24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/MSIL.Agent Sample 4d6fa2e2bc89… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4d6fa2e2bc89…. Malware family: Trojan/MSIL.Agent. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064","keywords":["Malicious","Trojan/MSIL.Agent","malware analysis","sandbox report","threat intelligence","4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/MSIL.Agent","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9f4,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "NuGet.Squirrel.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "NuGet.Squirrel.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "MetroFramework.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "websocket-sharp.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "Microsoft.Win32.TaskScheduler.dll"26:T5c5,Found reference to API "nexpected error in ChangeServiceConfig: {0}" (Indicator: "ChangeServiceConfig"; File: "AMSI") Found reference to API "[SC] ChangeServiceConfig2 SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004668.00000000.211421.90CB0000.00000004.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004668.00000000.211421.CE49B000.00000002.mdmp")27:T230a,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") file/memory contains long string with (Indicator: "Aes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "RC2"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "Aes"; File: "SevenZipSharp.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "Rijndael"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Uninstaller.Tools.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "Microsoft.Extensions.Caching.Memory.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RC2"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSAEncryptionPadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSASignaturePadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA1CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA256CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "AsnEncodedData"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeyedHashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") Found reference to "ile cache service AES Encryption with HKDF" (Indicator: "HKDF"; File: "AMSI")28:T5b6,Observed namespace "System" and MemberReference "GetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System" and MemberReference "GetMethods" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection.Emit" and MemberReference "SetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethods" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "MetroFramework.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "websocket-sharp.dll" Observed namespace "System" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "Squirrel.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Syncro.Uninstaller.exe"29:Tf39,4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin has big resource with name: "Installer.Syncro.Installer.exe" size: "5728512" and abnormal entropy:"7.980971065815129" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "165016" and abnormal entropy:"6.13687702150476" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/generictransparent.baml" size: "179273" and abnormal entropy:"6.305550879430742" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblue.baml" size: "178610" and abnormal entropy:"6.307279016171147" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2019.baml" size: "155338" and abnormal entropy:"6.13659563339989" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows11.baml" size: "194937" and abnormal entropy:"6.050952859583138" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows7.baml" size: "177967" and abnormal entropy:"6.307373232539465" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2013.baml" size: "171042" and abnormal entropy:"6.290332332448034" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericsummer.baml" size: "177420" and abnormal entropy:"6.294725185085658" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericexpressiondark.baml" size: "172045" and abnormal entropy:"6.308550398540881" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericfluent.baml" size: "165511" and abnormal entropy:"6.131583930484628" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8.baml" size: "161298" and abnormal entropy:"6.315678054578238" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericgreen.baml" size: "155447" and abnormal entropy:"6.1971925989048104" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8touch.baml" size: "160176" and abnormal entropy:"6.251792892655352" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericmaterial.baml" size: "169738" and abnormal entropy:"6.169199089027241" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblack.baml" size: "178375" and abnormal entropy:"6.307575327553487" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2019.baml" size: "162566" and abnormal entropy:"6.1183753746257095" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvista.baml" size: "178253" and abnormal entropy:"6.297443958952364" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2013.baml" size: "167435" and abnormal entropy:"6.3035493159972225" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016.baml" size: "164564" and abnormal entropy:"6.133823015434066" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficesilver.baml" size: "178265" and abnormal entropy:"6.305982984542167" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericcrystal.baml" size: "160635" and abnormal entropy:"6.1435739242667955" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "67707" and abnormal entropy:"6.170595835395746" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/generictransparent.baml" size: "67445" and abnormal entropy:"6.203426270272531" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericofficeblue.baml" size: "67290" and abnormal entropy:"6.206582184995473"2a:T8a2," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:06 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Accept-Encoding Content-Encoding: gzip ETag: W/"9548f4bdf695b9bf11a05000ee8003ea" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 87c4eefe5ff22af578dbed43205fe943 X-Runtime: 0.005883 with response body ==>7B226C616E6775616765223A22656E222C226272616E64696E675F636F6C6F72223A367D....... "GET /syncro/main/updates/RELEASES HTTP/1.1 Host: production.kabutoservices.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 06:03:07 GMT Content-Type: application/octet-stream Content-Length: 825 Connection: keep-alive Server: nginx Last-Modified: Thu 19 Mar 2026 09:21:39 GMT ETag: "69bbc023-339" Accept-Ranges: bytes with response body ==>363144413237464630384641303643383743313342363332313146313631313439344538303043462053796E63726F2D312E302E3139352E31383131342D6465....... "GET /api/syncro_device/installers/policy_id.json?customer_id=1823766&folder_id=4956886 HTTP/1.1 Host: admin.syncroapi.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 06:03:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare set-cookie: __cflb=02DiuJNvuXtZHcB9NdSBGwREMxfehGcfrE9L2XwCjDPPJ; HttpOnly; SameSite=Lax; Path=/; Expires=Fri 03 Apr 2026 05:03:15 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Authorization ETag: W/"6f0ce7c1261b37bbcea1102db57d4c78" Content-Security-Policy: default-src 'self' https: wss:; font-src 'self' https: data:; img-src 'self' https: data: http: blob:; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' assets.services.repairshopr.com assets.services.syncromsp.com blob:; style-src 'self' https: 'unsafe-inline' assets.services.repairshopr.com assets.services.syncromsp.com X-Request-Id: c5809ec6e8f9797d5fcf950cace22638 X-Runtime: 0.019111 X-S-Info: e27673-7ddcdc6dfc-24w6x Vary: Origin cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=HaLwYSmR5tIoHmU9ucawsd482ZnFBgpe52ycFSEu5A38L67oSAe69BmoiSWOxcq9tdW0PzxSo4HA192lbzPd6RBKjlTy8TzkKXTv4R%2FeND4SsOLrcr3Sc7fqjbxcAQKTOEp6jZk%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: 9e5da11c2f2d1ff0-SJC with response body ==>7B22706F6C6963795F6964223A353437323739387D....... "GET //device_api/sync_device?device_uuid=bcec97cf-63e1-4db5-a392-30b0052ba9a6 HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:16 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"f23a161be167f49fb909afc17abb1abf" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 946c0e13224689db752ccb4c1bcf9b2e X-Runtime: 0.051617 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /device_api/check_active?device_uuid=bcec97cf-63e1-4db5-a392-30b0052ba9a6 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"042a43358b5c5f58cf61979952738cae" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 758b97722ceea92a4e43d4909c230fe5 X-Runtime: 0.009654 with response body ==>7B22616374697665223A747275652C22756E696E7374616C6C6564223A66616C73657D....... "GET /device_api/sync_device?device_uuid=bcec97cf-63e1-4db5-a392-30b0052ba9a6&api_version=1 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"f193f32e4837dd448e47fad1024e8783" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 2f91efb0810ca46c7de6d5107dd6b0d8 X-Runtime: 0.039121 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK X-GUploader-UploadID: AMNfjG39PPFIKpHvyeyGI15fuY0tfHxieK1e1iE9iXq3cYi3DNYkM6tNptFfKarNnP2KhrKd x-goog-generation: 1504833424652915 x-goog-metageneration: 2 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 15086 x-goog-hash: crc32c=PcufuA== x-goog-hash: md5=lAz69MO+eeGC9gN1kA/Csw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Content-Length: 15086 Server: UploadServer Date: Thu 02 Apr 2026 06:02:23 GMT Expires: Thu 02 Apr 2026 07:02:23 GMT Cache-Control: public max-age=3600 Age: 66 Last-Modified: Fri 08 Sep 2017 01:17:04 GMT ETag: "940cfaf4c3be79e182f60375900fc2b3" Content-Type: image/vnd.microsoft.icon Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>000001000300101000000100200068040000360000002020000001002000C2A8100000C29E0400003030000001002000C2A82500004615000028000000100000.......4c:T2512," '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'" (Indicator: " Win32_LogicalDisk"; File: "AMSI") Found string ";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\" (Indicator: " Win32_OperatingSystem"; File: "AMSI") Found string "ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'" (Indicator: " Win32_Service"; File: "AMSI") Found string "elect * from Win32_Process" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT * FROM Win32_Process WHERE Handle = '{0}'" (Indicator: " Win32_Process"; File: "AMSI")69:T419,Found reference to API "b__34_0" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to API "b__34_1" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to API "DeleteFileSafe" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to API "DeleteFileIfExistSafe" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to API "DeleteFileInternal" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin") Found reference to API "DeleteFileIfExist" (Indicator: "DeleteFile"; File: "4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin")6a:Taf3," '" (Indicator: " win32_ntlogevent"; File: "AMSI") "ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '" (Indicator: " win32_ntlogevent"; File: "AMSI") "ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'" (Indicator: " win32_logicaldisk"; File: "AMSI") ";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\" (Indicator: " win32_operatingsystem"; File: "AMSI") "ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'" (Indicator: " win32_service"; File: "AMSI") "elect * from Win32_Process" (Indicator: " win32_process"; File: "AMSI") "ELECT * FROM Win32_Process WHERE Handle = '{0}'" (Indicator: " win32_process"; File: "AMSI")6e:T3401,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1823766,"policy_id":5472798,"folder_id":4956886}}" HTTP/1.1 201 Created Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"5c87d6e740fb4f7a6125906587149766" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 90b5a1dcb973e61781bea9cbd345055c X-Runtime: 0.111428 with response body ==>7B2275756964223A2262636563393763662D363365312D346462352D613339322D333062303035326261396136222C22636F6D70757465725F75756964223A22....... "POST /device_api/metric HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 140 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"device_uuid":"bcec97cf-63e1-4db5-a392-30b0052ba9a6","event_name":"Kabuto_Client_Version","event_params":"{\"version\":\"1.0.199.18369\"}"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"8d0c87c0e37caaa72599614f9bc1486e" Cache-Control: max-age=0 private must-revalidate X-Request-Id: c0e4927c5fd59cceb0fdc2e03c6fe697 X-Runtime: 0.014841 with no response body6f:T74b9,"Syncro.Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\Syncro.Installer.exe]- [targetUID: 00000000-00006988] "Telerik.Windows.Controls.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.dll]- [targetUID: 00000000-00006944] "Telerik.Windows.Controls.Navigation.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Navigation.dll]- [targetUID: 00000000-00006944] "Telerik.Windows.Controls.Input.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Input.dll]- [targetUID: 00000000-00006944] "Syncro.Service.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.exe]- [targetUID: 00000000-00006944] "Telerik.Windows.Controls.ConversationalUI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.ConversationalUI.dll]- [targetUID: 00000000-00006944] "System.Text.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Json.dll]- [targetUID: 00000000-00006944] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Newtonsoft.Json.dll]- [targetUID: 00000000-00006944] "MetroFramework.Fonts.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.Fonts.dll]- [targetUID: 00000000-00006944] "RepairTech.Common.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll]- [targetUID: 00000000-00006944] "Telerik.Windows.Data.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Data.dll]- [targetUID: 00000000-00006944] "Syncro.App.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll]- [targetUID: 00000000-00006944] "NuGet.Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\NuGet.Squirrel.dll]- [targetUID: 00000000-00006944] "7za-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x64.dll]- [targetUID: 00000000-00006944] "MetroFramework.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.dll]- [targetUID: 00000000-00006944] "Mono.Cecil.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Mono.Cecil.dll]- [targetUID: 00000000-00006944] "7za-x86.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x86.dll]- [targetUID: 00000000-00006944] "Autofac.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Autofac.dll]- [targetUID: 00000000-00006944] "websocket-sharp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\websocket-sharp.dll]- [targetUID: 00000000-00006944] "Microsoft.Win32.TaskScheduler.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.TaskScheduler.dll]- [targetUID: 00000000-00006944] "Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Squirrel.dll]- [targetUID: 00000000-00006944] "ICSharpCode.SharpZipLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ICSharpCode.SharpZipLib.dll]- [targetUID: 00000000-00006944] "System.Diagnostics.DiagnosticSource.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.DiagnosticSource.dll]- [targetUID: 00000000-00006944] "Syncro.Uninstaller.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.exe]- [targetUID: 00000000-00006944] "SevenZipSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SevenZipSharp.dll]- [targetUID: 00000000-00006944] "SharpSnmpLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SharpSnmpLib.dll]- [targetUID: 00000000-00006944] "System.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Memory.dll]- [targetUID: 00000000-00006944] "Serilog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.dll]- [targetUID: 00000000-00006944] "CSharpFunctionalExtensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\CSharpFunctionalExtensions.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll]- [targetUID: 00000000-00006944] "RepairTech.Common.Wpf.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Wpf.dll]- [targetUID: 00000000-00006944] "Syncro.Contracts.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll]- [targetUID: 00000000-00006944] "JetBrains.Annotations.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\JetBrains.Annotations.dll]- [targetUID: 00000000-00006944] "System.Numerics.Vectors.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Numerics.Vectors.dll]- [targetUID: 00000000-00006944] "Flurl.Http.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.Http.dll]- [targetUID: 00000000-00006944] "System.IO.Pipelines.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.IO.Pipelines.dll]- [targetUID: 00000000-00006944] "Microsoft.Web.XmlTransform.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Web.XmlTransform.dll]- [targetUID: 00000000-00006944] "Interop.WUApiLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.WUApiLib.dll]- [targetUID: 00000000-00006944] "System.Text.Encodings.Web.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Encodings.Web.dll]- [targetUID: 00000000-00006944] "System.ValueTuple.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ValueTuple.dll]- [targetUID: 00000000-00006944] "Syncro.Uninstaller.Tools.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.Tools.exe]- [targetUID: 00000000-00006944] "Microsoft.Extensions.Logging.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Logging.Abstractions.dll]- [targetUID: 00000000-00006944] "Microsoft.Extensions.Options.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Options.dll]- [targetUID: 00000000-00006944] "Microsoft.Extensions.DependencyInjection.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.DependencyInjection.Abstractions.dll]- [targetUID: 00000000-00006944] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Runner.exe]- [targetUID: 00000000-00006944] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.Service.Runner.exe]- [targetUID: 00000000-00006944] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.App.Runner.exe]- [targetUID: 00000000-00006944] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.Runner.exe]- [targetUID: 00000000-00006944] "FluentCommandLineParser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\FluentCommandLineParser.dll]- [targetUID: 00000000-00006944] "Microsoft.Extensions.Caching.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Memory.dll]- [targetUID: 00000000-00006944] "Microsoft.Extensions.Primitives.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Primitives.dll]- [targetUID: 00000000-00006944] "Splat.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Splat.dll]- [targetUID: 00000000-00006944] "Microsoft.Extensions.Caching.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Abstractions.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "System.Security.Cryptography.Algorithms.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Algorithms.dll]- [targetUID: 00000000-00006944] "System.Security.Cryptography.X509Certificates.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.X509Certificates.dll]- [targetUID: 00000000-00006944] "Flurl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.dll]- [targetUID: 00000000-00006944] "Interop.IWshRuntimeLibrary.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.IWshRuntimeLibrary.dll]- [targetUID: 00000000-00006944] "RollbarSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RollbarSharp.dll]- [targetUID: 00000000-00006944] "Serilog.Sinks.Console.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.Console.dll]- [targetUID: 00000000-00006944] "System.Diagnostics.EventLog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.EventLog.dll]- [targetUID: 00000000-00006944] "Syncro.Uninstaller.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Uninstaller.resources.dll]- [targetUID: 00000000-00006944] "System.Security.AccessControl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.AccessControl.dll]- [targetUID: 00000000-00006944] "Serilog.Sinks.File.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.File.dll]- [targetUID: 00000000-00006944] "System.Runtime.InteropServices.RuntimeInformation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.InteropServices.RuntimeInformation.dll]- [targetUID: 00000000-00006944] "System.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.dll]- [targetUID: 00000000-00006944] "System.Threading.Tasks.Extensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Threading.Tasks.Extensions.dll]- [targetUID: 00000000-00006944] "System.Net.IPNetwork.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Net.IPNetwork.dll]- [targetUID: 00000000-00006944] "Microsoft.Win32.Registry.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.Registry.dll]- [targetUID: 00000000-00006944] "Microsoft.Bcl.AsyncInterfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Bcl.AsyncInterfaces.dll]- [targetUID: 00000000-00006944] "System.Buffers.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Buffers.dll]- [targetUID: 00000000-00006944] "System.Security.Cryptography.Encoding.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Encoding.dll]- [targetUID: 00000000-00006944] "System.Security.Cryptography.Primitives.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Primitives.dll]- [targetUID: 00000000-00006944] "Interop.NetFwTypeLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.NetFwTypeLib.dll]- [targetUID: 00000000-00006944] "System.ServiceProcess.ServiceController.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ServiceProcess.ServiceController.dll]- [targetUID: 00000000-00006944] "Phoenix.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Phoenix.dll]- [targetUID: 00000000-00006944] "Syncro.Service.Models.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Models.dll]- [targetUID: 00000000-00006944] "System.Runtime.CompilerServices.Unsafe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.CompilerServices.Unsafe.dll]- [targetUID: 00000000-00006944] "System.Security.Principal.Windows.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Principal.Windows.dll]- [targetUID: 00000000-00006944] "Destructurama.Attributed.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Destructurama.Attributed.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Service.Configuration.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Service.Services.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Services.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Serilog.Formatting.Compact.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Formatting.Compact.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.App.resources.dll]- [targetUID: 00000000-00006944] "DeltaCompressionDotNet.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\DeltaCompressionDotNet.dll]- [targetUID: 00000000-00006944] "Syncro.Service.Interfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Interfaces.dll]- [targetUID: 00000000-00006944] "UrlCombineLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\UrlCombineLib.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00006944] "Syncro.App.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll.config]- [targetUID: 00000000-00006944] "Syncro.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll.config]- [targetUID: 00000000-00006944] "RepairTech.Common.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll.config]- [targetUID: 00000000-00006944] "Syncro.Contracts.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll.config]- [targetUID: 00000000-00006944] "Syncro.Service.Configuration.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll.config]- [targetUID: 00000000-00006944]70:T3bf5," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"89bc8ea969f24e154c91abf4e40d9b37" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 48fea8eefd7988b24bddd6de1251510e X-Runtime: 0.007751 with no response body "PUT //device_api/device HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Content-Length: 192 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 06:03:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"efc2d9481654ba6bf9fb1fb4d37016db" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 7ff0ea77e6e478b4f282ae0b44d334b2 X-Runtime: 0.071228 with no response body73:T2d7a,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload:==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1823766,"policy_id":5472798,"folder_id":4956886}}"74:T781,Spawned process "b__37_0\" (Indicator: \"CreateDirectory\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"CreateDirectoryWithParents\" (Indicator: \"CreateDirectory\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"CreateDirectoryIfNotExist\" (Indicator: \"CreateDirectory\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"O SEEK penalty is checking for the '{physicalDrive}' drive. DeviceIoControl: {message}\" (Indicator: \"DeviceIoControl\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"OTATE device is checking for the '{physicalDrive}' drive. CreateFile failed: {message}\" (Indicator: \"CreateFile\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataTaskAsync\" in \"Squirrel.dll\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileTaskAsync\" in \"Squirrel.dll\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006988.00000000.210111.038B0000.00000004.mdmp, 00000000-00006988.00000001.212031.038B0000.00000004.mdmp, 00000000-00006988.00000002.212208.038B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\"\n Observed function \"Process.Start\" in \"MetroFramework.dll\"\n Observed function \"Process.Start\" in \"Microsoft.Win32.TaskScheduler.dll\"\n Observed function \"Process.Start\" in \"Squirrel.dll\"\n Observed function \"ProcessUtils.StartHiddenApp\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$43","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$45","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Syncro.Installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile\"\n Process Syncro.Installer.exe created mutex with name \"SM0:6944:120:WilError_01\"\n Process Syncro.Installer.exe created mutex with name \"Local\\SM0:6944:304:WilStaging_02\"\n Process Syncro.Installer.exe created mutex with name \"Global\\RasPbFile\"\n Process Syncro.Installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6944:304:WilStaging_02\"\n Process Syncro.Installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6944:120:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$46","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"%PROGRAMFILES%\\\\RepairTech\\\\Syncro\\\\install.bat\"\" (UID: 00000000-00003248)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$48","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$49","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\.\\pipe\\FingKitHost","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"xtension of JsonFormatter by subclassing is obsolete and will be removed in a future Serilog version. Write a custom formatter based on JsonValueFormatter instead. See https://github.com/serilog/serilog/pull/819.\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\", Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e089\" />\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0,\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$61","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$62","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"X5Dm78\"\n \"{-jY^*'\"\n \"mwkvFk\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"production.kabutoservices.com\" has high entropy\n Contacted domain: \"admin.syncroapi.com\" has high entropy\n Contacted domain: \"storage.googleapis.com\" has high entropy\n Contacted domain: \"mangerhelp.syncroapi.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"PUTs data to a web server (HTTPS)","description":"PUT //device_api/device/addon HTTP/1.1\nContent-Type: application/json\nHost: rmm.syncromsp.com\nContent-Length: 198\nAccept-Encoding: gzip\n deflate\n\n PUT //device_api/device HTTP/1.1\nContent-Type: application/json\nHost: rmm.syncromsp.com\nContent-Length: 192\nAccept-Encoding: gzip\n deflate\n","origin":"Network Traffic","mitre_attack_id":"T1020","relevance":3,"id":"network-73","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://syncromsp.com\"\n Found HTTPS url \"https://go.microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$63","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"admin.syncroapi.com\" (90 days old)\n Short term registered certificate: \"mangerhelp.syncroapi.com\" (90 days old)\n Short term registered certificate: \"rmm.syncromsp.com\" (89 days old)\n Short term registered certificate: \"storage.googleapis.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"20.242.180.219\" on port \"443\"\n HTTPS traffic to \"3.224.165.2\" on port \"443\"\n HTTPS traffic to \"104.26.14.34\" on port \"443\"\n HTTPS traffic to \"172.217.12.123\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"7za-x64.dll\"\n YARA signature for AES encryption matched on file \"7za-x86.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"$64","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"Syncro.Installer.exe\"\n YARA signature matched on embedded PE in file \"Syncro.Service.exe\"\n YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"RepairTech.Common.Wpf.dll\"\n YARA signature for high entropy images embedded in resource file \"Syncro.App.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"file/memory contains long string(File: \"SevenZipSharp.dll\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE13AD19B9E881364D785ECBD9CAE9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006988.00000000.210111.038B0000.00000004.mdmp, 00000000-00006988.00000001.212031.038B0000.00000004.mdmp, 00000000-00006988.00000002.212208.038B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access code repositories","description":"file/memory contains long string with (Indicator: \"github\\\"; File: \"UrlCombineLib.dll\")","origin":"File/Memory","mitre_attack_id":"T1213.003","relevance":1,"id":"string-774","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006988.00000000.210111.038B0000.00000004.mdmp, 00000000-00006988.00000001.212031.038B0000.00000004.mdmp, 00000000-00006988.00000002.212208.038B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"file/memory contains long string with (Indicator: \"nthash\"; File: \"RollbarSharp.dll\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"Syncro.Uninstaller.exe\")\n file/memory contains long string(File: \"Syncro.Tools.dll\")\n file/memory contains long string(File: \"Syncro.Uninstaller.Tools.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"k__BackingField\" (Indicator: \"\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"{0}] http ping to {1}: error, status: {2}, message: {3}\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"ot App.Runner Heartbeat Ping\" (Indicator: \"ping\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Syncro.Installer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"file/memory contains long string(File: \"Syncro.Uninstaller.exe\")\n file/memory contains long string(File: \"Syncro.Uninstaller.Tools.exe\")\n file/memory contains long string(File: \"System.ServiceProcess.ServiceController.dll\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"System.Security.Principal.Windows.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"Syncro.Tools.dll\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006944-00000C2C-2225564482\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006944-00000C2C-2225564505\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006944-00000C2C-2227392176\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006944-00000C2C-2227392200\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Syncro.Installer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006944)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\sc.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004668.00000000.211421.90CB0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006988.00000000.210111.038B0000.00000004.mdmp, 00000000-00006988.00000001.212031.038B0000.00000004.mdmp, 00000000-00006988.00000002.212208.038B0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006988.00000000.210111.038B0000.00000004.mdmp, 00000000-00006988.00000001.212031.038B0000.00000004.mdmp, 00000000-00006988.00000002.212208.038B0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\sc.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007680.00000000.211746.79030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006944-00000C2C-2230463583","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004668.00000000.211421.CE49B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Syncro.Installer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"n&�\")\n \"Syncro.Installer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Syncro.Installer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"| Out-String -Stream -Width 120\" (Indicator: \"Out-String\"; File: \"AMSI\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Syncro.Installer.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\Syncro.Installer.exe]- [targetUID: 00000000-00006988]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Syncro.Installer.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Syncro.Installer.exe.log]- [targetUID: 00000000-00006944]\n Dropped file: \"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin.exe.log]- [targetUID: 00000000-00006988]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"custom-logo.png\" has type \"PNG image data 500 x 120 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"chat-bubbles-icon.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4d6fa2e2bc8964159cf4bbd71095dbb3cc7e9ffa91a9416c2b96970d3615e064.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Telerik.Windows.Controls.ConversationalUI.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"MetroFramework.Fonts.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"NuGet.Squirrel.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"MetroFramework.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"Mono.Cecil.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"7za-x86.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"websocket-sharp.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Syncro.Uninstaller.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ce067386879142590e11c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"