24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/MSIL.Agent Sample 16fcea9cd0ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 16fcea9cd0ef…. Malware family: Trojan/MSIL.Agent. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07","keywords":["Malicious","Trojan/MSIL.Agent","malware analysis","sandbox report","threat intelligence","16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07"],"about":{"@type":"SoftwareApplication","name":"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/MSIL.Agent","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9f4,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "NuGet.Squirrel.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "NuGet.Squirrel.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "MetroFramework.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "websocket-sharp.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "Microsoft.Win32.TaskScheduler.dll"26:T5c5,Found reference to API "nexpected error in ChangeServiceConfig: {0}" (Indicator: "ChangeServiceConfig"; File: "AMSI") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000400.00000000.249694.BC43B000.00000002.mdmp") Found reference to API "[SC] ChangeServiceConfig2 SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006352.00000000.249370.A4900000.00000004.mdmp")27:T230a,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") file/memory contains long string with (Indicator: "Aes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "RC2"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "Aes"; File: "SevenZipSharp.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "Rijndael"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Uninstaller.Tools.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "Microsoft.Extensions.Caching.Memory.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RC2"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSAEncryptionPadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSASignaturePadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA1CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA256CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "AsnEncodedData"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeyedHashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") Found reference to "ile cache service AES Encryption with HKDF" (Indicator: "HKDF"; File: "AMSI")28:T5b6,Observed namespace "System" and MemberReference "GetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System" and MemberReference "GetMethods" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection.Emit" and MemberReference "SetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethods" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "MetroFramework.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "websocket-sharp.dll" Observed namespace "System" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "Squirrel.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Syncro.Uninstaller.exe"29:Tf39,16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin has big resource with name: "Installer.Syncro.Installer.exe" size: "5728512" and abnormal entropy:"7.980971065815129" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "165016" and abnormal entropy:"6.13687702150476" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/generictransparent.baml" size: "179273" and abnormal entropy:"6.305550879430742" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblue.baml" size: "178610" and abnormal entropy:"6.307279016171147" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2019.baml" size: "155338" and abnormal entropy:"6.13659563339989" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows11.baml" size: "194937" and abnormal entropy:"6.050952859583138" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows7.baml" size: "177967" and abnormal entropy:"6.307373232539465" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2013.baml" size: "171042" and abnormal entropy:"6.290332332448034" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericsummer.baml" size: "177420" and abnormal entropy:"6.294725185085658" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericexpressiondark.baml" size: "172045" and abnormal entropy:"6.308550398540881" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericfluent.baml" size: "165511" and abnormal entropy:"6.131583930484628" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8.baml" size: "161298" and abnormal entropy:"6.315678054578238" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericgreen.baml" size: "155447" and abnormal entropy:"6.1971925989048104" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8touch.baml" size: "160176" and abnormal entropy:"6.251792892655352" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericmaterial.baml" size: "169738" and abnormal entropy:"6.169199089027241" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblack.baml" size: "178375" and abnormal entropy:"6.307575327553487" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2019.baml" size: "162566" and abnormal entropy:"6.1183753746257095" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvista.baml" size: "178253" and abnormal entropy:"6.297443958952364" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2013.baml" size: "167435" and abnormal entropy:"6.3035493159972225" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016.baml" size: "164564" and abnormal entropy:"6.133823015434066" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficesilver.baml" size: "178265" and abnormal entropy:"6.305982984542167" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericcrystal.baml" size: "160635" and abnormal entropy:"6.1435739242667955" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "67707" and abnormal entropy:"6.170595835395746" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/generictransparent.baml" size: "67445" and abnormal entropy:"6.203426270272531" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericofficeblue.baml" size: "67290" and abnormal entropy:"6.206582184995473"2a:Ta0b," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:30:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Accept-Encoding Content-Encoding: gzip ETag: W/"88b1abbca6fdd0fed5d9838dfe9ee0fc" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 03abc6a1c44bd1b146b98e0eaa0792b2 X-Runtime: 0.006931 with response body ==>7B226C616E6775616765223A22656E222C226272616E64696E675F636F6C6F72223A367D....... "GET /syncro/main/updates/RELEASES HTTP/1.1 Host: production.kabutoservices.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 00:31:00 GMT Content-Type: application/octet-stream Content-Length: 825 Connection: keep-alive Server: nginx Last-Modified: Thu 19 Mar 2026 09:21:39 GMT ETag: "69bbc023-339" Accept-Ranges: bytes with response body ==>363144413237464630384641303643383743313342363332313146313631313439344538303043462053796E63726F2D312E302E3139352E31383131342D6465....... "GET /api/syncro_device/installers/policy_id.json?customer_id=1823766&folder_id=4956886 HTTP/1.1 Host: admin.syncroapi.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 00:31:09 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare set-cookie: __cflb=02DiuJNvuXtZHcB9NdSBGwREMxfehGcfrmSTwn1RvEEQc; HttpOnly; SameSite=Lax; Path=/; Expires=Thu 02 Apr 2026 23:31:09 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Authorization ETag: W/"6f0ce7c1261b37bbcea1102db57d4c78" Content-Security-Policy: default-src 'self' https: wss:; font-src 'self' https: data:; img-src 'self' https: data: http: blob:; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' assets.services.repairshopr.com assets.services.syncromsp.com blob:; style-src 'self' https: 'unsafe-inline' assets.services.repairshopr.com assets.services.syncromsp.com X-Request-Id: a91a0ddb12a747691ae5949065a12e10 X-Runtime: 0.020517 X-S-Info: 45f48d-76f748bb4d-sxjww Vary: Origin cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nMmnBq6PxqQFPSW%2BE6jz00Fszi%2FE9JRq3E9saPF0XObtJxYhvDIK3YCfcvlCibYxo2%2F2MYy9G5PjyZRpLOvOYZSimucHyEWz48A%2BnmIbenSXbT6LLJU1Fm30f1wR5F8hqc%2F9vyc%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: 9e5bbaa23e1d70f0-SJC with response body ==>7B22706F6C6963795F6964223A353437323739387D....... "GET //device_api/sync_device?device_uuid=8081f049-dead-41ad-a5dc-8ffbd37ee268 HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:10 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"c31f98c61067a5b34436af625f950082" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 331c421714d41b073a3382a5b9368c8a X-Runtime: 0.049117 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /device_api/check_active?device_uuid=8081f049-dead-41ad-a5dc-8ffbd37ee268 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:22 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"7c991084cc7348352840a1ad523e422b" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 028b1fd6a34d175ef7bcfed2a94fdd2c X-Runtime: 0.005024 with response body ==>7B22616374697665223A747275652C22756E696E7374616C6C6564223A6E756C6C7D....... "GET /device_api/sync_device?device_uuid=8081f049-dead-41ad-a5dc-8ffbd37ee268&api_version=1 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:22 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"88ee748d39f7627c5d516dbfaf54ed2a" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 14b655a4573ef32247ff8aa9927ef954 X-Runtime: 0.043678 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK X-GUploader-UploadID: AMNfjG3aikN9OwYoxWKM5thztmiK6CGNGM7MWJNXmMp_3_5E1LLKfoCfKlXfiogprUMFW7xk0Hy6-QI x-goog-generation: 1504833424652915 x-goog-metageneration: 2 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 15086 x-goog-hash: crc32c=PcufuA== x-goog-hash: md5=lAz69MO+eeGC9gN1kA/Csw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Content-Length: 15086 Server: UploadServer Date: Thu 02 Apr 2026 00:14:03 GMT Expires: Thu 02 Apr 2026 01:14:03 GMT Cache-Control: public max-age=3600 Age: 1040 Last-Modified: Fri 08 Sep 2017 01:17:04 GMT ETag: "940cfaf4c3be79e182f60375900fc2b3" Content-Type: image/vnd.microsoft.icon Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>000001000300101000000100200068040000360000002020000001002000C2A8100000C29E0400003030000001002000C2A82500004615000028000000100000.......4c:T2626," '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'" (Indicator: " Win32_LogicalDisk"; File: "AMSI") Found string ";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\" (Indicator: " Win32_OperatingSystem"; File: "AMSI") Found string "ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'" (Indicator: " Win32_Service"; File: "AMSI") Found string "elect * from Win32_Process" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT * FROM Win32_Process WHERE Handle = '{0}'" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT Version FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "AMSI") Found string "ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}" (Indicator: " Win32_Process"; File: "AMSI")6a:T5df,Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00000400.00000000.249694.7FD40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001108.00000000.248064.03510000.00000004.mdmp, 00000000-00001108.00000001.249984.03510000.00000004.mdmp, 00000000-00001108.00000002.250267.03510000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001108.00000000.248064.03510000.00000004.mdmp, 00000000-00001108.00000001.249984.03510000.00000004.mdmp, 00000000-00001108.00000002.250267.03510000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}ks" (Indicator: "\Device\"; Source: "00000000-00001108.00000000.248064.03510000.00000004.mdmp, 00000000-00001108.00000001.249984.03510000.00000004.mdmp, 00000000-00001108.00000002.250267.03510000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}ks" (Indicator: "\DosDevices\"; Source: "00000000-00001108.00000000.248064.03510000.00000004.mdmp, 00000000-00001108.00000001.249984.03510000.00000004.mdmp, 00000000-00001108.00000002.250267.03510000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00006352.00000000.249370.A4900000.00000004.mdmp")6b:T4a7,Found reference to API "b__34_0" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "b__34_1" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "DeleteFileSafe" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "DeleteFileIfExistSafe" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "DeleteFileInternal" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "DeleteFileIfExist" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin")6c:Tae9," '" (Indicator: " win32_ntlogevent"; File: "AMSI") "ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '" (Indicator: " win32_ntlogevent"; File: "AMSI") "ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'" (Indicator: " win32_logicaldisk"; File: "AMSI") ";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\" (Indicator: " win32_operatingsystem"; File: "AMSI") "ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'" (Indicator: " win32_service"; File: "AMSI") "elect * from Win32_Process" (Indicator: " win32_process"; File: "AMSI") "ELECT * FROM Win32_Process WHERE Handle = '{0}'" (Indicator: " win32_process"; File: "AMSI") "ELECT Version FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; File: "AMSI") "ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}" (Indicator: " win32_process"; File: "AMSI")70:T3401,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1823766,"policy_id":5472798,"folder_id":4956886}}" HTTP/1.1 201 Created Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:09 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"2b205ae5e8530f93b5ec26ed4e20167f" Cache-Control: max-age=0 private must-revalidate X-Request-Id: f0457fea7e5e5221f679ef42e1020d74 X-Runtime: 0.084849 with response body ==>7B2275756964223A2238303831663034392D646561642D343161642D613564632D386666626433376565323638222C22636F6D70757465725F75756964223A22....... "POST /device_api/metric HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 140 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"device_uuid":"8081f049-dead-41ad-a5dc-8ffbd37ee268","event_name":"Kabuto_Client_Version","event_params":"{\"version\":\"1.0.199.18369\"}"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"700ed82687bbaa3a23cf6f281c61c91c" Cache-Control: max-age=0 private must-revalidate X-Request-Id: ef6bbc53dd9ef0012065cda34836c3fa X-Runtime: 0.014355 with no response body71:T74b9,"Syncro.Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\Syncro.Installer.exe]- [targetUID: 00000000-00006816] "Telerik.Windows.Controls.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.dll]- [targetUID: 00000000-00006816] "Telerik.Windows.Controls.Navigation.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Navigation.dll]- [targetUID: 00000000-00006816] "Telerik.Windows.Controls.Input.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Input.dll]- [targetUID: 00000000-00006816] "Syncro.Service.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.exe]- [targetUID: 00000000-00006816] "Telerik.Windows.Controls.ConversationalUI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.ConversationalUI.dll]- [targetUID: 00000000-00006816] "System.Text.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Json.dll]- [targetUID: 00000000-00006816] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Newtonsoft.Json.dll]- [targetUID: 00000000-00006816] "MetroFramework.Fonts.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.Fonts.dll]- [targetUID: 00000000-00006816] "RepairTech.Common.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll]- [targetUID: 00000000-00006816] "Telerik.Windows.Data.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Data.dll]- [targetUID: 00000000-00006816] "Syncro.App.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll]- [targetUID: 00000000-00006816] "NuGet.Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\NuGet.Squirrel.dll]- [targetUID: 00000000-00006816] "7za-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x64.dll]- [targetUID: 00000000-00006816] "MetroFramework.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.dll]- [targetUID: 00000000-00006816] "Mono.Cecil.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Mono.Cecil.dll]- [targetUID: 00000000-00006816] "7za-x86.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x86.dll]- [targetUID: 00000000-00006816] "Autofac.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Autofac.dll]- [targetUID: 00000000-00006816] "websocket-sharp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\websocket-sharp.dll]- [targetUID: 00000000-00006816] "Microsoft.Win32.TaskScheduler.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.TaskScheduler.dll]- [targetUID: 00000000-00006816] "Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Squirrel.dll]- [targetUID: 00000000-00006816] "ICSharpCode.SharpZipLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ICSharpCode.SharpZipLib.dll]- [targetUID: 00000000-00006816] "System.Diagnostics.DiagnosticSource.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.DiagnosticSource.dll]- [targetUID: 00000000-00006816] "Syncro.Uninstaller.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.exe]- [targetUID: 00000000-00006816] "SevenZipSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SevenZipSharp.dll]- [targetUID: 00000000-00006816] "SharpSnmpLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SharpSnmpLib.dll]- [targetUID: 00000000-00006816] "System.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Memory.dll]- [targetUID: 00000000-00006816] "Serilog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.dll]- [targetUID: 00000000-00006816] "CSharpFunctionalExtensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\CSharpFunctionalExtensions.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll]- [targetUID: 00000000-00006816] "RepairTech.Common.Wpf.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Wpf.dll]- [targetUID: 00000000-00006816] "Syncro.Contracts.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll]- [targetUID: 00000000-00006816] "JetBrains.Annotations.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\JetBrains.Annotations.dll]- [targetUID: 00000000-00006816] "System.Numerics.Vectors.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Numerics.Vectors.dll]- [targetUID: 00000000-00006816] "Flurl.Http.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.Http.dll]- [targetUID: 00000000-00006816] "System.IO.Pipelines.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.IO.Pipelines.dll]- [targetUID: 00000000-00006816] "Microsoft.Web.XmlTransform.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Web.XmlTransform.dll]- [targetUID: 00000000-00006816] "Interop.WUApiLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.WUApiLib.dll]- [targetUID: 00000000-00006816] "System.Text.Encodings.Web.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Encodings.Web.dll]- [targetUID: 00000000-00006816] "System.ValueTuple.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ValueTuple.dll]- [targetUID: 00000000-00006816] "Syncro.Uninstaller.Tools.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.Tools.exe]- [targetUID: 00000000-00006816] "Microsoft.Extensions.Logging.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Logging.Abstractions.dll]- [targetUID: 00000000-00006816] "Microsoft.Extensions.Options.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Options.dll]- [targetUID: 00000000-00006816] "Microsoft.Extensions.DependencyInjection.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.DependencyInjection.Abstractions.dll]- [targetUID: 00000000-00006816] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Runner.exe]- [targetUID: 00000000-00006816] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.Service.Runner.exe]- [targetUID: 00000000-00006816] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.App.Runner.exe]- [targetUID: 00000000-00006816] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.Runner.exe]- [targetUID: 00000000-00006816] "FluentCommandLineParser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\FluentCommandLineParser.dll]- [targetUID: 00000000-00006816] "Microsoft.Extensions.Caching.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Memory.dll]- [targetUID: 00000000-00006816] "Microsoft.Extensions.Primitives.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Primitives.dll]- [targetUID: 00000000-00006816] "Splat.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Splat.dll]- [targetUID: 00000000-00006816] "Microsoft.Extensions.Caching.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Abstractions.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "System.Security.Cryptography.Algorithms.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Algorithms.dll]- [targetUID: 00000000-00006816] "System.Security.Cryptography.X509Certificates.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.X509Certificates.dll]- [targetUID: 00000000-00006816] "Flurl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.dll]- [targetUID: 00000000-00006816] "Interop.IWshRuntimeLibrary.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.IWshRuntimeLibrary.dll]- [targetUID: 00000000-00006816] "RollbarSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RollbarSharp.dll]- [targetUID: 00000000-00006816] "Serilog.Sinks.Console.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.Console.dll]- [targetUID: 00000000-00006816] "System.Diagnostics.EventLog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.EventLog.dll]- [targetUID: 00000000-00006816] "Syncro.Uninstaller.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Uninstaller.resources.dll]- [targetUID: 00000000-00006816] "System.Security.AccessControl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.AccessControl.dll]- [targetUID: 00000000-00006816] "Serilog.Sinks.File.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.File.dll]- [targetUID: 00000000-00006816] "System.Runtime.InteropServices.RuntimeInformation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.InteropServices.RuntimeInformation.dll]- [targetUID: 00000000-00006816] "System.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.dll]- [targetUID: 00000000-00006816] "System.Threading.Tasks.Extensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Threading.Tasks.Extensions.dll]- [targetUID: 00000000-00006816] "System.Net.IPNetwork.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Net.IPNetwork.dll]- [targetUID: 00000000-00006816] "Microsoft.Win32.Registry.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.Registry.dll]- [targetUID: 00000000-00006816] "Microsoft.Bcl.AsyncInterfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Bcl.AsyncInterfaces.dll]- [targetUID: 00000000-00006816] "System.Buffers.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Buffers.dll]- [targetUID: 00000000-00006816] "System.Security.Cryptography.Encoding.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Encoding.dll]- [targetUID: 00000000-00006816] "System.Security.Cryptography.Primitives.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Primitives.dll]- [targetUID: 00000000-00006816] "Interop.NetFwTypeLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.NetFwTypeLib.dll]- [targetUID: 00000000-00006816] "System.ServiceProcess.ServiceController.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ServiceProcess.ServiceController.dll]- [targetUID: 00000000-00006816] "Phoenix.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Phoenix.dll]- [targetUID: 00000000-00006816] "Syncro.Service.Models.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Models.dll]- [targetUID: 00000000-00006816] "System.Runtime.CompilerServices.Unsafe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.CompilerServices.Unsafe.dll]- [targetUID: 00000000-00006816] "System.Security.Principal.Windows.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Principal.Windows.dll]- [targetUID: 00000000-00006816] "Destructurama.Attributed.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Destructurama.Attributed.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Service.Configuration.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Service.Services.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Services.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Serilog.Formatting.Compact.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Formatting.Compact.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.App.resources.dll]- [targetUID: 00000000-00006816] "DeltaCompressionDotNet.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\DeltaCompressionDotNet.dll]- [targetUID: 00000000-00006816] "Syncro.Service.Interfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Interfaces.dll]- [targetUID: 00000000-00006816] "UrlCombineLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\UrlCombineLib.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006816] "Syncro.App.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll.config]- [targetUID: 00000000-00006816] "Syncro.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll.config]- [targetUID: 00000000-00006816] "RepairTech.Common.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll.config]- [targetUID: 00000000-00006816] "Syncro.Contracts.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll.config]- [targetUID: 00000000-00006816] "Syncro.Service.Configuration.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll.config]- [targetUID: 00000000-00006816]72:T3546," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"7f554f46b5cfe20f645c9d4fd44c0e86" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 383fd05102f2c0f8fcd53f6eb89255c4 X-Runtime: 0.013356 with no response body "PUT //device_api/device HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Content-Length: 192 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 00:31:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"1d67f49590cef448acbc01d53c40ebce" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 014b47868fc7755a9f88fc09aed6f78b X-Runtime: 0.045362 with no response body75:T2d7a,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload:==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1823766,"policy_id":5472798,"folder_id":4956886}}"76:T781,Spawned process "b__37_0\" (Indicator: \"CreateDirectory\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"CreateDirectoryWithParents\" (Indicator: \"CreateDirectory\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"CreateDirectoryIfNotExist\" (Indicator: \"CreateDirectory\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"O SEEK penalty is checking for the '{physicalDrive}' drive. DeviceIoControl: {message}\" (Indicator: \"DeviceIoControl\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"OTATE device is checking for the '{physicalDrive}' drive. CreateFile failed: {message}\" (Indicator: \"CreateFile\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataTaskAsync\" in \"Squirrel.dll\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileTaskAsync\" in \"Squirrel.dll\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001108.00000000.248064.03510000.00000004.mdmp, 00000000-00001108.00000001.249984.03510000.00000004.mdmp, 00000000-00001108.00000002.250267.03510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\"\n Observed function \"Process.Start\" in \"MetroFramework.dll\"\n Observed function \"Process.Start\" in \"Microsoft.Win32.TaskScheduler.dll\"\n Observed function \"Process.Start\" in \"Squirrel.dll\"\n Observed function \"ProcessUtils.StartHiddenApp\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$43","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$45","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Syncro.Installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6816:304:WilStaging_02\"\n Process Syncro.Installer.exe created mutex with name \"Global\\RasPbFile\"\n Process Syncro.Installer.exe created mutex with name \"SM0:6816:120:WilError_01\"\n Process Syncro.Installer.exe created mutex with name \"Local\\SM0:6816:304:WilStaging_02\"\n Process Syncro.Installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6816:120:WilError_01\"\n Process Syncro.Installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$46","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"%PROGRAMFILES%\\\\RepairTech\\\\Syncro\\\\install.bat\"\" (UID: 00000000-00006288)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$48","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$49","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\.\\pipe\\FingKitHost","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"xtension of JsonFormatter by subclassing is obsolete and will be removed in a future Serilog version. Write a custom formatter based on JsonValueFormatter instead. See https://github.com/serilog/serilog/pull/819.\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"k__BackingField\" (Indicator: \"\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"{0}] http ping to {1}: error, status: {2}, message: {3}\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"ot App.Runner Heartbeat Ping\" (Indicator: \"ping\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Syncro.Installer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$69","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"file/memory contains long string(File: \"Syncro.Uninstaller.exe\")\n file/memory contains long string(File: \"Syncro.Uninstaller.Tools.exe\")\n file/memory contains long string(File: \"System.ServiceProcess.ServiceController.dll\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"System.Security.Principal.Windows.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"Syncro.Tools.dll\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816-00000C2C-2878850314\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816-00000C2C-2878850336\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816-00000C2C-2880409341\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816-00000C2C-2880409369\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Syncro.Installer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006816-00000C2C-2882758626","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000400.00000000.249694.BC43B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Syncro.Installer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"6407404EC0C2DC010000000000000000000000000200000000\")\n \"Syncro.Installer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}ks\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001108.00000000.248064.03510000.00000004.mdmp, 00000000-00001108.00000001.249984.03510000.00000004.mdmp, 00000000-00001108.00000002.250267.03510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"| Out-String -Stream -Width 120\" (Indicator: \"Out-String\"; File: \"AMSI\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Syncro.Installer.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\Syncro.Installer.exe]- [targetUID: 00000000-00006816]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Syncro.Installer.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Syncro.Installer.exe.log]- [targetUID: 00000000-00006816]\n Dropped file: \"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin.exe.log]- [targetUID: 00000000-00001108]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"custom-logo.png\" has type \"PNG image data 500 x 120 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"chat-bubbles-icon.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"16fcea9cd0ef8a938844eef02a00ee9a92d64bee83456e5e204179b093619b07.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Telerik.Windows.Controls.ConversationalUI.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"MetroFramework.Fonts.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"NuGet.Squirrel.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"MetroFramework.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"Mono.Cecil.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"7za-x86.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"websocket-sharp.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Syncro.Uninstaller.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69cdb89e9bdd690d4b063167"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"