41
PID 1720 wrote to memory of 588	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	41
PID 1720 wrote to memory of 588	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	41
PID 1720 wrote to memory of 1168	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	43
PID 1720 wrote to memory of 1168	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	43
PID 1720 wrote to memory of 1168	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	43
PID 1720 wrote to memory of 1168	1720	tmp1E45.tmp.SyncroLive.Installer-latest.tmp	43
PID 1964 wrote to memory of 692	1964	SyncroLive.Service.Runner.exe	45
PID 1964 wrote to memory of 692	1964	SyncroLive.Service.Runner.exe	45
PID 1964 wrote to memory of 692	1964	SyncroLive.Service.Runner.exe	45
PID 1224 wrote to memory of 1752	1224	Syncro.Service.Runner.exe	48
PID 1224 wrote to memory of 1752	1224	Syncro.Service.Runner.exe	48
PID 1224 wrote to memory of 1752	1224	Syncro.Service.Runner.exe	48
PID 1224 wrote to memory of 1752	1224	Syncro.Service.Runner.exe	48

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SoftwareSASGeneration = "1"	SyncroLive.Agent.Runner.exe

C:\Users\Admin\AppData\Local\Temp\f827.exe
"C:\Users\Admin\AppData\Local\Temp\f827.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe" --jwt-payload eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJ2ZXJzaW9uIjoxLCJpbnN0YWxsIjp7InNob3AiOiJIQUJCOTJuTlQ0X081UlBVRlJEV3dBIiwiY3VzdG9tZXJfaWQiOjk5MzQ3MCwiZm9sZGVyX2lkIjoyNzYzMTAxfSwic2VydmljaW5nIjp7ImNoYW5uZWwiOiJzeW5jcm8tcnRtIiwidGFyZ2V0Ijoic3luY3JvIn19.chGCuHgDg4pApnvD7hOGeh-cDIBWICZM-QWSjfJflkCCQV4Q_lrnPFISr9avhoiKDKnorD1kf53mceJNT8Hdbg
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c "C:\Program Files\RepairTech\Syncro\install.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /ShowCallStack /LogFile=C:\ProgramData/Syncro/logs/ServiceInstall.log "C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe"
      4⤵
      Drops file in Program Files directory
      PID:364
  - - C:\Windows\system32\sc.exe
      sc failure Syncro reset= 60 actions= restart/5000/restart/10000/restart/60000
      4⤵
      Launches sc.exe
      PID:864
  - - C:\Windows\system32\sc.exe
      sc start Syncro
      4⤵
      Launches sc.exe
      PID:1464

C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe
"C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe
  "C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:960
- C:\Windows\TEMP\tmp1E45.tmp.SyncroLive.Installer-latest.exe
  "C:\Windows\TEMP\tmp1E45.tmp.SyncroLive.Installer-latest.exe" /VERYSILENT
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\TEMP\is-V5H7M.tmp\tmp1E45.tmp.SyncroLive.Installer-latest.tmp
    "C:\Windows\TEMP\is-V5H7M.tmp\tmp1E45.tmp.SyncroLive.Installer-latest.tmp" /SL5="$70040,13891222,57856,C:\Windows\TEMP\tmp1E45.tmp.SyncroLive.Installer-latest.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\TEMP\is-CLIB7.tmp\7za.exe
      "C:\Windows\TEMP\is-CLIB7.tmp\7za.exe" e "C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg" -o"C:\Program Files\RepairTech\LiveAgent\app-0.0.62\" lib\net45\*.* -aoa
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:1480
  - - C:\Windows\TEMP\is-CLIB7.tmp\7za.exe
      "C:\Windows\TEMP\is-CLIB7.tmp\7za.exe" e "C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg" -o"C:\Program Files\RepairTech\LiveAgent\app-0.0.62\x64" lib\net45\x64\*.* -aoa
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1096
  - - C:\Windows\TEMP\is-CLIB7.tmp\7za.exe
      "C:\Windows\TEMP\is-CLIB7.tmp\7za.exe" e "C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg" -o"C:\Program Files\RepairTech\LiveAgent\app-0.0.62\x86" lib\net45\x86\*.* -aoa
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:588
  - - C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe
      "C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe" install start
      4⤵
      Executes dropped EXE
      Sets service image path in registry
      PID:1168
- C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe
  "C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe" install
  2⤵
  - Executes dropped EXE
  - Sets service image path in registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1752

C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe
"C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe" -displayname "SyncroLive" -servicename "SyncroLive"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\RepairTech\LiveAgent\SyncroLive.Agent.Runner.exe
  "C:\Program Files\RepairTech\LiveAgent\SyncroLive.Agent.Runner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:692

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2012

C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe
"C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe" -displayname "SyncroRecovery" -servicename "SyncroOvermind"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe

Filesize
32KB

MD5
23d83dd2a0bd3ae532851b79d5f3940d

SHA1
7f308859d0de11cb61d6528296b6269f6c92915d

SHA256
f3d36b34b75e8bf262dae2176abad3d5d553bb60de70387348c98b468287500d

SHA512
867cea111fc04ff20a572e91552ae5c994162ff6cde4efaf7820f6b9a5104a2db2b351f1b2d036791b275d025c8945216c7a95873c29bab4e3fdec3f138824fe

Download Submit
C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg

Filesize
12.3MB

MD5
0214bc09f76c5c121d09b5cd0637790d

SHA1
93996294124c104b8015ed6315cfd2062baf1e19

SHA256
19377d455a7c228ced463f798ec33688045ab6eb892ba4bdb29a9225de16d6ed

SHA512
a228fc75b2b496a755628eac822b188f8381dd5fe52f74035d9d866512dcf20b7542ab72038aa104402249be4e810ed3a5e99f67f37d94ca62e995f84659bb5a

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe

Filesize
32KB

MD5
1aa2d8a5d3ecc3aa134528b7117244b3

SHA1
0b149d62a7883c6c903118c7b6886a981d1ff31c

SHA256
60abbb3e61ba60715051790ad84703855455a24533e6e68b7fd0791b79d37b14

SHA512
500938e0df236efc0242a81bfbef2c9f8a7ca52644fd1c05146c7a4333f8d525d57169ac38cce945d0cdc6759601e41e17db06f71fad8e5436fe94c0d050d958

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe

Filesize
32KB

MD5
1aa2d8a5d3ecc3aa134528b7117244b3

SHA1
0b149d62a7883c6c903118c7b6886a981d1ff31c

SHA256
60abbb3e61ba60715051790ad84703855455a24533e6e68b7fd0791b79d37b14

SHA512
500938e0df236efc0242a81bfbef2c9f8a7ca52644fd1c05146c7a4333f8d525d57169ac38cce945d0cdc6759601e41e17db06f71fad8e5436fe94c0d050d958

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe

Filesize
36KB

MD5
55d568af3444a7319dfdb2ddc0a6bc2f

SHA1
e6fb8fc639c71c2ef922ed9f36b29cda45622292

SHA256
10c8cd588d627f46df3a7385e07d36674c2f0374e6327c7f9595cb22d8635753

SHA512
1cdb5edd9ed982e6eaa20042efaa4e57a5d6b6927c921d06accad2493bc7ac6d7444a2467b38b82a5a6cd3c7d8bf59e32ba0e858290327770007914818fac3a5

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe

Filesize
36KB

MD5
55d568af3444a7319dfdb2ddc0a6bc2f

SHA1
e6fb8fc639c71c2ef922ed9f36b29cda45622292

SHA256
10c8cd588d627f46df3a7385e07d36674c2f0374e6327c7f9595cb22d8635753

SHA512
1cdb5edd9ed982e6eaa20042efaa4e57a5d6b6927c921d06accad2493bc7ac6d7444a2467b38b82a5a6cd3c7d8bf59e32ba0e858290327770007914818fac3a5

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Autofac.dll

Filesize
247KB

MD5
94bce38faf97857d39b9348f43664317

SHA1
8adf558ad484b47a94e199318a4fad70eab0f090

SHA256
0bfa585a98172330547fec4bda0d747afea4b01bc691378dfbef2ae82d110dd4

SHA512
e7ca307423aa8527b379a88f2bcf2cabe34b58d04b2f979ad4ae11867fa6a08984ca5212706f749fcfab5338e0cceefa1dd35bfa8e9921fa40ec8cd0c8caab8d

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\CSharpFunctionalExtensions.dll

Filesize
125KB

MD5
841e154928ed4f18c7750a39780d118b

SHA1
f383e8aae69a942ffd0915122f67b0f963d6c119

SHA256
dacbb5f45d70b290bbed42249c06d26cf65440e63f2ac1c8db125e808a693bbf

SHA512
22e68af198233d374e609809666bc8d77f1afc741c1436fcdd321ccd7bae8a52663e7284350211cdc640cd29af550084b52343b79e8584464733200ad74bfdfd

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Destructurama.Attributed.dll

Filesize
15KB

MD5
7eabdc9525bd1814899de66fef6be715

SHA1
04cf3922eb9d39adf9e3acfe7cb5246c5f718c86

SHA256
ac6ef04b83ca3ec163e6998ef4904434bffc0405a793ae5dbb2e800e3984dabb

SHA512
a0b95e6f5212ea7c2cfa52e372143973f72254aeb67fe6032b1db58b840f93ec9da87e565bb696417bb5bd7b6dd9a3a35af461cf51b0651fb2419ead79ccadd0

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\FluentCommandLineParser.dll

Filesize
51KB

MD5
de2b96fbe5b4104094389d69afb3ee4e

SHA1
d264d7519a6f4b6a6df6f39a382e352d4a48acdf

SHA256
0118168035446602ef5ca6f5426f8d54975f58613c3898e0b6689d92a35c589f

SHA512
c73a93fcbffdcbfa1b1c5928ab4304eb172710cd4ea3795796edc6e08145078199a4b0208464438d08fc569212fc11778b1d2c86ed7e6ee7e3b86f5321f33b03

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Flurl.Http.dll

Filesize
103KB

MD5
67c42a9cd1262c422f8ea562805f0294

SHA1
23d99f695530cb18bf9009668bb414338c953f60

SHA256
62d4336b23c78955d9e51573935102beadd58bdb19530bb6d650cf39f4d8bc30

SHA512
881cf4f3fb64dd2d1f42146abec7bfddf95a80a131774d7a6196b54197161866bfc09e1b6f16074f96454aecec3a03540b706e2c43df828a7c954e57e282ccca

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Flurl.dll

Filesize
35KB

MD5
88d6cef2bd73709f7f35d6cdb63c6b52

SHA1
9ec6e0b10922101af0135d40f2a5fcbb798002a4

SHA256
17714b55721d04c35ebb4898afd9e267e3cb04b25beb8bda9a460c52587955f5

SHA512
c187f53222988c23f45946cfce5e18d32c5ac3af22e65097aafcef0f3ddbc83f3c0acb02a90cf16c5241a0dda5162674ee7bd2627e1da38c13fff22bdf8febf8

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Interop.NetFwTypeLib.dll

Filesize
22KB

MD5
65a6be1f8674bf2489d8e858ee8d7e65

SHA1
46a5a710f2fceb5c4daa7150a4b2517478fff0ae

SHA256
72a5ad582c5e1f754256a5de51ad01602ba23b295172de0efd27137affc44454

SHA512
333d1756b30b802c1ba3a690381238da8d356944ffc4fa1f49d9f97374d476de1989e66613fe97ddf8c6db76c567cd6f4f58651452baafd899d4c4e5c24c922c

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\MetroFramework.dll

Filesize
343KB

MD5
d9fc57f451780a9afee72d870b460d4d

SHA1
6554fd655df6efd3f5de4559b915ceeb11a8ef41

SHA256
fd45b9b900e163ab1aa6e703408ea281be3292089d4b45b646e826df02e3c88e

SHA512
1c8b9f67400a43596e289b3c44c27f55da87a88578a336f5933a81f808074bb5c79cd40e9cb706f81eb4d433ff4af1c4f5d02af2a79ed8860d6a1d42eaa338d3

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
20KB

MD5
5220eefd7753e11b99d73faf39fbb486

SHA1
7d8264be4fcb17f81acb8b1add980cd96a6fd856

SHA256
ed5bc605f7f9fcc382183abef06c354dad946abb42a07631712077b2157d6bc9

SHA512
81e483bd76240543704194c0eb0c8a9e7dc46aa535653e7d5590e00c002b2980237ada793c05c0eedd5d1a92de90055867b21be665ff94fac038e280939c66c1

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Microsoft.Win32.TaskScheduler.dll

Filesize
229KB

MD5
3b64aebb9d2a910b6839b56c84653a9b

SHA1
0fdd9adc8048547cf3328295db2ac291f5c6b81b

SHA256
fcc18b30e67afe2e5e037ec4e2bcbcf1153e0c257dc26dc48084676a87be2486

SHA512
463a3fb2957bdbbf6effa43562e331a24aa49d1c5dbd0509773f5d3ba2830d93a684876c5eea0b744a2fec7d7b70e12c1d1533c671ccf590f53aaaf9252d23f0

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Newtonsoft.Json.dll

Filesize
659KB

MD5
4df6c8781e70c3a4912b5be796e6d337

SHA1
cbc510520fcd85dbc1c82b02e82040702aca9b79

SHA256
3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af

SHA512
964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\NuGet.Squirrel.dll

Filesize
501KB

MD5
027f049a2a46dec069feea75a41959f2

SHA1
0ae7cf7ec68d77b090c9fd2a2f94177ac0b83001

SHA256
c3da58593f6a9083518b209145b176277ced95fcab6713c7f24fd65103be032c

SHA512
b3b1d1d08fb2aced9bdcf4d297033bb0234ee93c69e6ead110697a2e420634ae70c0270a18f27ba47a55e14a38902da5faf2fc41609cfd139e0bcebcdff85abd

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Phoenix.dll

Filesize
19KB

MD5
740b42f4425d77963dea08725e183fb5

SHA1
5fe5ba99a89a543dda4b0666d4ec194fa4482d32

SHA256
3c1a8f21d4f493229ea5590254e1e92415f05c6294a1a41f29df332dee2014a7

SHA512
69250a7670ba0a886b1603d5b29a392d6fb274be28e2557702038287373bd7007c56edd2ff3d95b4e9a1eb3bc8de2dc0cc62fe5513fa015e01bf69a5e85688a0

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\RepairTech.Common.Tools.dll

Filesize
272KB

MD5
f7c1260c791bffd642254c712ae6c8bd

SHA1
abd31d5a84583999181c5d0ed4c7948533792529

SHA256
9e74dc561d2a9eae6fbf4709f0aa5275c28e571690c52859445dfc7ff24ca566

SHA512
3c52e538537e302e9dbacbabe5c68cd420a6386b9702d5cb0a2e84d592b508733f04aa6b02e528d4afdaf442994ecbec50f0490b590924f2dd15afbc1b255c6a

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\RepairTech.Common.Wpf.dll

Filesize
52KB

MD5
1df29ba0ee65751dced59e89e336b648

SHA1
93859e7d2994a62cb6f129faadc092b381466e55

SHA256
e0711690bd0f9a6d552ea3a9e309fd0fa7d4e5d06c35e6afdb545833a4ee78cb

SHA512
36167985283ecc8da4e80ba1823147c6aa5dd6582b9f83b9ddfe674692815138637f69f1e4d29a261b479c20eeedeb5b4c4eb6929d775e09ca9afb743afe4f85

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\RestSharp.dll

Filesize
167KB

MD5
b4aaa21288c1d923150c8d88b6ece126

SHA1
6d99e70ab9511aee701ff7068b5792f4194377bf

SHA256
b539f648dab37f211acb38dfcf4c79b488fa3beb5a7edf6740f894d2d1807449

SHA512
0de9227f5d134fc6b7029fb8202beade5e30be1f236e785eaae534cb0e944a98d9adfa2dd1917138994cfcfa2047a45c935f2b4f96944ed3dc017762ab9e08ca

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\RollbarSharp.dll

Filesize
36KB

MD5
7931fd2a2e06c7a654c9edfe388a8033

SHA1
2fb6de045f81bd56fce6a367dd992efc73ba4405

SHA256
cd722eda12d89b33cc00fa7e967eb6837b8335fada88368a6896d357f4362c15

SHA512
33ff92fa6dbb93b97c739ece89433c7ed34106e91cd76eb2431d0e840338af3dd456c3116b8362de33906eb348ad7eded630e28a98c94536ee8c1f3baf8f6b80

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.Formatting.Compact.dll

Filesize
8KB

MD5
fdb7ad01c66a0c96174300167fadd249

SHA1
38b9971de844165f164e37e2d234d16f6022636c

SHA256
2d7dec266c5436f58ab620db4e3b5c83e550e7f76caff26eae8186b14b52cdd6

SHA512
13df8a0ec363dc3a8f80114c64869db6f1233ae250df1bf48260cf62588065200d5a920f7d16d41faac4ddd4b9edd4d3383d1bbdb1849d120a145175d3a74d4a

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.Sinks.Console.dll

Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.Sinks.File.dll

Filesize
25KB

MD5
6509ca95a38ac29c03379113172cacb7

SHA1
f94b8d751fefcd29d28875e291fd570e103d12d7

SHA256
85ad8530adc1dec3b97f2074c720b81528ba5ea6c7274e1a98a906304bccd12f

SHA512
d8bd0b8998725e2fa361bcb446f48b6105bd603707bf914bb978c63b5c40958bcd2a3fef1f666541793f1d06377f3f2967d1241e445bee6919eb8f84f5a5d7f5

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.Sinks.Literate.dll

Filesize
5KB

MD5
a0ebef9e8cce247cc12310a03b38aa7e

SHA1
22848b43d3b7f99cea7b339e86fcb4c08d7e6e51

SHA256
5e2e204439217c960237a894548680b39d5972fabfa3009538f43530eac23a3e

SHA512
53dc332b0329899883e019a4adbead244c65324fc4654c6c4d8080b3f2cc1953f2d0c61ac3507d00ac85c9cb98d711e127df335e334a3e2b2e70e59e3239d758

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Serilog.dll

Filesize
115KB

MD5
fbfbf8c2de7f389105d728037bfcc11f

SHA1
91dd7e807ffcfdc9cb67f5a75d85dcf537475583

SHA256
e7c7528f8a920988862b8c22d0ae4c40df6824332780c1cec41d84fe633b6bed

SHA512
264667b13ff54e8ae24663f6ea11225794946c5db34d440bd68cc90c940c92d1da7faf39dfa551d13a19f5e21c82130662ffab2a2e2ebfb004576d880e9fb369

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Splat.dll

Filesize
45KB

MD5
1975e684c48457d72f37696bb1b880e6

SHA1
eb254b470df9172aa07f13e7280bced746d95e22

SHA256
7a6f255cf59d6594c8f5bc466956f09305a3a10c8d683e485c7e1f14371701c4

SHA512
edb06da485e4dc562c7833ef887172be5ddb4d36a041463dc662ccafaa8fad816306091f774a7463f1538ad1c62ee9433bd12673d943bd885bf2cb38fc633a08

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Squirrel.dll

Filesize
235KB

MD5
d550332bbab5b5a0df621ef3ed1677a4

SHA1
2c198adf77df29c30f64ab28ced1b5f18f8c446b

SHA256
07ef7526245209dd607f7a34c54a9c9d9d2d3639d75ecb7c618cfcc6db61b461

SHA512
6e58e4b6b8fdbc97136fb51bc7835952fb18d36d77da78c261cae03b77b1a964650d64c7f1cfb3a294dd3deacf939ab1df09a41fb025a8944de0ccdb056a9b16

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.App.dll

Filesize
432KB

MD5
ecbb9ee0101467b4e3de1cfd8e7f7eba

SHA1
8e128396cf3b760e7ef253bdb87411da924c171d

SHA256
2d2c4500a56ea13099bff813d1488a497c8a2b7ff59df8a9cadd6d1b89b52ca3

SHA512
67b62ae6baa8e7d3cc3fbf6463f5b4d49a357e8b11b5417bcdc0a232d2d2103c98dd5bda89f899db25990649c4e043b26106a2ab0ec8298b4d9682eb4bc880a4

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.App.dll.config

Filesize
3KB

MD5
29a3fb17a36c73f4c578b948950572f0

SHA1
7fbd63662d4ca33028cc23828849461b6422609a

SHA256
6d3ce7aa37dd56dbfca1770777d414e9683dce6e402f031fc2f7cbb98fdd82c6

SHA512
63ac42a22ebba9ba5bbbe20113ce97889f27d1869ab6334e0871c5a7184354548d0225efb344a7dee8cd545ab13b052e13f207f9b4c2ef7e5eaec33bb90acce6

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Contracts.dll

Filesize
106KB

MD5
20ee66f7d35817b0b11156fc75b417e0

SHA1
5012c2b717d2af98960b6f5b88175b23d860e3cf

SHA256
983813a02824802461de07d57d6fcac4300defe70d9795518a12a23053c111c2

SHA512
2615961d538c9a2109a2d54a62b314ea62f7716160a2a4aeb80dfa6ac66238f35e6229c31dc8a42dde0181112ace2405d664d98f5566dc0bd03f23eeec6fb48c

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Service.Configuration.dll

Filesize
10KB

MD5
ddd20f1a5cd34bd89e0fb5778b9346f6

SHA1
5a66a3b36f657fcca26081e64cb9711a8c2cad6f

SHA256
4d0580d07338eaa258814d5715218fd8a87491df4601cb2e825ab6b9b8e556ad

SHA512
c6ea5ac534b5ff1799691933a32450eba3d462865d1a52a71487d813b3c7c834f575d614ed56b8a0f2bce213314a545703ce277b7f26c72507b8fb76fa711ea4

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Service.exe

Filesize
1006KB

MD5
d34cde8d4d8030dadc57c9afd660447f

SHA1
860e88ca711a7ccba913c5a91bdcc975c2fd827b

SHA256
2eedd9416a32028edcce8b50ed491cbdf18391e5c3f9b362564c93d8c1f7d411

SHA512
0ff13fafa515292bc5353319abc97950eb16dd0294d8ba4f6348707d293b2bf002f497b44c1017e894be6b3bdde0fa80b123a8f805033e367a52feafedbbca0f

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Service.exe.config

Filesize
4KB

MD5
8d8995a5b322b505d622af6cd2bfdffa

SHA1
56f353b5df27ff2dc98f9fef29bdab086a8a0fda

SHA256
5af11c9ce145d76e865f091da12d3cc70f84e069e790dc54eb2c93b92b84fa8c

SHA512
a8d0e6a67ec700e37b19fde7768bc3d2b8db6d90b96b7e276fad8fb3d851508f718ce0370b06c26cdeb87711b24798925150ec56ed20b48c46a51fe3c8801834

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\Syncro.Tools.dll

Filesize
83KB

MD5
470a24154426f34fe5a1f34747ff430f

SHA1
683c9635c869319438353686be39c9f5a148d93e

SHA256
f664f33e90c0ba43aeb8fa94c965f2086a98011cc1c07925cb26da22476029d7

SHA512
aa3cf7bd1d6167e371019a047cb10d81f117ff9c50dad90ea7cbc228b0c041454498a5840d3d995556cec4bd072975fd58ef8003e8e57c26d63d61feeb78a271

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\SystemInterface.dll

Filesize
87KB

MD5
6c19cad7d00cee4e4aae931b79c0cbd2

SHA1
b8e275ee742584b017fe48918d35edfbba97c1b8

SHA256
e9ecc8b5c887b3eb58523d108aa7a74340c5b5270aa3182d5dd1fc363afdbc02

SHA512
c1892e5b45a4c48a342fe869c43e2348c6d21dd14771ee0c4a59ff1eca6b9b77b2742e54106d956e9f7c7c9ea13f9d41b6a2ef1b4f9a036a96e76b9373c58363

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\SystemWrapper.dll

Filesize
174KB

MD5
e5dd264a7dc69d6f9bb85919984955a3

SHA1
4d83ac11160295835f3c8266e9d96f49446e0023

SHA256
122dabfe8a6b37cbbb6b062ca99fc567128037178764b9b0965706938ded6d05

SHA512
640316365ed262bc4725b9c103bfa9754dce44e74b9a18dbd7fe9f413cd8904a7ad9282796eb2b1253f3039c789bb513746f517c37d4ba0057e8cdc375939d20

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\config.json

Filesize
869B

MD5
b8131bcfde5af2f88c7ebe90bbbab965

SHA1
a82ff00ad442d1af4356fcf8729abb3164077be1

SHA256
f22f770c78a63b75d079a2b919938613edf10a1360a05b64e42aeb676e868efb

SHA512
5b1d052dd5e96082d64bd61531b3cd3f48861929e62de2bf7022d9d39e0d02bb08655832538f7fbce241b07755c51d7b1a96ad6ebc46204e24742e011a9ada28

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.167\en\Syncro.App.resources.dll

Filesize
39KB

MD5
6eddb83f9ef2e6a98ce9f9b9d025570e

SHA1
9a3b15bb6b06983ea5a2bc1924f160f2fe418cb4

SHA256
212bff63272382948247b717ca851a19fc0b3fa35c81b922bccd40acee4dfc78

SHA512
5a45bae48404db3127428a93d40b12ae70211d902ad3fb06ae0003a72fa2f9c45f7177cec34f96afd0f29acb0ecb68e228c257b53e748a6450c8763f73454143

Download Submit
C:\Program Files\RepairTech\Syncro\install.bat

Filesize
639B

MD5
e3eb8d69316f0551bda4908c44d8684e

SHA1
dc8d0350c67f2a9b4a2adec253863273c26aa760

SHA256
8952ea8c7a55898f87d131886cad0ceb966ad4475c701ea6590d906bfc6dc0af

SHA512
b276ab4113ff39c715b840d84916c49319d03b8458dea0bc9c1f23f87a331dac1975e5c596c088cbdf44c50e5a9bc54ddfdbb5fe9363f7496ce242dab3f37865

Download Submit
C:\ProgramData\Syncro\Images\logo.ico

Filesize
14KB

MD5
940cfaf4c3be79e182f60375900fc2b3

SHA1
4c476f0b6eeb7a99912b1a5b2a7ee43c96d40baa

SHA256
97dda1267bb780b5c073d57367fc3590548fab97b9d90ee86d5a55dffd5847e9

SHA512
774e2f1bd38a1145ad7758964276a74c3f8c7deb6932c5203a4c19050d3f4cf38ee71d6ac645c4a55ba3559ea031623267ea5ccd9fbf26a758234203d1590b90

Download Submit
C:\ProgramData\Syncro\logs\20220928-Syncro.Installer.log

Filesize
6KB

MD5
28ae112ce00cc2ad1ea0185561fe2cbd

SHA1
098e3c6231758706d71d8eebd82a7c85982d66d9

SHA256
ac4f0cf7198c4b8231da83406418a5500ae06f40c34c312523589cfec83956eb

SHA512
89f67651d52a13a63a59d5dd57df91ad77a0d011a49063768529fcd16bcb24841eb29158c96ddde66dd6a62fe7123df256c939ee602089b99cee833882964eb1

Download Submit
C:\ProgramData\Syncro\logs\MasterInstaller.log

Filesize
1KB

MD5
2660c6950ba3ceba43d8221b1aa5e5cb

SHA1
9f2e28ae966c148289426eea53a22d148a1e943e

SHA256
3dc64aaaf96be2d0bbb338a4726803284674ff8ce5844278e872173490f01f09

SHA512
05c03ecc29970d55d737cd7f1450a37387be9d314e8e5025122d6d581aca0819961541309fb410bb4e2a8ad6c66735902ed67e3cbfd64c2f8005b95806f748a4

Download Submit
C:\ProgramData\Syncro\logs\ServiceInstall.log

Filesize
1KB

MD5
5be5998b9b6bdae1128e45955f106f79

SHA1
2383b5d93f47be54fe89f6184cb764bb756156f2

SHA256
f10d0f36784db77a8b3c39ca688d36678fdc332cc74636f463d8d4a2fe267a09

SHA512
0fd4853fbee83fcde004c904653396b510ca840ac2b2c276497c247d718b1679ca50a7d5a84e54e74e6bfec01882a99ca3c83b9a1b00f0cf085c3025b6e665c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe

Filesize
7.0MB

MD5
7bb45f8522187b26bbef2d9957bbe5fa

SHA1
4f4bbc74fe99a4f8f288a28cdfbc86441d182f0f

SHA256
6547e5d392ed49b02c9afff77cd9c7d36f29193e7c2b511b7e2f31e5650a853c

SHA512
1b535e99ea81007eb47cfcb51bbd6c054a4dd312624ef9047d3293e5fa3c0a3a646f737268275a9bb6af1028d1e2607164daffd484a0bb2c01b47305d5517be1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe

Filesize
7.0MB

MD5
7bb45f8522187b26bbef2d9957bbe5fa

SHA1
4f4bbc74fe99a4f8f288a28cdfbc86441d182f0f

SHA256
6547e5d392ed49b02c9afff77cd9c7d36f29193e7c2b511b7e2f31e5650a853c

SHA512
1b535e99ea81007eb47cfcb51bbd6c054a4dd312624ef9047d3293e5fa3c0a3a646f737268275a9bb6af1028d1e2607164daffd484a0bb2c01b47305d5517be1

Download Submit
C:\Windows\TEMP\is-V5H7M.tmp\tmp1E45.tmp.SyncroLive.Installer-latest.tmp

Filesize
706KB

MD5
4d77c41ecb0fe9113fd7d81e136bb3f1

SHA1
312f0bceabeaa2ad59b79f9656ca94b7f4453258

SHA256
c6fcb8184a3ec70654690413e735ee7c18251da9f3bc708ff2f54d186b6acdb4

SHA512
79dd09f4870a1822c4606dadce47712d8bb1c2ea2bd9d4d743f8b78fb8c1f93227603eba00068a53227186ae6a1a000ca8a21097e69b13e656d0cc401612af30

Download Submit
C:\Windows\TEMP\tmp1E45.tmp.SyncroLive.Installer-latest.exe

Filesize
13.5MB

MD5
6ee357d6ff97bd054f2f8d6c1e72f0e7

SHA1
d01ceb73738cf0e2c86463f86292c38e4873c524

SHA256
ad3ebf1789063615ef35ae5583d9641765670fed1ac57659e2d1010f54109f24

SHA512
2b458237b74143e732fbc4740b0437d058966845c2fc4f9f64a4932a98cd6f44e63aedad3ad17aca3f6fc01ccc0b400747b406c38c4595cd22d883cb8aca28f0

Download Submit
C:\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
C:\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
C:\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
C:\Windows\Temp\is-V5H7M.tmp\tmp1E45.tmp.SyncroLive.Installer-latest.tmp

Filesize
706KB

MD5
4d77c41ecb0fe9113fd7d81e136bb3f1

SHA1
312f0bceabeaa2ad59b79f9656ca94b7f4453258

SHA256
c6fcb8184a3ec70654690413e735ee7c18251da9f3bc708ff2f54d186b6acdb4

SHA512
79dd09f4870a1822c4606dadce47712d8bb1c2ea2bd9d4d743f8b78fb8c1f93227603eba00068a53227186ae6a1a000ca8a21097e69b13e656d0cc401612af30

Download Submit
C:\Windows\Temp\tmp1E45.tmp.SyncroLive.Installer-latest.exe

Filesize
13.5MB

MD5
6ee357d6ff97bd054f2f8d6c1e72f0e7

SHA1
d01ceb73738cf0e2c86463f86292c38e4873c524

SHA256
ad3ebf1789063615ef35ae5583d9641765670fed1ac57659e2d1010f54109f24

SHA512
2b458237b74143e732fbc4740b0437d058966845c2fc4f9f64a4932a98cd6f44e63aedad3ad17aca3f6fc01ccc0b400747b406c38c4595cd22d883cb8aca28f0

Download Submit
\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe

Filesize
32KB

MD5
23d83dd2a0bd3ae532851b79d5f3940d

SHA1
7f308859d0de11cb61d6528296b6269f6c92915d

SHA256
f3d36b34b75e8bf262dae2176abad3d5d553bb60de70387348c98b468287500d

SHA512
867cea111fc04ff20a572e91552ae5c994162ff6cde4efaf7820f6b9a5104a2db2b351f1b2d036791b275d025c8945216c7a95873c29bab4e3fdec3f138824fe

Download Submit
\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-CLIB7.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-V5H7M.tmp\tmp1E45.tmp.SyncroLive.Installer-latest.tmp

Filesize
706KB

MD5
4d77c41ecb0fe9113fd7d81e136bb3f1

SHA1
312f0bceabeaa2ad59b79f9656ca94b7f4453258

SHA256
c6fcb8184a3ec70654690413e735ee7c18251da9f3bc708ff2f54d186b6acdb4

SHA512
79dd09f4870a1822c4606dadce47712d8bb1c2ea2bd9d4d743f8b78fb8c1f93227603eba00068a53227186ae6a1a000ca8a21097e69b13e656d0cc401612af30

Download Submit
memory/364-92-0x000000013FF10000-0x000000013FF1A000-memory.dmp

Filesize
40KB

Download
memory/364-94-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/952-184-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/952-183-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/960-160-0x00000000010E0000-0x00000000010EC000-memory.dmp

Filesize
48KB

Download
memory/1144-63-0x0000000000C50000-0x0000000000C74000-memory.dmp

Filesize
144KB

Download
memory/1144-75-0x000000001AEE0000-0x000000001AF00000-memory.dmp

Filesize
128KB

Download
memory/1144-66-0x0000000000870000-0x000000000087A000-memory.dmp

Filesize
40KB

Download
memory/1144-67-0x0000000000C90000-0x0000000000C9A000-memory.dmp

Filesize
40KB

Download
memory/1144-68-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

Filesize
40KB

Download
memory/1144-69-0x0000000002520000-0x0000000002528000-memory.dmp

Filesize
32KB

Download
memory/1144-70-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/1144-71-0x000000001ACD0000-0x000000001ACDE000-memory.dmp

Filesize
56KB

Download
memory/1144-72-0x00000000026B0000-0x00000000026B8000-memory.dmp

Filesize
32KB

Download
memory/1144-64-0x0000000000C70000-0x0000000000C8A000-memory.dmp

Filesize
104KB

Download
memory/1144-83-0x000000001BCC0000-0x000000001BCC8000-memory.dmp

Filesize
32KB

Download
memory/1144-73-0x000000001ACE0000-0x000000001ACEC000-memory.dmp

Filesize
48KB

Download
memory/1144-62-0x0000000000B80000-0x0000000000BD4000-memory.dmp

Filesize
336KB

Download
memory/1144-74-0x000000001B720000-0x000000001B7CA000-memory.dmp

Filesize
680KB

Download
memory/1144-61-0x000000001B2D0000-0x000000001B32C000-memory.dmp

Filesize
368KB

Download
memory/1144-65-0x0000000000DB0000-0x0000000000DD0000-memory.dmp

Filesize
128KB

Download
memory/1144-60-0x0000000000850000-0x0000000000876000-memory.dmp

Filesize
152KB

Download
memory/1144-76-0x000000001ACF0000-0x000000001AD04000-memory.dmp

Filesize
80KB

Download
memory/1144-59-0x0000000000100000-0x0000000000808000-memory.dmp

Filesize
7.0MB

Download
memory/1144-77-0x000000001B340000-0x000000001B348000-memory.dmp

Filesize
32KB

Download
memory/1144-78-0x000000001B350000-0x000000001B358000-memory.dmp

Filesize
32KB

Download
memory/1144-79-0x000000001C800000-0x000000001C8FA000-memory.dmp

Filesize
1000KB

Download
memory/1144-80-0x000000001C6A0000-0x000000001C74A000-memory.dmp

Filesize
680KB

Download
memory/1144-81-0x000000001B806000-0x000000001B825000-memory.dmp

Filesize
124KB

Download
memory/1144-88-0x000000001BEB0000-0x000000001BECA000-memory.dmp

Filesize
104KB

Download
memory/1144-82-0x000000001BAF0000-0x000000001BB00000-memory.dmp

Filesize
64KB

Download
memory/1144-87-0x000000001BCF0000-0x000000001BCF8000-memory.dmp

Filesize
32KB

Download
memory/1144-86-0x000000001BD00000-0x000000001BD08000-memory.dmp

Filesize
32KB

Download
memory/1144-85-0x000000001BCE0000-0x000000001BCE8000-memory.dmp

Filesize
32KB

Download
memory/1144-84-0x000000001BCD0000-0x000000001BCD8000-memory.dmp

Filesize
32KB

Download
memory/1224-98-0x0000000000C40000-0x0000000000C4E000-memory.dmp

Filesize
56KB

Download
memory/1224-111-0x00000000006B0000-0x00000000006D0000-memory.dmp

Filesize
128KB

Download
memory/1224-153-0x0000000019F90000-0x0000000019FB0000-memory.dmp

Filesize
128KB

Download
memory/1224-119-0x0000000000C20000-0x0000000000C3C000-memory.dmp

Filesize
112KB

Download
memory/1224-151-0x0000000019D10000-0x0000000019D22000-memory.dmp

Filesize
72KB

Download
memory/1224-121-0x00000000194A0000-0x00000000194E0000-memory.dmp

Filesize
256KB

Download
memory/1224-149-0x0000000019E30000-0x0000000019E72000-memory.dmp

Filesize
264KB

Download
memory/1224-147-0x0000000019570000-0x000000001957C000-memory.dmp

Filesize
48KB

Download
memory/1224-145-0x0000000019CE0000-0x0000000019D10000-memory.dmp

Filesize
192KB

Download
memory/1224-143-0x0000000019550000-0x0000000019560000-memory.dmp

Filesize
64KB

Download
memory/1224-115-0x0000000000C00000-0x0000000000C1C000-memory.dmp

Filesize
112KB

Download
memory/1224-141-0x0000000019560000-0x000000001956E000-memory.dmp

Filesize
56KB

Download
memory/1224-140-0x0000000019560000-0x000000001956E000-memory.dmp

Filesize
56KB

Download
memory/1224-117-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

Filesize
200KB

Download
memory/1224-138-0x0000000019540000-0x0000000019548000-memory.dmp

Filesize
32KB

Download
memory/1224-100-0x0000000019D30000-0x0000000019E30000-memory.dmp

Filesize
1024KB

Download
memory/1224-136-0x0000000019530000-0x0000000019538000-memory.dmp

Filesize
32KB

Download
memory/1224-123-0x0000000000DE0000-0x0000000000E04000-memory.dmp

Filesize
144KB

Download
memory/1224-113-0x0000000000A00000-0x0000000000A26000-memory.dmp

Filesize
152KB

Download
memory/1224-102-0x0000000000420000-0x0000000000464000-memory.dmp

Filesize
272KB

Download
memory/1224-134-0x0000000019390000-0x000000001939C000-memory.dmp

Filesize
48KB

Download
memory/1224-125-0x0000000019510000-0x000000001951A000-memory.dmp

Filesize
40KB

Download
memory/1224-104-0x00000000001F0000-0x00000000001FA000-memory.dmp

Filesize
40KB

Download
memory/1224-132-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/1224-106-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/1224-130-0x00000000194F0000-0x0000000019504000-memory.dmp

Filesize
80KB

Download
memory/1224-107-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/1224-109-0x0000000000B30000-0x0000000000B7A000-memory.dmp

Filesize
296KB

Download
memory/1224-155-0x000000001A090000-0x000000001A114000-memory.dmp

Filesize
528KB

Download
memory/1224-127-0x0000000019C30000-0x0000000019CDA000-memory.dmp

Filesize
680KB

Download
memory/1504-54-0x0000000000100000-0x0000000000820000-memory.dmp

Filesize
7.1MB

Download
memory/1504-55-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1720-192-0x0000000074741000-0x0000000074743000-memory.dmp

Filesize
8KB

Download