f0e8ccd2f98ef6f6a4cf2282853e6418a8f3a8873d4eb7d25c5ff20b284d7414

Analysis

max time kernel
300s
max time network
301s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

uu.msi
Size

5.9MB
MD5

5a35d1da14c8bddf7fecfaefbf76a1b4
SHA1

536bddcecfec95b7c987fb9e248ba7c7da9b8944
SHA256

9fad7afeb555c95ba4f55ac3238e88eb098c7f9f1ab1796c930c5de54634801e
SHA512

e322b04665d46028c8167ada14c1bae8bd53eed04146f93406d01d4a9bd3a7204ac6e14a4bcb6a2e40b5bcef15f04c18542df084f019f4682461050288da735e
SSDEEP

98304:GAC9AGDm8MytOY9woKC4BDBwWlKylZ/FxCeMxlGV9GZRik9VI5TMwGP2KEgT:w9mzytc/CKDllTllCeue6STzAT

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
2	2024	msiexec.exe
4	2024	msiexec.exe
6	2024	msiexec.exe
8	2024	msiexec.exe
10	2024	msiexec.exe
14	520	msiexec.exe

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1112	Installer.exe
1520	Syncro.Service.Runner.exe
304	Syncro.App.Runner.exe
1976	tmp659F.tmp.SyncroLive.Installer-latest.exe
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
976	7za.exe
1196	7za.exe
676	7za.exe
1984	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2444	Syncro.Overmind.Service.exe
2596	Syncro.Overmind.Service.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SyncroLive\ImagePath = "\"C:\\Program Files\\RepairTech\\LiveAgent\\SyncroLive.Service.Runner.exe\" -displayname \"SyncroLive\" -servicename \"SyncroLive\""	SyncroLive.Service.Runner.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SyncroOvermind\ImagePath = "\"C:\\ProgramData\\Syncro\\bin\\Syncro.Overmind.Service.exe\" -displayname \"SyncroRecovery\" -servicename \"SyncroOvermind\""	Syncro.Overmind.Service.exe

Loads dropped DLL 9 IoCs

pid	Process
1976	tmp659F.tmp.SyncroLive.Installer-latest.exe
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
2024	SyncroLive.Agent.Runner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	Syncro.Installer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	Syncro.Installer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_52894DBA51C2BA5ACE3EE5577FB04C4C	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	Syncro.Installer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	Syncro.Installer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	SyncroLive.Agent.Runner.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_52894DBA51C2BA5ACE3EE5577FB04C4C	Syncro.Overmind.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	Syncro.Installer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	Syncro.Installer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	Syncro.Service.Runner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\7za-x86.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\DeltaCompressionDotNet.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\it-IT\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\it\System.Spatial.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Mixpanel.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\ZetaLongPaths.dll	7za.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\de\System.Spatial.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\es\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Images\chat-bubbles-icon.png	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\Microsoft.Bcl.AsyncInterfaces.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Microsoft.Data.Services.Client.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Microsoft.Web.XmlTransform.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Serilog.Sinks.Literate.dll	7za.exe
File created	C:\Program Files\RepairTech\Syncro\Update.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\ja\Microsoft.Data.Edm.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\ja\System.Spatial.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\ru-RU\Syncro.App.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Splat.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.App.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\en\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\Images\kabuto-logo.ico	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Microsoft.Bcl.AsyncInterfaces.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Telerik.Windows.Data.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Service.exe.config	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\System.Spatial.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\UrlCombineLib.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\x64\turbojpeg.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\x64\WebRTC.Native.Internal.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Telerik.Windows.Controls.Navigation.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\FluentCommandLineParser.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\config.json	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\Destructurama.Attributed.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\de\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Interop.NetFwTypeLib.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\RestSharp.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\System.Security.Cryptography.X509Certificates.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SharpDX.DXGI.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SharpDX.Mathematics.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SyncroLive.Service.exe.config	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\SystemWrapper.dll	7za.exe
File created	C:\Program Files\RepairTech\Syncro\packages\RELEASES	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\es\System.Spatial.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\fr-FR\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\ja\System.Spatial.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\MetroFramework.Fonts.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Squirrel.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Interop.IWshRuntimeLibrary.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\ko\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\zh-Hant\Microsoft.Data.Services.Client.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\System.Security.Cryptography.Encoding.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\Telerik.Windows.Data.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\fi-FI\Syncro.App.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\it\Microsoft.Data.OData.resources.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\RepairTech.Common.Tools.dll.config	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Service.Configuration.dll	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Tools.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Uninstaller.Tools.exe	Syncro.Installer.exe
File opened for modification	C:\Program Files\RepairTech\Syncro\app-1.0.168\websocket-sharp.dll	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\Syncro\install.bat	Syncro.Installer.exe
File created	C:\Program Files\RepairTech\LiveAgent\is-7A2OT.tmp	tmp659F.tmp.SyncroLive.Installer-latest.tmp
File opened for modification	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Interop.NetFwTypeLib.dll	7za.exe
File created	C:\Program Files\RepairTech\LiveAgent\app-0.0.62\Mixpanel.dll	7za.exe
File opened for modification	C:\Program Files\RepairTech\LiveAgent\unins000.dat	tmp659F.tmp.SyncroLive.Installer-latest.tmp

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI9C81.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	Syncro.Installer.exe
File created	C:\Windows\Installer\{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\6c95fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6c95fa.msi	msiexec.exe
File created	C:\Windows\Installer\6c95fb.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\6c95fd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\6c95fb.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1048	sc.exe
1404	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000	tmp659F.tmp.SyncroLive.Installer-latest.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Syncro.Service.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SyncroLive.Agent.Runner.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Syncro.Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Syncro.Overmind.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Syncro.Service.Runner.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D3D65F7B3DA21204D963B3E9C9F9EB33\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\PackageCode = "778729A429A44874D8D4D102C27F49E9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\ProductIcon = "C:\\Windows\\Installer\\{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7500CEBB70B554E4C93BAE54CF782BB3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\ProductName = "Syncro"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList\PackageName = "uu.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D3D65F7B3DA21204D963B3E9C9F9EB33	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7500CEBB70B554E4C93BAE54CF782BB3\D3D65F7B3DA21204D963B3E9C9F9EB33	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D3D65F7B3DA21204D963B3E9C9F9EB33\SourceList\Media	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
520	msiexec.exe
520	msiexec.exe
764	Syncro.Installer.exe
764	Syncro.Installer.exe
1520	Syncro.Service.Runner.exe
1520	Syncro.Service.Runner.exe
304	Syncro.App.Runner.exe
304	Syncro.App.Runner.exe
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp
1520	Syncro.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
1520	Syncro.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
1520	Syncro.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2036	SyncroLive.Service.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2596	Syncro.Overmind.Service.exe
2596	Syncro.Overmind.Service.exe
2596	Syncro.Overmind.Service.exe
2596	Syncro.Overmind.Service.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2024	SyncroLive.Agent.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe
2036	SyncroLive.Service.Runner.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeSecurityPrivilege	520	msiexec.exe
Token: SeCreateTokenPrivilege	2024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2024	msiexec.exe
Token: SeLockMemoryPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeMachineAccountPrivilege	2024	msiexec.exe
Token: SeTcbPrivilege	2024	msiexec.exe
Token: SeSecurityPrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeLoadDriverPrivilege	2024	msiexec.exe
Token: SeSystemProfilePrivilege	2024	msiexec.exe
Token: SeSystemtimePrivilege	2024	msiexec.exe
Token: SeProfSingleProcessPrivilege	2024	msiexec.exe
Token: SeIncBasePriorityPrivilege	2024	msiexec.exe
Token: SeCreatePagefilePrivilege	2024	msiexec.exe
Token: SeCreatePermanentPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeDebugPrivilege	2024	msiexec.exe
Token: SeAuditPrivilege	2024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2024	msiexec.exe
Token: SeChangeNotifyPrivilege	2024	msiexec.exe
Token: SeRemoteShutdownPrivilege	2024	msiexec.exe
Token: SeUndockPrivilege	2024	msiexec.exe
Token: SeSyncAgentPrivilege	2024	msiexec.exe
Token: SeEnableDelegationPrivilege	2024	msiexec.exe
Token: SeManageVolumePrivilege	2024	msiexec.exe
Token: SeImpersonatePrivilege	2024	msiexec.exe
Token: SeCreateGlobalPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	112	vssvc.exe
Token: SeRestorePrivilege	112	vssvc.exe
Token: SeAuditPrivilege	112	vssvc.exe
Token: SeBackupPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	1912	DrvInst.exe
Token: SeLoadDriverPrivilege	1912	DrvInst.exe
Token: SeLoadDriverPrivilege	1912	DrvInst.exe
Token: SeLoadDriverPrivilege	1912	DrvInst.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeDebugPrivilege	764	Syncro.Installer.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe
Token: SeRestorePrivilege	520	msiexec.exe
Token: SeTakeOwnershipPrivilege	520	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2024	msiexec.exe
2024	msiexec.exe
304	Syncro.App.Runner.exe
320	tmp659F.tmp.SyncroLive.Installer-latest.tmp

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1112	520	msiexec.exe	31
PID 520 wrote to memory of 1112	520	msiexec.exe	31
PID 520 wrote to memory of 1112	520	msiexec.exe	31
PID 764 wrote to memory of 304	764	Syncro.Installer.exe	34
PID 764 wrote to memory of 304	764	Syncro.Installer.exe	34
PID 764 wrote to memory of 304	764	Syncro.Installer.exe	34
PID 304 wrote to memory of 676	304	cmd.exe	36
PID 304 wrote to memory of 676	304	cmd.exe	36
PID 304 wrote to memory of 676	304	cmd.exe	36
PID 304 wrote to memory of 1048	304	cmd.exe	37
PID 304 wrote to memory of 1048	304	cmd.exe	37
PID 304 wrote to memory of 1048	304	cmd.exe	37
PID 304 wrote to memory of 1404	304	cmd.exe	38
PID 304 wrote to memory of 1404	304	cmd.exe	38
PID 304 wrote to memory of 1404	304	cmd.exe	38
PID 1520 wrote to memory of 304	1520	Syncro.Service.Runner.exe	40
PID 1520 wrote to memory of 304	1520	Syncro.Service.Runner.exe	40
PID 1520 wrote to memory of 304	1520	Syncro.Service.Runner.exe	40
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1520 wrote to memory of 1976	1520	Syncro.Service.Runner.exe	41
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 1976 wrote to memory of 320	1976	tmp659F.tmp.SyncroLive.Installer-latest.exe	42
PID 320 wrote to memory of 976	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	43
PID 320 wrote to memory of 976	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	43
PID 320 wrote to memory of 976	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	43
PID 320 wrote to memory of 976	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	43
PID 320 wrote to memory of 1196	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	45
PID 320 wrote to memory of 1196	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	45
PID 320 wrote to memory of 1196	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	45
PID 320 wrote to memory of 1196	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	45
PID 320 wrote to memory of 676	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	47
PID 320 wrote to memory of 676	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	47
PID 320 wrote to memory of 676	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	47
PID 320 wrote to memory of 676	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	47
PID 320 wrote to memory of 1984	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	49
PID 320 wrote to memory of 1984	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	49
PID 320 wrote to memory of 1984	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	49
PID 320 wrote to memory of 1984	320	tmp659F.tmp.SyncroLive.Installer-latest.tmp	49
PID 2036 wrote to memory of 2024	2036	SyncroLive.Service.Runner.exe	51
PID 2036 wrote to memory of 2024	2036	SyncroLive.Service.Runner.exe	51
PID 2036 wrote to memory of 2024	2036	SyncroLive.Service.Runner.exe	51
PID 1520 wrote to memory of 2444	1520	Syncro.Service.Runner.exe	54
PID 1520 wrote to memory of 2444	1520	Syncro.Service.Runner.exe	54
PID 1520 wrote to memory of 2444	1520	Syncro.Service.Runner.exe	54
PID 1520 wrote to memory of 2444	1520	Syncro.Service.Runner.exe	54

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\SoftwareSASGeneration = "1"	SyncroLive.Agent.Runner.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\uu.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe" --msi --key eEv1rOer1Ms5cK_PMCtd6A --customerid 01006130 --policyid 0 --folderid 02794644
  2⤵
  - Executes dropped EXE
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Syncro.Installer.exe" --msi --key eEv1rOer1Ms5cK_PMCtd6A --customerid 01006130 --policyid 0 --folderid 02794644
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c "C:\Program Files\RepairTech\Syncro\install.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:304
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe" /ShowCallStack /LogFile=C:\ProgramData/Syncro/logs/ServiceInstall.log "C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe"
        5⤵
        
        PID:676
    - - C:\Windows\system32\sc.exe
        
        sc failure Syncro reset= 60 actions= restart/5000/restart/10000/restart/60000
        5⤵
        Launches sc.exe
        
        PID:1048
    - - C:\Windows\system32\sc.exe
        
        sc start Syncro
        5⤵
        Launches sc.exe
        
        PID:1404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000314" "000000000000056C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe
"C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe
  "C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:304
- C:\Windows\TEMP\tmp659F.tmp.SyncroLive.Installer-latest.exe
  "C:\Windows\TEMP\tmp659F.tmp.SyncroLive.Installer-latest.exe" /VERYSILENT
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\TEMP\is-O99HM.tmp\tmp659F.tmp.SyncroLive.Installer-latest.tmp
    "C:\Windows\TEMP\is-O99HM.tmp\tmp659F.tmp.SyncroLive.Installer-latest.tmp" /SL5="$4007A,13891222,57856,C:\Windows\TEMP\tmp659F.tmp.SyncroLive.Installer-latest.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\TEMP\is-7H2LL.tmp\7za.exe
      "C:\Windows\TEMP\is-7H2LL.tmp\7za.exe" e "C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg" -o"C:\Program Files\RepairTech\LiveAgent\app-0.0.62\" lib\net45\*.* -aoa
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:976
  - - C:\Windows\TEMP\is-7H2LL.tmp\7za.exe
      "C:\Windows\TEMP\is-7H2LL.tmp\7za.exe" e "C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg" -o"C:\Program Files\RepairTech\LiveAgent\app-0.0.62\x64" lib\net45\x64\*.* -aoa
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1196
  - - C:\Windows\TEMP\is-7H2LL.tmp\7za.exe
      "C:\Windows\TEMP\is-7H2LL.tmp\7za.exe" e "C:\Program Files\RepairTech\LiveAgent\packages\SyncroLive-0.0.62-full.nupkg" -o"C:\Program Files\RepairTech\LiveAgent\app-0.0.62\x86" lib\net45\x86\*.* -aoa
      4⤵
      Executes dropped EXE
      PID:676
  - - C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe
      "C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe" install start
      4⤵
      Executes dropped EXE
      Sets service image path in registry
      PID:1984
- C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe
  "C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe" install
  2⤵
  - Executes dropped EXE
  - Sets service image path in registry
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2444

C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe
"C:\Program Files\RepairTech\LiveAgent\SyncroLive.Service.Runner.exe" -displayname "SyncroLive" -servicename "SyncroLive"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\RepairTech\LiveAgent\SyncroLive.Agent.Runner.exe
  "C:\Program Files\RepairTech\LiveAgent\SyncroLive.Agent.Runner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:2024

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2388

C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe
"C:\ProgramData\Syncro\bin\Syncro.Overmind.Service.exe" -displayname "SyncroRecovery" -servicename "SyncroOvermind"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe

Filesize
32KB

MD5
1aa2d8a5d3ecc3aa134528b7117244b3

SHA1
0b149d62a7883c6c903118c7b6886a981d1ff31c

SHA256
60abbb3e61ba60715051790ad84703855455a24533e6e68b7fd0791b79d37b14

SHA512
500938e0df236efc0242a81bfbef2c9f8a7ca52644fd1c05146c7a4333f8d525d57169ac38cce945d0cdc6759601e41e17db06f71fad8e5436fe94c0d050d958

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe

Filesize
32KB

MD5
1aa2d8a5d3ecc3aa134528b7117244b3

SHA1
0b149d62a7883c6c903118c7b6886a981d1ff31c

SHA256
60abbb3e61ba60715051790ad84703855455a24533e6e68b7fd0791b79d37b14

SHA512
500938e0df236efc0242a81bfbef2c9f8a7ca52644fd1c05146c7a4333f8d525d57169ac38cce945d0cdc6759601e41e17db06f71fad8e5436fe94c0d050d958

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe

Filesize
36KB

MD5
55d568af3444a7319dfdb2ddc0a6bc2f

SHA1
e6fb8fc639c71c2ef922ed9f36b29cda45622292

SHA256
10c8cd588d627f46df3a7385e07d36674c2f0374e6327c7f9595cb22d8635753

SHA512
1cdb5edd9ed982e6eaa20042efaa4e57a5d6b6927c921d06accad2493bc7ac6d7444a2467b38b82a5a6cd3c7d8bf59e32ba0e858290327770007914818fac3a5

Download Submit
C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe

Filesize
36KB

MD5
55d568af3444a7319dfdb2ddc0a6bc2f

SHA1
e6fb8fc639c71c2ef922ed9f36b29cda45622292

SHA256
10c8cd588d627f46df3a7385e07d36674c2f0374e6327c7f9595cb22d8635753

SHA512
1cdb5edd9ed982e6eaa20042efaa4e57a5d6b6927c921d06accad2493bc7ac6d7444a2467b38b82a5a6cd3c7d8bf59e32ba0e858290327770007914818fac3a5

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Autofac.dll

Filesize
247KB

MD5
94bce38faf97857d39b9348f43664317

SHA1
8adf558ad484b47a94e199318a4fad70eab0f090

SHA256
0bfa585a98172330547fec4bda0d747afea4b01bc691378dfbef2ae82d110dd4

SHA512
e7ca307423aa8527b379a88f2bcf2cabe34b58d04b2f979ad4ae11867fa6a08984ca5212706f749fcfab5338e0cceefa1dd35bfa8e9921fa40ec8cd0c8caab8d

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\CSharpFunctionalExtensions.dll

Filesize
125KB

MD5
841e154928ed4f18c7750a39780d118b

SHA1
f383e8aae69a942ffd0915122f67b0f963d6c119

SHA256
dacbb5f45d70b290bbed42249c06d26cf65440e63f2ac1c8db125e808a693bbf

SHA512
22e68af198233d374e609809666bc8d77f1afc741c1436fcdd321ccd7bae8a52663e7284350211cdc640cd29af550084b52343b79e8584464733200ad74bfdfd

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Destructurama.Attributed.dll

Filesize
15KB

MD5
7eabdc9525bd1814899de66fef6be715

SHA1
04cf3922eb9d39adf9e3acfe7cb5246c5f718c86

SHA256
ac6ef04b83ca3ec163e6998ef4904434bffc0405a793ae5dbb2e800e3984dabb

SHA512
a0b95e6f5212ea7c2cfa52e372143973f72254aeb67fe6032b1db58b840f93ec9da87e565bb696417bb5bd7b6dd9a3a35af461cf51b0651fb2419ead79ccadd0

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\FluentCommandLineParser.dll

Filesize
51KB

MD5
de2b96fbe5b4104094389d69afb3ee4e

SHA1
d264d7519a6f4b6a6df6f39a382e352d4a48acdf

SHA256
0118168035446602ef5ca6f5426f8d54975f58613c3898e0b6689d92a35c589f

SHA512
c73a93fcbffdcbfa1b1c5928ab4304eb172710cd4ea3795796edc6e08145078199a4b0208464438d08fc569212fc11778b1d2c86ed7e6ee7e3b86f5321f33b03

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Flurl.Http.dll

Filesize
103KB

MD5
67c42a9cd1262c422f8ea562805f0294

SHA1
23d99f695530cb18bf9009668bb414338c953f60

SHA256
62d4336b23c78955d9e51573935102beadd58bdb19530bb6d650cf39f4d8bc30

SHA512
881cf4f3fb64dd2d1f42146abec7bfddf95a80a131774d7a6196b54197161866bfc09e1b6f16074f96454aecec3a03540b706e2c43df828a7c954e57e282ccca

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Flurl.dll

Filesize
35KB

MD5
88d6cef2bd73709f7f35d6cdb63c6b52

SHA1
9ec6e0b10922101af0135d40f2a5fcbb798002a4

SHA256
17714b55721d04c35ebb4898afd9e267e3cb04b25beb8bda9a460c52587955f5

SHA512
c187f53222988c23f45946cfce5e18d32c5ac3af22e65097aafcef0f3ddbc83f3c0acb02a90cf16c5241a0dda5162674ee7bd2627e1da38c13fff22bdf8febf8

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Interop.NetFwTypeLib.dll

Filesize
22KB

MD5
65a6be1f8674bf2489d8e858ee8d7e65

SHA1
46a5a710f2fceb5c4daa7150a4b2517478fff0ae

SHA256
72a5ad582c5e1f754256a5de51ad01602ba23b295172de0efd27137affc44454

SHA512
333d1756b30b802c1ba3a690381238da8d356944ffc4fa1f49d9f97374d476de1989e66613fe97ddf8c6db76c567cd6f4f58651452baafd899d4c4e5c24c922c

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\MetroFramework.dll

Filesize
343KB

MD5
d9fc57f451780a9afee72d870b460d4d

SHA1
6554fd655df6efd3f5de4559b915ceeb11a8ef41

SHA256
fd45b9b900e163ab1aa6e703408ea281be3292089d4b45b646e826df02e3c88e

SHA512
1c8b9f67400a43596e289b3c44c27f55da87a88578a336f5933a81f808074bb5c79cd40e9cb706f81eb4d433ff4af1c4f5d02af2a79ed8860d6a1d42eaa338d3

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
20KB

MD5
5220eefd7753e11b99d73faf39fbb486

SHA1
7d8264be4fcb17f81acb8b1add980cd96a6fd856

SHA256
ed5bc605f7f9fcc382183abef06c354dad946abb42a07631712077b2157d6bc9

SHA512
81e483bd76240543704194c0eb0c8a9e7dc46aa535653e7d5590e00c002b2980237ada793c05c0eedd5d1a92de90055867b21be665ff94fac038e280939c66c1

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Microsoft.Win32.TaskScheduler.dll

Filesize
229KB

MD5
3b64aebb9d2a910b6839b56c84653a9b

SHA1
0fdd9adc8048547cf3328295db2ac291f5c6b81b

SHA256
fcc18b30e67afe2e5e037ec4e2bcbcf1153e0c257dc26dc48084676a87be2486

SHA512
463a3fb2957bdbbf6effa43562e331a24aa49d1c5dbd0509773f5d3ba2830d93a684876c5eea0b744a2fec7d7b70e12c1d1533c671ccf590f53aaaf9252d23f0

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Newtonsoft.Json.dll

Filesize
659KB

MD5
4df6c8781e70c3a4912b5be796e6d337

SHA1
cbc510520fcd85dbc1c82b02e82040702aca9b79

SHA256
3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af

SHA512
964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\NuGet.Squirrel.dll

Filesize
501KB

MD5
60c7dc7ba7d0ae42e2228e5c49bbe162

SHA1
806b0955e67c1243c29b3216dc913c003c3e9321

SHA256
705d9545b33072323ddaf7d26d90c5e18b15754dfcddc04a58afab51368c5559

SHA512
8b25a9b584c9feec1fd04d22300ace5fe74a594bb4edbc5205142b7267d0941e51f419260fdd8a51f7f8cffe4a473cc66afef4dfc296a021840db444c9a4d36b

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Phoenix.dll

Filesize
19KB

MD5
a7c8097f71478a1c6ddd30cd8113ad46

SHA1
ef9a449f64b75b5419b51361a416e70c81d9f7d6

SHA256
374c1350475a34aa369bd80061910476cd22d587a55038853fc976197440162b

SHA512
c2497e90e0cc990b3dff8e0b3e6bbf158d53c862edae3103c054278d2e38499915a575fc7378e869b52ad22f3c6e34450e14071b05eb1202de4930cd76dea2f0

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\RepairTech.Common.Tools.dll

Filesize
272KB

MD5
796f43a73a63c3e097763f66aa3b8ff7

SHA1
d22210904bfef6092776a47fe6b98c12b6dbe153

SHA256
b8e79e671256b865d8db3ea2cd58b3159bf7b708f3459828278cab928ac5d510

SHA512
26be758076b3b8cce45cbe59d4b03650b144f819c421051de8e22351ce883dceee2f5aed2658d9657a769f34d7e6fcda769d4d6d857bffdce2032466d0585062

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\RepairTech.Common.Wpf.dll

Filesize
52KB

MD5
8141f0af4cd425514411660a4d5bd8f5

SHA1
c8d6824e2cf33f68bca5ef371a5901162200bc40

SHA256
343bf1060d5e2f62692178a4daa51b3a6a53e386d2cad2cc0f452050a282b31c

SHA512
c8cea2cf48361792a99cbf8edac0c15e2de88a1e123aa9fe34020f1fe54f22d190277f286b1d90f18831a4f48e281eef417727d52adf55a8a3274a3ea455fb5a

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\RestSharp.dll

Filesize
167KB

MD5
b4aaa21288c1d923150c8d88b6ece126

SHA1
6d99e70ab9511aee701ff7068b5792f4194377bf

SHA256
b539f648dab37f211acb38dfcf4c79b488fa3beb5a7edf6740f894d2d1807449

SHA512
0de9227f5d134fc6b7029fb8202beade5e30be1f236e785eaae534cb0e944a98d9adfa2dd1917138994cfcfa2047a45c935f2b4f96944ed3dc017762ab9e08ca

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\RollbarSharp.dll

Filesize
36KB

MD5
7931fd2a2e06c7a654c9edfe388a8033

SHA1
2fb6de045f81bd56fce6a367dd992efc73ba4405

SHA256
cd722eda12d89b33cc00fa7e967eb6837b8335fada88368a6896d357f4362c15

SHA512
33ff92fa6dbb93b97c739ece89433c7ed34106e91cd76eb2431d0e840338af3dd456c3116b8362de33906eb348ad7eded630e28a98c94536ee8c1f3baf8f6b80

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Serilog.Formatting.Compact.dll

Filesize
8KB

MD5
fdb7ad01c66a0c96174300167fadd249

SHA1
38b9971de844165f164e37e2d234d16f6022636c

SHA256
2d7dec266c5436f58ab620db4e3b5c83e550e7f76caff26eae8186b14b52cdd6

SHA512
13df8a0ec363dc3a8f80114c64869db6f1233ae250df1bf48260cf62588065200d5a920f7d16d41faac4ddd4b9edd4d3383d1bbdb1849d120a145175d3a74d4a

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Serilog.Sinks.Console.dll

Filesize
31KB

MD5
c48bf7030e583e273e94e2d32b752a83

SHA1
51666bcec96f529b1a28b72db54cc7fcdf68441d

SHA256
ded3b57b64eca479f2a659a244e4c403ebfb83a9a9b30ced893c145e77affd29

SHA512
475e61bbb4484f468548dd7590d1d0bcc19912b322eacf2960b32c2c3ff1084231ddf8e689735e385a1f43e9912f79a028eae136c7dc8e130f2d3dd1eaf1f004

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Serilog.Sinks.File.dll

Filesize
25KB

MD5
6509ca95a38ac29c03379113172cacb7

SHA1
f94b8d751fefcd29d28875e291fd570e103d12d7

SHA256
85ad8530adc1dec3b97f2074c720b81528ba5ea6c7274e1a98a906304bccd12f

SHA512
d8bd0b8998725e2fa361bcb446f48b6105bd603707bf914bb978c63b5c40958bcd2a3fef1f666541793f1d06377f3f2967d1241e445bee6919eb8f84f5a5d7f5

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Serilog.Sinks.Literate.dll

Filesize
5KB

MD5
a0ebef9e8cce247cc12310a03b38aa7e

SHA1
22848b43d3b7f99cea7b339e86fcb4c08d7e6e51

SHA256
5e2e204439217c960237a894548680b39d5972fabfa3009538f43530eac23a3e

SHA512
53dc332b0329899883e019a4adbead244c65324fc4654c6c4d8080b3f2cc1953f2d0c61ac3507d00ac85c9cb98d711e127df335e334a3e2b2e70e59e3239d758

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Serilog.dll

Filesize
115KB

MD5
fbfbf8c2de7f389105d728037bfcc11f

SHA1
91dd7e807ffcfdc9cb67f5a75d85dcf537475583

SHA256
e7c7528f8a920988862b8c22d0ae4c40df6824332780c1cec41d84fe633b6bed

SHA512
264667b13ff54e8ae24663f6ea11225794946c5db34d440bd68cc90c940c92d1da7faf39dfa551d13a19f5e21c82130662ffab2a2e2ebfb004576d880e9fb369

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Splat.dll

Filesize
45KB

MD5
1975e684c48457d72f37696bb1b880e6

SHA1
eb254b470df9172aa07f13e7280bced746d95e22

SHA256
7a6f255cf59d6594c8f5bc466956f09305a3a10c8d683e485c7e1f14371701c4

SHA512
edb06da485e4dc562c7833ef887172be5ddb4d36a041463dc662ccafaa8fad816306091f774a7463f1538ad1c62ee9433bd12673d943bd885bf2cb38fc633a08

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Squirrel.dll

Filesize
235KB

MD5
f337f9b5615590307732f1e94b8ebcb4

SHA1
30110300fb63a72827aaf1b594f21632594f4c82

SHA256
46a139b49a419e2217bc09700121a08e6e169f654b076866590a9360957a3b34

SHA512
60e057f432488aebb77e584b5deb9535913d1fbd320cd63cd0746d6c7765f1866e3678150c9393e9ce55ab2a7840e0271a5556cc91c7bc0eaf7072283c2d8549

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.App.dll

Filesize
432KB

MD5
fa11417c9172c86dd8d5c08370e132db

SHA1
028e7c09caf1e25673f5774a2d98f58e5b890bc3

SHA256
a79e60e88045051f5290bdd5ab76dae83f78828b850bd11f769ac25e3cb4d9c2

SHA512
ebdda723dd1101cb67a12e402aef9a4a5e1f5918171c3040b3f891092037f039f88ed8a7df42a18dab1e5c269642edd75292b9098b5b7b2fe5512aa789a27481

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.App.dll.config

Filesize
3KB

MD5
29a3fb17a36c73f4c578b948950572f0

SHA1
7fbd63662d4ca33028cc23828849461b6422609a

SHA256
6d3ce7aa37dd56dbfca1770777d414e9683dce6e402f031fc2f7cbb98fdd82c6

SHA512
63ac42a22ebba9ba5bbbe20113ce97889f27d1869ab6334e0871c5a7184354548d0225efb344a7dee8cd545ab13b052e13f207f9b4c2ef7e5eaec33bb90acce6

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Contracts.dll

Filesize
106KB

MD5
1863a5697f2fcac4d590587e97bf36d9

SHA1
b90ef5cf2edb66d1cee0cd5a9be38ac832c69158

SHA256
807f68a74686038c9b91b55393053ac130b6cce3469c63a598111639c1a9cea9

SHA512
7af4847c1db7760d1644eb311a5932bae3da60fc1ba1a701afc3725a5d899026424210e4c497b801be7307684f130351d8fc87b923d4237628d85d02f9f1d363

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Service.Configuration.dll

Filesize
10KB

MD5
adbb784da491cb2b3e690bb5612e6854

SHA1
240873851b5ff2f612509f80fa94073ca0576357

SHA256
2b939583c11aab90e350cdb533caa719bd57254aff58e7d87fadf0de29fec049

SHA512
50e78fa65c3142239b993e12dd92e368d31a5fbeb87d3601f98da9683c96bcf243c2bc5b7706059f84c9e56c09e0177af8b86d7abb9a661f04bce44de2084d00

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Service.exe

Filesize
1007KB

MD5
b58599b0f8dedd76ab622d5eea9497cd

SHA1
436ce0e8022935a61eccb94679e9c19dca781362

SHA256
31c096d1075cbe54ae0274c7828904bee807be2bd8fffcb6257d91e681fa764a

SHA512
58b350ec82cb6f4cb778a860d9d235f561810b917a782dedf8c3b65c930d99bcc6e0d6e04a7108c6d61c598b6cb310daee7f77691e946afc6afa26fdf6ac17a5

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Service.exe.config

Filesize
4KB

MD5
8d8995a5b322b505d622af6cd2bfdffa

SHA1
56f353b5df27ff2dc98f9fef29bdab086a8a0fda

SHA256
5af11c9ce145d76e865f091da12d3cc70f84e069e790dc54eb2c93b92b84fa8c

SHA512
a8d0e6a67ec700e37b19fde7768bc3d2b8db6d90b96b7e276fad8fb3d851508f718ce0370b06c26cdeb87711b24798925150ec56ed20b48c46a51fe3c8801834

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\Syncro.Tools.dll

Filesize
83KB

MD5
cff50121d9807e654c1074143a015335

SHA1
d1ebb1a9d67e9fe3ed1d78bd6102658dea2df641

SHA256
1d3dd902c2449e5470225175c6793241418ec01c5eb802cecab0b31694ce1253

SHA512
8c99f97bfdc9f71232a4a729991c6736a3246f553dd18c96c459e389dc5240218ab0fa43a96e11b2ffa5f3cdab7d5e884ebc479d2b17485ef66e17657fdb960c

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\SystemInterface.dll

Filesize
87KB

MD5
6c19cad7d00cee4e4aae931b79c0cbd2

SHA1
b8e275ee742584b017fe48918d35edfbba97c1b8

SHA256
e9ecc8b5c887b3eb58523d108aa7a74340c5b5270aa3182d5dd1fc363afdbc02

SHA512
c1892e5b45a4c48a342fe869c43e2348c6d21dd14771ee0c4a59ff1eca6b9b77b2742e54106d956e9f7c7c9ea13f9d41b6a2ef1b4f9a036a96e76b9373c58363

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\SystemWrapper.dll

Filesize
174KB

MD5
e5dd264a7dc69d6f9bb85919984955a3

SHA1
4d83ac11160295835f3c8266e9d96f49446e0023

SHA256
122dabfe8a6b37cbbb6b062ca99fc567128037178764b9b0965706938ded6d05

SHA512
640316365ed262bc4725b9c103bfa9754dce44e74b9a18dbd7fe9f413cd8904a7ad9282796eb2b1253f3039c789bb513746f517c37d4ba0057e8cdc375939d20

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\config.json

Filesize
869B

MD5
b8131bcfde5af2f88c7ebe90bbbab965

SHA1
a82ff00ad442d1af4356fcf8729abb3164077be1

SHA256
f22f770c78a63b75d079a2b919938613edf10a1360a05b64e42aeb676e868efb

SHA512
5b1d052dd5e96082d64bd61531b3cd3f48861929e62de2bf7022d9d39e0d02bb08655832538f7fbce241b07755c51d7b1a96ad6ebc46204e24742e011a9ada28

Download Submit
C:\Program Files\RepairTech\Syncro\app-1.0.168\en\Syncro.App.resources.dll

Filesize
39KB

MD5
f61cac27413de146d3e70c5d6c4a9e2c

SHA1
16415b8df306ef3ec0a9ff25ec0db435fecf737f

SHA256
d551be97aa15cbb9122a59f33e03a7128e090cbdd94df71ac53fa3e0b357343b

SHA512
550a45b080e6f6d2b815a14039f6e032f52c77e39f6e8e02749989dca5d4c5d44f68ff68c017fca4212e07edb7d4affd4c40cda9548248e32397fc47a316b669

Download Submit
C:\Program Files\RepairTech\Syncro\install.bat

Filesize
639B

MD5
e3eb8d69316f0551bda4908c44d8684e

SHA1
dc8d0350c67f2a9b4a2adec253863273c26aa760

SHA256
8952ea8c7a55898f87d131886cad0ceb966ad4475c701ea6590d906bfc6dc0af

SHA512
b276ab4113ff39c715b840d84916c49319d03b8458dea0bc9c1f23f87a331dac1975e5c596c088cbdf44c50e5a9bc54ddfdbb5fe9363f7496ce242dab3f37865

Download Submit
C:\ProgramData\Syncro\Images\logo.ico

Filesize
14KB

MD5
940cfaf4c3be79e182f60375900fc2b3

SHA1
4c476f0b6eeb7a99912b1a5b2a7ee43c96d40baa

SHA256
97dda1267bb780b5c073d57367fc3590548fab97b9d90ee86d5a55dffd5847e9

SHA512
774e2f1bd38a1145ad7758964276a74c3f8c7deb6932c5203a4c19050d3f4cf38ee71d6ac645c4a55ba3559ea031623267ea5ccd9fbf26a758234203d1590b90

Download Submit
C:\ProgramData\Syncro\logs\20221012-Syncro.Installer.log

Filesize
6KB

MD5
6620659bb86ab7073373515f46246fc4

SHA1
edff9fbc3406b14972f29a5430342591845fb9a5

SHA256
5feaae84f5181173ce7588e5c4f7ea158007dc091fdfc3d5cbb1066d4014f9ce

SHA512
5a83421ada9e2aacceed6481e1925e528bc253d9dc8b1be7329c947cbb69ef20a878edadc3fd9a55db4382f41e449948d59034b77e0d6de81bc9ccb53e11af45

Download Submit
C:\ProgramData\Syncro\logs\ServiceInstall.log

Filesize
1KB

MD5
5be5998b9b6bdae1128e45955f106f79

SHA1
2383b5d93f47be54fe89f6184cb764bb756156f2

SHA256
f10d0f36784db77a8b3c39ca688d36678fdc332cc74636f463d8d4a2fe267a09

SHA512
0fd4853fbee83fcde004c904653396b510ca840ac2b2c276497c247d718b1679ca50a7d5a84e54e74e6bfec01882a99ca3c83b9a1b00f0cf085c3025b6e665c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17

Filesize
2KB

MD5
67bf17af0d82abb981966a27b2af95cc

SHA1
023ec55468a49253e7c945c9acbd87f757fe72e3

SHA256
65146c52225a28f5187407a4bac6e01c28088204ce16172608ea50c3743e6e1d

SHA512
0650881dabbcb21a0c6007ac748ab9f456aab2f10a11cdb21b83d13de7b5ca374eb33c2e6e4f213f83542d4edb6c37bdc9dbe4ab498a920f2f8c30a6d569f233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
0698dbc93ba7b6bef73ba316695f8317

SHA1
a444078ff1eb7c88f52cb4e324365926b491ed47

SHA256
263292040d77903899257c1d21201dc64d6f8d6b5a1d945cd5b28d0124d7906c

SHA512
ebacaa7009aebb88199cd70fd0bb3afe69ed300318cb633edd1c0404e42aef829617f589bcbad6cb7ab4bd0a8ae87f7df1435c786184ecc5de61c8fc6950a900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_52894DBA51C2BA5ACE3EE5577FB04C4C

Filesize
510B

MD5
70d35e9b1604fa420674e4fbba8ff9df

SHA1
25b78f58f2271d3a4876829d1f099105e968747a

SHA256
ef40d5a8c1e166b09860db7c4f4917bc8b368c56efb875f0934c082a06af3b8c

SHA512
47a56593b20d33671414bc70166b0c5b2d4542950a55b7204067543c845511ff9b545528e045413fc5287f27c48055ea182a262e30989ca93039c66ca2fbd40d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17

Filesize
488B

MD5
9cd699517e7ad69c99fc77d54def6cd7

SHA1
20a0f12af71f88625dad9eeb71ea48c469d477d1

SHA256
80f61e8fe02ac4bf706144b0a8297d1cd8c3da54f6e9703274bd596f14849e60

SHA512
80a2e55932e8a7d68566d066e4178a558fb9f789689ee823b35774aa93474bdce4d8d0c3083b58d36edf770ad310c77d9d961d45923e3956cf120ec791ce525b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3ce56598b8884ba1c90b83a8b09e825

SHA1
002f86585877fd90773e7cc894601e8ff754485b

SHA256
741473bb9efc68a6dd6c6c5853cda062ec2adec509c1c96ceab7dac9cb933e3f

SHA512
fc1a5ba6e393c1dd130d5d80af228992f5d35c2d3f2f8a511d0c8436d82bd492915df50b3e894468ba161fef5d949b8d06573326bc49646c0e53c0b2559067da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
bd2187e9de9c933e21a4b74c032b12bf

SHA1
4d825f4df5fd8c52b9d1529d82ea87ad3c737145

SHA256
f560a9338640beecfad7bb5d1308b2b7966a5478e9a9790f15b0a45588f14686

SHA512
8c5277a8c0f40f41225409a231cb66578ef4eb5559a7b2c82c01e7a5192ffcf863b60b4fafca3fef71adac3a00b50dee227f76b3469f613fe50a9b529c821d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_52894DBA51C2BA5ACE3EE5577FB04C4C

Filesize
480B

MD5
3b51be5de8152f97e9c2ace23fa95776

SHA1
552c7f27041d38cc53a03f2de33a274d9cf3fcda

SHA256
cffc16f97b3e59ce37c8851bfe5e19f45e0fad734875e213579b962abc995334

SHA512
4aa3068d27c36f8a5af21158b3b974112cf9c2b8d9864e1328c146e276aa84a357a717716fc4a340896bf1296de5dc15817816b707b44d3ff0e08a1587299a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Installer.exe

Filesize
7.1MB

MD5
5fdc21287fa2a976bb5a661e6a2a4d85

SHA1
3bb03dca0de6961b0be9403979a3847d8ba4466d

SHA256
09ac0ed20fdc3cb6b6ff969d18d94f28031d6992fb49f739d0db61d2486cbc54

SHA512
f86827404b703f915ad055604cf8d8d533ed3fe7e9856c77809cf7aa13967844c1dc0716bfc27386f5ac1fa2c0d3c70f25bc1791f3957325893322088fcdd9bc

Download Submit
C:\Windows\TEMP\is-O99HM.tmp\tmp659F.tmp.SyncroLive.Installer-latest.tmp

Filesize
706KB

MD5
4d77c41ecb0fe9113fd7d81e136bb3f1

SHA1
312f0bceabeaa2ad59b79f9656ca94b7f4453258

SHA256
c6fcb8184a3ec70654690413e735ee7c18251da9f3bc708ff2f54d186b6acdb4

SHA512
79dd09f4870a1822c4606dadce47712d8bb1c2ea2bd9d4d743f8b78fb8c1f93227603eba00068a53227186ae6a1a000ca8a21097e69b13e656d0cc401612af30

Download Submit
C:\Windows\TEMP\tmp659F.tmp.SyncroLive.Installer-latest.exe

Filesize
13.5MB

MD5
6ee357d6ff97bd054f2f8d6c1e72f0e7

SHA1
d01ceb73738cf0e2c86463f86292c38e4873c524

SHA256
ad3ebf1789063615ef35ae5583d9641765670fed1ac57659e2d1010f54109f24

SHA512
2b458237b74143e732fbc4740b0437d058966845c2fc4f9f64a4932a98cd6f44e63aedad3ad17aca3f6fc01ccc0b400747b406c38c4595cd22d883cb8aca28f0

Download Submit
C:\Windows\Temp\is-O99HM.tmp\tmp659F.tmp.SyncroLive.Installer-latest.tmp

Filesize
706KB

MD5
4d77c41ecb0fe9113fd7d81e136bb3f1

SHA1
312f0bceabeaa2ad59b79f9656ca94b7f4453258

SHA256
c6fcb8184a3ec70654690413e735ee7c18251da9f3bc708ff2f54d186b6acdb4

SHA512
79dd09f4870a1822c4606dadce47712d8bb1c2ea2bd9d4d743f8b78fb8c1f93227603eba00068a53227186ae6a1a000ca8a21097e69b13e656d0cc401612af30

Download Submit
C:\Windows\Temp\tmp659F.tmp.SyncroLive.Installer-latest.exe

Filesize
13.5MB

MD5
6ee357d6ff97bd054f2f8d6c1e72f0e7

SHA1
d01ceb73738cf0e2c86463f86292c38e4873c524

SHA256
ad3ebf1789063615ef35ae5583d9641765670fed1ac57659e2d1010f54109f24

SHA512
2b458237b74143e732fbc4740b0437d058966845c2fc4f9f64a4932a98cd6f44e63aedad3ad17aca3f6fc01ccc0b400747b406c38c4595cd22d883cb8aca28f0

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6001fd1efaf7eed136c3c73819b97b0

SHA1
ce576d0daf49a50dbecd1f38b4d2988ba5334216

SHA256
40da4978f3c7110a1cf5f92f0f6f1a6224c2df805c8319cda4a60fb01dc55eef

SHA512
696e7dc51283f18823b52a0ec92c200cad7850ca39476d9936954d7da443e03685b56a054f3529a53329d1bb3f8f9e051408246a3220b4b68ae950e4c9199267

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3214e09757441ecc81deba995474bbc9

SHA1
ca3c9ffdae7649000457605ece8e9e0d3da0037b

SHA256
e06652e415db096d8b9c323f0dc93f70ce2ebecf3467040fde69f0044d80a31d

SHA512
e34239607323ea1e0aa703de4083c32827942ca51a15a90f676527699aac2cd9efafc28ffe3533dc5e9976f7b89067d67b0fa72a4f6a2ef7eaf0631541984bb8

Download Submit
\Windows\Temp\is-7H2LL.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-7H2LL.tmp\7za.exe

Filesize
676KB

MD5
2e3309647ce678ca313fe3825a57ccb9

SHA1
792fdeccddd3cc182eac3a1ecd7affe5b48262c8

SHA256
e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4

SHA512
5eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc

Download Submit
\Windows\Temp\is-O99HM.tmp\tmp659F.tmp.SyncroLive.Installer-latest.tmp

Filesize
706KB

MD5
4d77c41ecb0fe9113fd7d81e136bb3f1

SHA1
312f0bceabeaa2ad59b79f9656ca94b7f4453258

SHA256
c6fcb8184a3ec70654690413e735ee7c18251da9f3bc708ff2f54d186b6acdb4

SHA512
79dd09f4870a1822c4606dadce47712d8bb1c2ea2bd9d4d743f8b78fb8c1f93227603eba00068a53227186ae6a1a000ca8a21097e69b13e656d0cc401612af30

Download Submit
memory/320-207-0x00000000748D1000-0x00000000748D3000-memory.dmp

Filesize
8KB

Download
memory/676-97-0x000000013F170000-0x000000013F17A000-memory.dmp

Filesize
40KB

Download
memory/676-99-0x0000000002040000-0x000000000204E000-memory.dmp

Filesize
56KB

Download
memory/764-85-0x000000001B380000-0x000000001B388000-memory.dmp

Filesize
32KB

Download
memory/764-79-0x00000000026F0000-0x00000000026F8000-memory.dmp

Filesize
32KB

Download
memory/764-66-0x0000000000B00000-0x0000000001208000-memory.dmp

Filesize
7.0MB

Download
memory/764-93-0x000000001BAA0000-0x000000001BABA000-memory.dmp

Filesize
104KB

Download
memory/764-92-0x000000001B610000-0x000000001B618000-memory.dmp

Filesize
32KB

Download
memory/764-91-0x000000001B720000-0x000000001B728000-memory.dmp

Filesize
32KB

Download
memory/764-90-0x000000001B600000-0x000000001B608000-memory.dmp

Filesize
32KB

Download
memory/764-89-0x000000001B5F0000-0x000000001B5F8000-memory.dmp

Filesize
32KB

Download
memory/764-88-0x000000001B5E0000-0x000000001B5E8000-memory.dmp

Filesize
32KB

Download
memory/764-87-0x000000001B410000-0x000000001B420000-memory.dmp

Filesize
64KB

Download
memory/764-86-0x000000001C750000-0x000000001C84A000-memory.dmp

Filesize
1000KB

Download
memory/764-67-0x0000000000250000-0x0000000000276000-memory.dmp

Filesize
152KB

Download
memory/764-84-0x000000001AF20000-0x000000001AF28000-memory.dmp

Filesize
32KB

Download
memory/764-83-0x0000000002850000-0x0000000002864000-memory.dmp

Filesize
80KB

Download
memory/764-82-0x000000001AEF0000-0x000000001AF10000-memory.dmp

Filesize
128KB

Download
memory/764-81-0x00000000027A0000-0x000000000284A000-memory.dmp

Filesize
680KB

Download
memory/764-80-0x0000000002790000-0x000000000279C000-memory.dmp

Filesize
48KB

Download
memory/764-68-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/764-78-0x0000000002780000-0x000000000278E000-memory.dmp

Filesize
56KB

Download
memory/764-77-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Filesize
32KB

Download
memory/764-76-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/764-75-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

Filesize
40KB

Download
memory/764-74-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/764-73-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/764-72-0x0000000000AA0000-0x0000000000AC0000-memory.dmp

Filesize
128KB

Download
memory/764-71-0x0000000000A00000-0x0000000000A1A000-memory.dmp

Filesize
104KB

Download
memory/764-70-0x00000000004E0000-0x0000000000504000-memory.dmp

Filesize
144KB

Download
memory/764-69-0x00000000009B0000-0x0000000000A04000-memory.dmp

Filesize
336KB

Download
memory/1520-128-0x0000000000E30000-0x0000000000E54000-memory.dmp

Filesize
144KB

Download
memory/1520-114-0x0000000000A80000-0x0000000000ACA000-memory.dmp

Filesize
296KB

Download
memory/1520-159-0x0000000019980000-0x0000000019992000-memory.dmp

Filesize
72KB

Download
memory/1520-163-0x000000001A5A0000-0x000000001A624000-memory.dmp

Filesize
528KB

Download
memory/1520-164-0x00000000199A0000-0x00000000199A8000-memory.dmp

Filesize
32KB

Download
memory/1520-157-0x0000000019F40000-0x0000000019F82000-memory.dmp

Filesize
264KB

Download
memory/1520-155-0x0000000019970000-0x000000001997C000-memory.dmp

Filesize
48KB

Download
memory/1520-153-0x0000000019940000-0x0000000019970000-memory.dmp

Filesize
192KB

Download
memory/1520-151-0x0000000019450000-0x0000000019460000-memory.dmp

Filesize
64KB

Download
memory/1520-149-0x0000000019420000-0x0000000019428000-memory.dmp

Filesize
32KB

Download
memory/1520-148-0x0000000019930000-0x000000001993E000-memory.dmp

Filesize
56KB

Download
memory/1520-147-0x0000000019930000-0x000000001993E000-memory.dmp

Filesize
56KB

Download
memory/1520-145-0x0000000019440000-0x0000000019448000-memory.dmp

Filesize
32KB

Download
memory/1520-143-0x0000000019430000-0x0000000019438000-memory.dmp

Filesize
32KB

Download
memory/1520-141-0x00000000009E0000-0x00000000009EC000-memory.dmp

Filesize
48KB

Download
memory/1520-139-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/1520-138-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/1520-136-0x0000000000F60000-0x0000000000F74000-memory.dmp

Filesize
80KB

Download
memory/1520-133-0x0000000019E90000-0x0000000019F3A000-memory.dmp

Filesize
680KB

Download
memory/1520-131-0x0000000000F80000-0x0000000000F8A000-memory.dmp

Filesize
40KB

Download
memory/1520-129-0x0000000000D20000-0x0000000000D28000-memory.dmp

Filesize
32KB

Download
memory/1520-103-0x0000000000F90000-0x0000000000F9E000-memory.dmp

Filesize
56KB

Download
memory/1520-126-0x0000000000DF0000-0x0000000000E30000-memory.dmp

Filesize
256KB

Download
memory/1520-105-0x0000000019D90000-0x0000000019E90000-memory.dmp

Filesize
1024KB

Download
memory/1520-124-0x0000000000D00000-0x0000000000D1C000-memory.dmp

Filesize
112KB

Download
memory/1520-107-0x0000000000A30000-0x0000000000A74000-memory.dmp

Filesize
272KB

Download
memory/1520-109-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1520-122-0x0000000000DB0000-0x0000000000DE2000-memory.dmp

Filesize
200KB

Download
memory/1520-120-0x0000000000820000-0x000000000083C000-memory.dmp

Filesize
112KB

Download
memory/1520-116-0x0000000000800000-0x0000000000820000-memory.dmp

Filesize
128KB

Download
memory/1520-118-0x0000000000CD0000-0x0000000000CF6000-memory.dmp

Filesize
152KB

Download
memory/1520-161-0x0000000019F90000-0x0000000019FB0000-memory.dmp

Filesize
128KB

Download
memory/1520-112-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/1520-111-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/1976-199-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1976-198-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2024-54-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download