24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 68:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/MSIL.Agent Sample aa074b990ef3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aa074b990ef3…. Malware family: Trojan/MSIL.Agent. Threat score 100/100. 3/28 AV engines flagged this file. 7 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f","keywords":["Malicious","Trojan/MSIL.Agent","malware analysis","sandbox report","threat intelligence","aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f"],"about":{"@type":"SoftwareApplication","name":"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/MSIL.Agent","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf3f,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00003404.00000001.257553.00270000.00000004.mdmp") Found reference to "get_Oid" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "set_Oid" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "k__BackingField" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "k__BackingField" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "get_OidMonitors" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "set_OidMonitors" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "SnmpDeviceOidMonitorPolicy" (Indicator: "Oid"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found reference to "ile cache service AES Encryption with HKDF" (Indicator: "HKDF"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "get_ECDsaP256" (Indicator: "ECDsa"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "ECDsa" (Indicator: "ECDsa"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "HashAlgorithmName" (Indicator: "HashAlgorithm"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "ECDsaCng" (Indicator: "ECDsa"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "ECDsaCng" (Indicator: "ECDsaCng"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "AesCng" (Indicator: "Aes"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "AesCng" (Indicator: "AesCng"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to "RSASignaturePadding" (Indicator: "RSASignaturePadding"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")26:T562,Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00580000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.005B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00930000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00940000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00B90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.00E10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.010F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.04F20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp")27:T4a1,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Command line contains long Base64-encoded string Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Sample file has high entropy (likely encrypted/compressed content)28:T4d95,Found XOR loop in file "sample.bin" at offset 298580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 366623; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 500184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 503577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 550244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 624922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 630452; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 780575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 893573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 945860; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 998576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1002640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1014017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1213535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1222943; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1252671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1315842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1328119; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1344541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1562120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1709318; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1751316; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1756065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1859008; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1904035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2010956; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2136823; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2171664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2236304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2337587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2446763; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2552827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2589130; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2624745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2880071; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3051646; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3065746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3268077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3284914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3357714; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3430725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3447103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3491768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3502199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3608946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3625923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3646462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3663016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3804530; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3818296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3828936; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3876594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3937026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3961430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3983578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3996109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4009369; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4023163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4100345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4166674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4209940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4258418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4282845; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4330781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4331514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4356451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4393798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4396218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4408420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4431569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4460255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4503066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4526681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4553506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4554029; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4603159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4681483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4694286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4714372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4725480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4735463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4737833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4787330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4837416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4982060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4984176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5040266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5067279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5080695; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5121185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5171654; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5264302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5317567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5517949; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 364451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 457272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 531193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 597692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 620878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 675934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 717159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 719423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 797971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 817047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 895021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 914691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 923100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1061017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1084865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1113739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1258649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1292938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1321207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1425226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1485189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1509001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1753909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1796096; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1935296; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1976057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2093088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2101195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2127008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2334416; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2431328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2434617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2449100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2505566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2521628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2648940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2693721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2866140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2924982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2960100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3075401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3107470; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3151294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3180698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3258793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3393623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3396926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3416788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3450157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3480196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3519558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3656839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3725629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3737770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3759558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3792950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3859787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3903276; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3913238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4037943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4045737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4101715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4121297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4299748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4329635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4349343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4352578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4353428; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4395468; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4465040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4466932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4531745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4603751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4626216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4745800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4781403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4784137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4879595; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4900075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4990685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4993170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5007412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5048845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5078364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5088307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5095287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5132838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5203266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5234967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5267539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5378408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5430308; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5448723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5528589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5553557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5556485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5590174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5645496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5681095; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 67005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 86022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 111543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 227358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 288554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 291425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 302009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 384082; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 401835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 470391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 498524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 785662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 993617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1052042; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1142317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1300151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1306726; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1594284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1609134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1632222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1641951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1729537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1777219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1822112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2195348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2197300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2279327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2284192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2521692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2557486; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2562513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2563910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2597268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2855224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3388294; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3427003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3450161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3489823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3565633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3765487; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3857578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3885185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3901635; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3986780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4020023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4041599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4044491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4074417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4239408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4271314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4298650; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4467740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4512676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4587705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4845455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5036737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5089410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5257521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5260151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5614144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5622363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679472; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5679562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5799037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5801907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5851097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5853967; code bytes = 803029:T5c7,Found string "xtension of JsonFormatter by subclassing is obsolete and will be removed in a future Serilog version. Write a custom formatter based on JsonValueFormatter instead. See https://github.com/serilog/serilog/pull/819." (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found string "RepositoryUrl&https://github.com/serilog/serilog.git" (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found string "Extension of JsonFormatter by subclassing is obsolete and will be removed in a future Serilog version. Write a custom formatter based on JsonValueFormatter instead. See https://github.com/serilog/serilog/pull/819." (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found string "RepositoryUrl-https://github.com/serilog/serilog-sinks-file" (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00930000.00000004.mdmp") Found string "RepositoryUrl0https://github.com/serilog/serilog-sinks-console" (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp") Found string "RepositoryUrl$https://github.com/tmenier/Flurl.git" (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00B90000.00000004.mdmp") Found string "RepositoryUrl*https://github.com/JamesNK/Newtonsoft.Json" (Indicator: "github.com"; Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp")2a:T569,Found string "get_Is64BitOperatingSystem" (Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "k__BackingField" (Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "get_UserName" (Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "set_UserName" (Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "get_OSVersion" (Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp, 00000000-00003404.00000001.257553.010F0000.00000004.mdmp") Found string "b__1_0" (Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "lpMachineName" (Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "WTSUserName" (Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "dwOSVersionInfoSize" (Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found string "Syncro.Pal.Windows.IO.IDriveInfoFactory.GetDrives" (Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")2b:Tabe,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009d009f02000000000000000000000000000000000000140098009f0200000000000000000000086d25000000000020000000000000000000000040eb2800f8692500186b2500903a2900c06e25000000000004f958000000000060fb580095e16c77825b3400feffffffff2b70779a2a707764c5b475b69f7077000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5b475903a290064c5b475 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000025000000000074012500000000000600000000000000500125001a00000010cb2a00000000001a000000000000001400000000000000000000000000000000000000000000000200000278402a006304006700000000000000000000000080000000000000009b3e00a5f8a32a000100000000000000020000000c00000060502a0060502a005b502a0000000000000000000000250000000001c0f1130000000000e0f7130095e16c77ba553400feffffff435c70775059707794000000a00000005a502a0058502a009400000064f31300fdfe977500000000180000004b41306e (UID: 00000000-00003020)2c:Te3e,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100007056290074fb5800145c7077435c707740fc5800010000009401250001000000f4fa5800935c717740837877d4a0707766bd1c7740fc58000100000001000000186a290000000000c4fa5800f4fa580060fb580095e16c776a433400feffffffd4a070771bbe73750000af7500000000 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530000402a000f00010e5213000e63006f006e00660069006700750072006100740069006f006e00000055004200570053005c0041000b00000b2813000000402a00a85729006f00630061006c005c00500072006f0067007200 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebc875b8362f000030fd7f9a5c717700f0fd7f08bb13004430fd7f00000000400000003f000000210000000030fd7ffcba1300c15c717760827877210000000030fd7f9a5c717700f0fd7f20bb1300578970778083787713177475d8ebc875 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003020) "Syncro.Installer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a7010000000000007b8465770000737524ec210001000000e000737501000000d8ea2100935c717740837877d4a070771f84657724ec21000100000001000000a0882b0000000000a8ea2100d8ea210044eb210095e16c773f6a3400feffffffd4a070771bbe73750000af7500000000 (UID: 00000000-00003404) "Syncro.Installer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000024000000020000000000000000000000d00c2d00180000000000000000000000220000000000000000000000240000000d0000000000000001000000040d2d0005000000000000000000000022000000000000000000000024000000020000000000000000000000 (UID: 00000000-00003404) "Syncro.Installer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310075f5f67077f3819c73f42edb71a0a02b00a035db71c3819c735cefd804a0872b00b2f47077d3819c736cefd8040000d4710000d47100000000c8eed804f0000000f000d47100000000d8eed804530000006cf0d80400000000010000003cefd80440f57077000000000000000028efd804 (UID: 00000000-00003404) "Syncro.Installer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c470974c08a31008c47097400000000c08a3100ace7d804086d7077188178770000000060e8d80400000000de549869ece7d80495e16c77077f3400feffffff6b2c717731197475021000000000000000000100c0e7d804c89f70778c4709740000000000000000 (UID: 00000000-00003404) "Syncro.Installer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003404)2d:Ta94,"Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2e:T49b,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" queries volume information of "C:\aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" at 00000000-00003020-0000010C-4901012 "Syncro.Installer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\Syncro.Installer.exe" at 00000000-00003404-0000010C-3898397 "Syncro.Installer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.dll" at 00000000-00003404-0000010C-6174092 "Syncro.Installer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Collections\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Collections.dll" at 00000000-00003404-0000010C-6965758 "Syncro.Installer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003404-0000010C-8827020 "Syncro.Installer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll" at 00000000-00003404-0000010C-157568702f:T53f,"Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "Syncro.Installer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB")30:T4e7c,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003020) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\434d944356ef49383de75240670cd55f\System.ServiceProcess.ni.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003404) "Syncro.Installer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003404)31:T515,Found reference to API "ailed to CreateProcessWithToken, fallback to CreateProcessAsUser" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "CreateProcessWithToken" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "CreateProcessAsUser" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "tartProcessAsCurrentUser: CreateProcessAsUser failed. Error code:" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "CreateProcessingInstruction" (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp")32:T621,Found reference to API "b__37_0" (Indicator: "CreateDirectory"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "CreateDirectoryWithParents" (Indicator: "CreateDirectory"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "CreateDirectoryIfNotExist" (Indicator: "CreateDirectory"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00930000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.00B90000.00000004.mdmp") Found reference to API "b__44_0" (Indicator: "CreateDirectory"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "b__0" (Indicator: "CreateDirectory"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "CreateDirectoryWithParents" (Indicator: "CreateDirectory"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "CreateDirectoryIfNotExist" (Indicator: "CreateDirectory"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")33:T4df,Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "O SEEK penalty is checking for the '{physicalDrive}' drive. CreateFile failed: {message}" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "OTATE device is checking for the '{physicalDrive}' drive. CreateFile failed: {message}" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "b__0" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "b__0" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "TryCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "TryCreateFileStream" (Indicator: "CreateFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")34:T31b5,Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetProcessById"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "MoveFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "CopyFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "AttachConsole"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetTempFileName"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetTempPath"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "Sleep"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetObject"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "MessageBox"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "CreateDirectory"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "SetErrorMode"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "GetStdHandle"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "SetStdHandle"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "CreateFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "AllocConsole"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "FreeConsole"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003020.00000001.257537.020E0000.00000004.mdmp, 00000000-00003020.00000002.257566.020E0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "CreateRestrictedToken"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithToken"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessAsUser"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00930000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.00B90000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00003404.00000001.257553.00910000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.010F0000.00000004.mdmp") Found reference to API (Indicator: "OpenFile"; Source: "00000000-00003404.00000001.257553.00930000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003404.00000001.257553.00930000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "OpenService"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "LoadImage"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "WTSQueryUserToken"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "SetTokenInformation"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "SetThreadDesktop"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateDesktop"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "OpenDesktop"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "WTSEnumerateSessions"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp")35:T53e,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp 00000000-00003020.00000002.257566.00250000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp 00000000-00003020.00000001.257537.00590000.00000002.mdmp 00000000-00003020.00000002.257566.00250000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp 00000000-00003020.00000002.257566.00250000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp 00000000-00003020.00000001.257537.00590000.00000002.mdmp 00000000-00003020.00000002.257566.00250000.00000004.mdmp36:Tb9b,"Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe "Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full" in Source: 600005c-FrameworkInstaller~IsFramework462Installed "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp 00000000-00003020.00000002.257566.00250000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003404.00000001.257553.00270000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003404.00000001.257553.00270000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003404.00000001.257553.00EE0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003404.00000001.257553.00EE0000.00000004.mdmp37:T468,Process aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\INSTALLER-SYNCRO-A32C299C-E895-4A2B-B690-3C73661D7063" Process aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe created mutex with name "Local\ZonesCacheCounterMutex" Process aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe created mutex with name "Global\INSTALLER-SYNCRO-A32C299C-E895-4A2B-B690-3C73661D7063" Process aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process Syncro.Installer.exe created mutex with name "\Sessions\1\BaseNamedObjects\RasPbFile" Process Syncro.Installer.exe created mutex with name "RasPbFile"38:T1272,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "Syncro.Installer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]39:Tdc7,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003020.00000001.257537.020E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003020.00000002.257566.00250000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003020.00000002.257566.020E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003404.00000001.257553.00270000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003404.00000001.257553.00270000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003404.00000001.257553.00EE0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003404.00000001.257553.00EE0000.00000004.mdmp3a:T32e9,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "GDI32.DLL" at base 76330000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76840000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70990000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "KERNEL32" at base 75930000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b830000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "ADVAPI32.DLL" at base 76280000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b7a0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "SHLWAPI.DLL" at base 76860000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "VERSION.DLL" at base 74a50000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 69890000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "USER32.DLL" at base 77830000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "MSCOREE.DLL" at base 6b8e0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "PSAPI.DLL" at base 76030000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "RPCRT4.DLL" at base 766c0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "KERNEL32.DLL" at base 75930000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64250000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "OLE32.DLL" at base 75e70000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "CRYPTBASE.DLL" at base 754b0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6dcf0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b660000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68e30000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cc40000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "SHELL32.DLL" at base 76a60000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "PROFAPI.DLL" at base 755d0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "NTDLL.DLL" at base 776b0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63a30000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "PROPSYS.DLL" at base 74100000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "COMCTL32.DLL" at base 74480000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "OLEAUT32.DLL" at base 75a40000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "CLBCATQ.DLL" at base 76630000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74100000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "NTMARTA.DLL" at base 74a20000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77810000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 756b0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75ca0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "SECUR32.DLL" at base 752e0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75780000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71a60000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75930000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "SETUPAPI.DLL" at base 768c0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75460000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77810000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "CRYPTSP.DLL" at base 74fc0000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d50000 "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" loaded module "RPCRTREMOTE.DLL" at base 75550000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76840000 "Syncro.Installer.exe" loaded module "GDI32.DLL" at base 76330000 "Syncro.Installer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70990000 "Syncro.Installer.exe" loaded module "KERNEL32" at base 75930000 "Syncro.Installer.exe" loaded module "VERSION.DLL" at base 74a50000 "Syncro.Installer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 69890000 "Syncro.Installer.exe" loaded module "USER32.DLL" at base 77830000 "Syncro.Installer.exe" loaded module "MSCOREE.DLL" at base 6b8e0000 "Syncro.Installer.exe" loaded module "PSAPI.DLL" at base 76030000 "Syncro.Installer.exe" loaded module "RPCRT4.DLL" at base 766c0000 "Syncro.Installer.exe" loaded module "KERNEL32.DLL" at base 75930000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64250000 "Syncro.Installer.exe" loaded module "OLE32.DLL" at base 75e70000 "Syncro.Installer.exe" loaded module "CRYPTBASE.DLL" at base 754b0000 "Syncro.Installer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6dcf0000 "Syncro.Installer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b660000 "Syncro.Installer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cc40000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68e30000 "Syncro.Installer.exe" loaded module "ADVAPI32.DLL" at base 76280000 "Syncro.Installer.exe" loaded module "CRYPTSP.DLL" at base 74fc0000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d50000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63a30000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NET.HTTP\C1F72F0CA85CB675A88EFE8F2067F7C8\SYSTEM.NET.HTTP.NI.DLL" at base 6bd30000 "Syncro.Installer.exe" loaded module "SHELL32.DLL" at base 76a60000 "Syncro.Installer.exe" loaded module "PROFAPI.DLL" at base 755d0000 "Syncro.Installer.exe" loaded module "NTDLL.DLL" at base 776b0000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6b610000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 68b50000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 63210000 "Syncro.Installer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 62eb0000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 62730000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a350000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 618c0000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743f0000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 68a40000 "Syncro.Installer.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77810000 "Syncro.Installer.exe" loaded module "BCRYPT.DLL" at base 750d0000 "Syncro.Installer.exe" loaded module "IMM32.DLL" at base 76840000 "Syncro.Installer.exe" loaded module "COMCTL32.DLL" at base 71d40000 "Syncro.Installer.exe" loaded module "GDIPLUS.DLL" at base 73f20000 "Syncro.Installer.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73f20000 "Syncro.Installer.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75930000 "Syncro.Installer.exe" loaded module "DWMAPI.DLL" at base 743a0000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75e70000 "Syncro.Installer.exe" loaded module "CLBCATQ.DLL" at base 76630000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76770000 "Syncro.Installer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SERV759BFB78#\434D944356EF49383DE75240670CD55F\SYSTEM.SERVICEPROCESS.NI.DLL" at base 6c850000 "Syncro.Installer.exe" loaded module "CRYPT32.DLL" at base 75790000 "Syncro.Installer.exe" loaded module "USERENV.DLL" at base 758d0000 "Syncro.Installer.exe" loaded module "GPAPI.DLL" at base 74b90000 "Syncro.Installer.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77810000 "Syncro.Installer.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77810000 "Syncro.Installer.exe" loaded module "RASAPI32.DLL" at base 6bfe0000 "Syncro.Installer.exe" loaded module "RTUTILS.DLL" at base 733c0000 "Syncro.Installer.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77810000 "Syncro.Installer.exe" loaded module "WS2_32.DLL" at base 758f0000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f80000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74ae0000 "Syncro.Installer.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f70000 "Syncro.Installer.exe" loaded module "RASMAN.DLL" at base 6cd30000 "Syncro.Installer.exe" loaded module "WINHTTP.DLL" at base 71240000 "Syncro.Installer.exe" loaded module "SHLWAPI.DLL" at base 76860000 "Syncro.Installer.exe" loaded module "SSPICLI.DLL" at base 75440000 "Syncro.Installer.exe" loaded module "CREDSSP.DLL" at base 74c80000 "Syncro.Installer.exe" loaded module "IPHLPAPI.DLL" at base 73910000 "Syncro.Installer.exe" loaded module "DHCPCSVC6.DLL" at base 73820000 "Syncro.Installer.exe" loaded module "DHCPCSVC.DLL" at base 73740000 "Syncro.Installer.exe" loaded module "NSI.DLL" at base 77800000 "Syncro.Installer.exe" loaded module "CFGMGR32.DLL" at base 756c0000 "Syncro.Installer.exe" loaded module "OLEAUT32.DLL" at base 75a40000 "Syncro.Installer.exe" loaded module "DNSAPI.DLL" at base 74e40000 "Syncro.Installer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 688d00003b:T4c1,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3c:Te48,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA")3d:Tfa0,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003020-00000C2E-125] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00003020-00000C66-2992331908] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003020-00000C2B-2994304836] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003020-00000C2B-2995808705] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003020-00000C2B-2996170117] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003020-00000C2B-2996489379] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003020-00000C2B-2996564962] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003020-00000C2B-2996762517] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003020-00000C2B-2997126755] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003020-00000C2B-2997217187] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003020-00000C2B-2997411410] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003020-00000C2B-2997578638] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003020-00000C2B-2997979940] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003020-00000C2B-2998543764] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003404-00000C2B-3006742784] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003404-00000C2B-3006818583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003404-00000C2B-3006939012] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll" [Source: 00000000-00003404-00000C2B-3007838520] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003404-00000C2B-3008980156] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll" [Source: 00000000-00003404-00000C2B-3010124742] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll" [Source: 00000000-00003404-00000C2B-3010503017] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" [Source: 00000000-00003404-00000C2B-3010854186] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003404-00000C2B-3011080388] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003404-00000C2B-3011564182] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003404-00000C2B-3011702773]3e:Tbab,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "")3f:T10de,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AA074B990EF39F77E3D07F2A3EAD60E1D87B5C073EA6EC5E3760356D131CD15F"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")40:T63f,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" reads file "c:\users\%osuser%\appdata\local\temp\syncro.installer.exe" "Syncro.Installer.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "Syncro.Installer.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux"41:T7e7,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\FLTLIB.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"42:T7bf,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "Syncro.Installer.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" "Syncro.Installer.exe" touched file "C:\Windows\mscorlib.pdb" "Syncro.Installer.exe" touched file "C:\Windows\Syncro.Installer.pdb"43:T851,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\FLTLIB.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll"44:Tb0c,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe.config" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Installer\" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.INI" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe.Local\" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Users\ajeSaco\AppData\Local\Temp\Syncro.Installer.exe:Zone.Identifier" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\AA074B990EF39F77E3D07F2A3EAD60E1D87B5C073EA6EC5E3760356D131CD15F.EXE.CONFIG" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\INSTALLER" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\AA074B990EF39F77E3D07F2A3EAD60E1D87B5C073EA6EC5E3760356D131CD15F.INI" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\ProgramData\SYNCRO" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\AA074B990EF39F77E3D07F2A3EAD60E1D87B5C073EA6EC5E3760356D131CD15F.EXE.LOCAL" "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Syncro.Installer.exe:ZONE.IDENTIFIER" "Syncro.Installer.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local"45:T4e4,Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.WebClient" and MemberReference "GetWebRequest" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AutomaticDecompression" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe"46:T641,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003404-00000C2C-3018465184") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003020.00000000.255616.012C0000.00000002.mdmp, 00000000-00003020.00000001.257537.012C0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003404.00000000.256265.01720000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003404.00000001.257553.00270000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003404.00000001.257553.00270000.00000004.mdmp") Found reference to API "rror shutdown [{0}] {1} process in a watchdog." (Indicator: " shutdown "; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "RollbarSink] Error send data to Rollbar" (Indicator: " send "; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "rying to send {method} call to {url} with {json}..." (Indicator: " send "; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "oo many times tried to send web call, it's out of the queue" (Indicator: " send "; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")47:T5f9,"4.0.0.0" "6.9.1.0" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=nb" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutB" "192.168.0.2" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" "0.0.0.0" "0.0.0.00000" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neu", Potential IP "2.0.0.0" found in string "erilog 2.0.0.0 24c2f752a8e58a10", Potential IP "1.4.0.0" found in string "troFramework 1.4.0.0 5f91a84759bf584a", Potential IP "12.0.0.0" found in string "ewtonsoft.Json 12.0.0.0 30ad4fe6b2a6aeed", Potential IP "13.0.0.0" found in string "ewtonsoft.Json 13.0.0.0 30ad4fe6b2a6aeed", Potential IP "1.1.0.0" found in string "log.Formatting.Compact 1.1.0.0 24c2f752a8e58a10", Potential IP "5.0.0.0" found in string "erilog.Sinks.File 5.0.0.0 24c2f752a8e58a10", Potential IP "4.1.0.0" found in string "erilog.Sinks.Console 4.1.0.0 24c2f752a8e58a10", Potential IP "1.4.0.0" found in string "etroFramework.Fonts 1.4.0.0 5f91a84759bf584a", Potential IP "4.0.0.0" found in string "=4.0.0.0 Cu", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral", "2.5.4.6", "2.5.4.8", "2.5.4.7", "2.5.4.10", "2.5.4.3", "1.19.1.0", "2.0.0.0", "2.12.0.0", "17.0.0.0", "5.0.0.0", "1.1.0.0", "4.1.0.0", "1.0.0.0", "3.2.4.0", "13.0.0.0", "1.5.0.20", "2.5.29.15", "2.5.29.19", "2.5.29.14", "2.5.29.10", "2.5.29.1"48:Te2d,Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "https://syncromsp.com/0/" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Heuristic match: "\f.ag" Heuristic match: "|v:.lv" Heuristic match: "f(.7r.jo" Heuristic match: ":o.bz" Heuristic match: "/9.gw" Pattern match: "https://go.microsoft.com/fwlink/?linkid=780596" Pattern match: "http://go.microsoft.com/fwlink/?linkid=780600" Heuristic match: "production.kabutoservices.com" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "a4de136ccb0e.tm" Heuristic match: "0c0e8f490c2.tm" Heuristic match: "bf8db22d782.tm" Heuristic match: "m.runtime.re" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "json.net is a popular high-performance json framework for .net" Pattern match: "https://github.com/jamesnk/newtonsoft.json" Pattern match: "https://www.newtonsoft.com/jsonschema" Pattern match: "https://www.nuget.org/packages/newtonsoft.json.bson" Pattern match: "newtonsoft.json/obj/release/net45/newtonsoft.json.pdb" Pattern match: "cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e" Pattern match: "crl3.digicert.com/digicertcsrsa4096rootg5.crl0" Pattern match: "http://crl3.digicert.com/netfoundationprojectscodesigningca2.crl0f" Pattern match: "http://crl4.digicert.com/netfoundationprojectscodesigningca2.crl0=" Pattern match: "http://ocsp.digicert.com0o" Pattern match: "cacerts.digicert.com/netfoundationprojectscodesigningca2.crt0" Pattern match: "https://www.newtonsoft.com/json" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Heuristic match: "microsoft .net" Pattern match: "https://rmm.syncromsp.com/device_api/auth/?shop_api_key=k9ghwoxynfhe9olu_btc4w&installer_version=1.0.191"49:T2b0a,Found URL "https://github.com/serilog/serilog/pull/819.typetagessageimestampevelewlinexceptionropertiesourcecontextvs_version_infovarfileinfotranslationstringfileinfo000004b0commentssimple" - Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found URL "https://github.com/serilog/serilog.gitmessagetemplate4serilog.parsing.messagetemplateparser+d__1iuse" - Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found URL "https://github.com/serilog/serilog/pull/819.7use" - Source: "00000000-00003404.00000001.257553.00780000.00000004.mdmp") Found URL "https://github.com/serilog/serilog-sinks-file>new" - Source: "00000000-00003404.00000001.257553.00930000.00000004.mdmp") Found URL "https://github.com/serilog/serilog-sinks-console$use" - Source: "00000000-00003404.00000001.257553.00950000.00000004.mdmp") Found URL "https://github.com/tmenier/flurl.git0flurl.http.cookiecutter+d__05flurl.http.downloadextensions+d__09flurl.http.flurlhttpexception+d__11(flurl.http.flurlrequest+d__293flurl.http.flurlrequest+d__323flurl.http.flurlrequest+d__35.flurl.http.flurlresponse+d__18" - Source: "00000000-00003404.00000001.257553.00B90000.00000004.mdmp") Found URL "https://github.com/jamesnk/newtonsoft.jsonen-us*newtonsoft.json.jsonreader+d__19newtonsoft.json.jsonreader+d__2d__5;newtonsoft.json.jsonreader+d__12bnewtonsoft.json.jsonreader+d__140newtonsoft.json.jsontextreader+d__38newtonsoft.json.jsontextreader+d__4:newtonsoft.json.jsontextreader+d__52newtonsoft.json.jsontextreader+d__74newtonsoft.json.jsontextreader+d__8>newtonsoft.json.jsontextreader+d__9@newtonsoft.json.jsontextreader+d__117newtonsoft.json.jsontextreader+d__124newtonsoft.json.jsontextreader+d__146newtonsoft.json.jsontextreader+d__157newtonsoft.json.jsontextreader+d__168newtonsoft.json.jsontextreader+d__176newtonsoft.json.jsontextreader+d__185newtonsoft.json.jsontextreader+d__19jnewtonsoft.json.jsontextreader+d__206newtonsoft.json.jsontextreader+d__21;newtonsoft.json.jsontextreader+d__259newtonsoft.json.jsontextreader+d__26fnewtonsoft.json.jsontextreader+d__27fnewtonsoft.json.jsontextreader+d__286newtonsoft.json.jsontextreader+d__298newtonsoft.json.jsontextreader+d__31?newtonsoft.json.jsontextreader+d__32@newtonsoft.json.jsontextreader+d__337newtonsoft.json.jsontextreader+d__345newtonsoft.json.jsontextreader+d__357newtonsoft.json.jsontextreader+d__36:newtonsoft.json.jsontextreader+d__37:newtonsoft.json.jsontextreader+d__38:newtonsoft.json.jsontextreader+d__408newtonsoft.json.jsontextreader+d__42dnewtonsoft.json.jsontextreader+d__43;newtonsoft.json.jsontextreader+d__45anewtonsoft.json.jsontextreader+d__47:newtonsoft.json.jsontextreader+d__499newtonsoft.json.jsontextreader+d__518newtonsoft.json.jsontextreader+d__539newtonsoft.json.jsontextreader+d__551newtonsoft.json.jsontextwriter+d__8>newtonsoft.json.jsontextwriter+d__96newtonsoft.json.jsontextwriter+d__13=newtonsoft.json.jsontextwriter+d__15d__24>newtonsoft.json.jsontextwriter+d__30>newtonsoft.json.jsontextwriter+d__32d__35=newtonsoft.json.jsontextwriter+d__38bnewtonsoft.json.jsontextwriter+d__40;newtonsoft.json.jsontextwriter+d__43d__547newtonsoft.json.jsontextwriter+d__607newtonsoft.json.jsontextwriter+d__647newtonsoft.json.jsontextwriter+d__787newtonsoft.json.jsontextwriter+d__977newtonsoft.json.jsontextwriter+d__99=newtonsoft.json.jsontextwriter+d__110:newtonsoft.json.jsontextwriter+d__115;newtonsoft.json.jsontextwriter+d__1212newtonsoft.json.jsonwriter+d__19newtonsoft.json.jsonwriter+d__201newtonsoft.json.jsonwriter+d__30d__31;newtonsoft.json.jsonwriter+d__32jnewtonsoft.json.jsonwriter+<g__awaitproperty" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00003404.00000001.257553.00D50000.00000004.mdmp") Found URL "https://rmm.syncromsp.com/device_api/auth/?shop_api_key=k9ghwoxynfhe9olu_btc4w&installer_version=1.0.191" - Source: "00000000-00003404.00000001.257553.00FF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00003404.00000001.257553.00FF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003404.00000001.257553.00FF0000.00000004.mdmp") Found URL "http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmllicensed" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0&.6>fnv^<<>>0hi" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0&.6>fnv^<<>>egoe" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.notdefnullnonmarkingreturnspaceexclamquotedblnumbersigndollarpercent" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://ocsp.verisign.com0,0*0(" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://crl.verisign.com/tss-ca.crl0tsa1-20u6t:!?da" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://ocsp.verisign.com0:08060http://crl.verisign.com/thawtetimestampingca.crl0tsa2048-1-530?7!op1verisign," - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "https://www.verisign.com/rpa" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "https://www.verisign.com/cps0*https://www.verisign.com/rpa0[0y0w0u" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0(0&0$http://ocsp.verisign.com01*0(0&" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0)class3ca2048-1-550xev1mpsoverisign," - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp") Found URL "http://csc3-2009-2-crl.verisign.com/csc3-2009-2.crl0d=0;090*0(https://www.verisign.com/rpa0i0g0$http://ocsp.verisign.com0?3http://csc3-2009-2-aia.verisign.com/csc3-2009-2.cer0_[kiz9\z5" - Source: "00000000-00003404.00000001.257553.05370000.00000004.mdmp")4a:T51e,Found reference string "ERROR_EVT_INVALID_EVENT_DATA" (Indicator: "error_evt_invalid_event_data"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_HV_EVENT_BUFFER_ALREADY_FREED" (Indicator: "error_hv_event_buffer_already_freed"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_EVT_EVENT_TEMPLATE_NOT_FOUND" (Indicator: "error_evt_event_template_not_found"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_EVT_EVENT_DEFINITION_NOT_FOUND" (Indicator: "error_evt_event_definition_not_found"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_EVENT_DONE" (Indicator: "error_event_done"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_EVENT_PENDING" (Indicator: "error_event_pending"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_NO_EVENT_PAIR" (Indicator: "error_no_event_pair"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference string "ERROR_INVALID_EVENT_COUNT" (Indicator: "error_invalid_event_count"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")4b:Teac,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003020) "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003020)4c:T10d9,Found string "ToBase64" (Indicator: "base64"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "ToBase64String" (Indicator: "base64"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "system.security.cryptography.algorithms" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "costura.system.security.cryptography.algorithms.dll.compressed" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "system.security.cryptography.encoding" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "costura.system.security.cryptography.encoding.dll.compressed" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "system.security.cryptography.primitives" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "costura.system.security.cryptography.primitives.dll.compressed" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003020.00000001.257537.020E0000.00000004.mdmp, 00000000-00003020.00000002.257566.020E0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003020.00000001.257537.020E0000.00000004.mdmp, 00000000-00003020.00000002.257566.020E0000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to e" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003404.00000000.256265.00270000.00000004.mdmp 00000000-00003404.00000001.257553.00270000.00000004.mdmp"), Found string "crosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003404.00000001.257553.00270000.00000004.mdmp"), Found string "ZipFile" (Indicator: "zipfile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp"), Found string "ile cache service AES Encryption with HKDF" (Indicator: "aes"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "ToBase64" (Indicator: "base64"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "base64" (Indicator: "base64"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "get_ECDsaP256" (Indicator: "ecdsa"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "ECDsa" (Indicator: "ecdsa"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "RepairTech.Common.Tools.Services.EncryptionService" (Indicator: ".encrypt"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp"), Found string "ECDsaCng" (Indicator: "ecdsa"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")4d:T422,Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")4e:T78a,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003020.00000000.255616.00250000.00000004.mdmp, 00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000001.257537.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003020.00000002.257566.00250000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003404.00000000.256265.00270000.00000004.mdmp, 00000000-00003404.00000001.257553.00270000.00000004.mdmp")4f:Tb06,Found reference to API "b__34_0" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "b__34_1" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "DeleteFileSafe" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "DeleteFileIfExistSafe" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "DeleteFileInternal" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "DeleteFileIfExist" (Indicator: "DeleteFile"; File: "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe") Found reference to API "DeleteFileSafe" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DeleteFileIfExistSafe" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DeleteFileIfExist" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "b__41_0" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "b__0" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "b__0" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "b__41_1" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DeleteFileInternal" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DeleteFilesByPattern" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DeleteFilePair" (Indicator: "DeleteFile"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")50:T401,Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; Source: "00000000-00003404.00000001.257553.008E0000.00000004.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00003404.00000001.257553.00A80000.00000004.mdmp")51:Te45,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Syncro.Installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")52:T959,"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "Syncro.Installer.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\SYNCRO_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")53:T5af,Found string "CreateSymbolicLinkW" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNEL32.DLL) Found string "AttachConsole" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNEL32.DLL) Found string "EnableMenuItem" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: USER32.DLL) Found string "Sleep" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNELBASE.DLL) Found string "GetSystemMenu" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: USER32.DLL) Found string "SetErrorMode" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNELBASE.DLL) Found string "GetStdHandle" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNELBASE.DLL) Found string "SetStdHandle" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNELBASE.DLL) Found string "AllocConsole" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNEL32.DLL) Found string "FreeConsole" (Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe, API is part of module: KERNEL32.DLL)54:T4f4,"Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "601084c" "cx": "1" "cy": "1"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "4010852" "cx": "1" "cy": "1"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "3c010796" "cx": "484" "cy": "30"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "30010c59" "cx": "484" "cy": "30"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1e010c7f" "cx": "16" "cy": "16"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "30010c59" "cx": "300" "cy": "30"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "3c010796" "cx": "16" "cy": "16"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1e010c7f" "cx": "16" "cy": "26"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1e010c7f" "cx": "1" "cy": "1"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "30010c59" "cx": "1" "cy": "1"} "Syncro.Installer.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "30010c59" "cx": "490" "cy": "30"}55:T5b6,Observed namespace "System" and MemberReference "GetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System" and MemberReference "GetMethods" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection.Emit" and MemberReference "SetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethods" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "MetroFramework.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "websocket-sharp.dll" Observed namespace "System" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "Squirrel.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Syncro.Uninstaller.exe"56:Ta07," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Accept-Encoding Content-Encoding: gzip ETag: W/"b057e7a61086340ea49015785662af62" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 5831c1198a875c73da8086e6d694790b X-Runtime: 0.008316 with response body ==>7B226C616E6775616765223A22656E222C226272616E64696E675F636F6C6F72223A367D....... "GET /syncro/main/updates/RELEASES HTTP/1.1 Host: production.kabutoservices.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 20:18:30 GMT Content-Type: application/octet-stream Content-Length: 825 Connection: keep-alive Server: nginx Last-Modified: Thu 19 Mar 2026 09:21:39 GMT ETag: "69bbc023-339" Accept-Ranges: bytes with response body ==>363144413237464630384641303643383743313342363332313146313631313439344538303043462053796E63726F2D312E302E3139352E31383131342D6465....... "GET /api/syncro_device/installers/policy_id.json?customer_id=1824114&folder_id=4958242 HTTP/1.1 Host: admin.syncroapi.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 20:18:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare set-cookie: __cflb=02DiuJNvuXtZHcB9NdSBGwREMxfehGcfrAW5TZoHxj9wi; HttpOnly; SameSite=Lax; Path=/; Expires=Fri 03 Apr 2026 19:18:39 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Authorization ETag: W/"7a2fe2fc94439e66af5f1688839cad6d" Content-Security-Policy: default-src 'self' https: wss:; font-src 'self' https: data:; img-src 'self' https: data: http: blob:; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' assets.services.repairshopr.com assets.services.syncromsp.com blob:; style-src 'self' https: 'unsafe-inline' assets.services.repairshopr.com assets.services.syncromsp.com X-Request-Id: a15b64ebea8a21d97988ccce96729727 X-Runtime: 0.028545 X-S-Info: aa26d9-69ddbc648c-zd2h5 Vary: Origin cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GCZY%2BnfQjyyOpYCrXIy7vpjeiVCZs8anWuaEnFikTOM066NbeozDYuqWT7WWvdexDKViKR1bzxJ11mbV5x%2BGwxSRNioZso%2FwWPv2EUuIZMc9xBS7GNXc3ln%2FBbfIPaxMBhd9usE%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: 9e628620691ff967-SJC with response body ==>7B22706F6C6963795F6964223A353437343334327D....... "GET //device_api/sync_device?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073 HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:40 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"028486645a13a9ee3c5def1b0db26985" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 26fc9b6e145f4e779704a93741ac9fb9 X-Runtime: 0.035405 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /device_api/check_active?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"d024d0df17b6f847cd5fcec71e246dbb" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 9ec47be5c9f749221ea545baa8b2132b X-Runtime: 0.007065 with response body ==>7B22616374697665223A747275652C22756E696E7374616C6C6564223A6E756C6C7D....... "GET /device_api/sync_device?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073&api_version=1 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"6076578f3247f4bef3e2a3440ffdbee1" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 475e0c0e06eec43d3269697476122e25 X-Runtime: 0.036544 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK X-GUploader-UploadID: AMNfjG1Z3grx6t5RWMXBZMem_64c2dS6Fnq1AgEGSbckhpbbAPYP97LgVbx9m1RVqJ8_17jr_Nexiik x-goog-generation: 1504833424652915 x-goog-metageneration: 2 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 15086 x-goog-hash: crc32c=PcufuA== x-goog-hash: md5=lAz69MO+eeGC9gN1kA/Csw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Content-Length: 15086 Server: UploadServer Date: Thu 02 Apr 2026 20:03:12 GMT Expires: Thu 02 Apr 2026 21:03:12 GMT Cache-Control: public max-age=3600 Age: 940 Last-Modified: Fri 08 Sep 2017 01:17:04 GMT ETag: "940cfaf4c3be79e182f60375900fc2b3" Content-Type: image/vnd.microsoft.icon Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>000001000300101000000100200068040000360000002020000001002000C2A8100000C29E0400003030000001002000C2A82500004615000028000000100000.......5c:T1728,"Telerik.Windows.Controls.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Controls.Navigation.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Navigation.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Controls.Input.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Input.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Controls.ConversationalUI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.ConversationalUI.dll]- [targetUID: 00000000-00000924] "System.Text.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Json.dll]- [targetUID: 00000000-00000924] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Newtonsoft.Json.dll]- [targetUID: 00000000-00000924] "MetroFramework.Fonts.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.Fonts.dll]- [targetUID: 00000000-00000924] "RepairTech.Common.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Data.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Data.dll]- [targetUID: 00000000-00000924] "Syncro.App.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll]- [targetUID: 00000000-00000924] "NuGet.Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\NuGet.Squirrel.dll]- [targetUID: 00000000-00000924] "7za-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x64.dll]- [targetUID: 00000000-00000924] "MetroFramework.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.dll]- [targetUID: 00000000-00000924] "Mono.Cecil.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Mono.Cecil.dll]- [targetUID: 00000000-00000924] "7za-x86.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x86.dll]- [targetUID: 00000000-00000924] "Autofac.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Autofac.dll]- [targetUID: 00000000-00000924] "websocket-sharp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\websocket-sharp.dll]- [targetUID: 00000000-00000924] "Microsoft.Win32.TaskScheduler.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.TaskScheduler.dll]- [targetUID: 00000000-00000924] "Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Squirrel.dll]- [targetUID: 00000000-00000924] "ICSharpCode.SharpZipLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ICSharpCode.SharpZipLib.dll]- [targetUID: 00000000-00000924] "System.Diagnostics.DiagnosticSource.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.DiagnosticSource.dll]- [targetUID: 00000000-00000924] "SevenZipSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SevenZipSharp.dll]- [targetUID: 00000000-00000924] "SharpSnmpLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SharpSnmpLib.dll]- [targetUID: 00000000-00000924] "System.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Memory.dll]- [targetUID: 00000000-00000924] "Serilog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.dll]- [targetUID: 00000000-00000924]5d:Tb61,"Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\Syncro.Service.Runner.exe" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\Syncro.App.Runner.exe" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\packages\RELEASES" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\packages\Syncro-1.0.199.18369-full.nupkg" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\7za-x64.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\7za-x86.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.App.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.Tools.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\Autofac.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\config.json" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.App.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.Tools.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\CSharpFunctionalExtensions.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.App.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.Tools.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.App.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.Tools.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\DeltaCompressionDotNet.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\Destructurama.Attributed.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.App.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.Tools.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.App.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Tools.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Uninstaller.resources.dll" "Syncro.Installer.exe" touched file "C:\Program Files\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.App.resources.dll"5e:T8c7,Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Close" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "Stop" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference ".ctor" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "AcceptTcpClient" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "get_Server" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "SetSocketOption" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpListener" and MemberReference "Start" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Bind" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Listen" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginAccept" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndAccept" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_RemoteEndPoint" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Shutdown" in "websocket-sharp.dll" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "get_Client" in "websocket-sharp.dll"5f:T45d,GET /device_api/auth/?shop_api_key=k9GHWOXYNfhE9OLU_bTc4w&installer_version=1.0.191 HTTP/1.1 Accept: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /syncro/main/updates/RELEASES HTTP/1.1 Host: production.kabutoservices.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET /api/syncro_device/installers/policy_id.json?customer_id=1824114&folder_id=4958242 HTTP/1.1 Host: admin.syncroapi.com Accept-Encoding: gzip deflate Connection: Keep-Alive GET //device_api/sync_device?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073 HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip deflate GET /device_api/check_active?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip deflate GET /device_api/sync_device?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073&api_version=1 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip deflate GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip deflate Connection: Keep-Alive 60:T47c,Found HTTPS GET request to https://rmm.syncromsp.com/device_api/auth/?shop_api_key=k9GHWOXYNfhE9OLU_bTc4w&installer_version=1.0.191 Found HTTPS GET request to https://production.kabutoservices.com/syncro/main/updates/RELEASES Found HTTPS GET request to https://admin.syncroapi.com/api/syncro_device/installers/policy_id.json?customer_id=1824114&folder_id=4958242 Found HTTPS POST request to https://rmm.syncromsp.com/device_api/device Found HTTPS PUT request to https://rmm.syncromsp.com//device_api/device/addon Found HTTPS GET request to https://rmm.syncromsp.com//device_api/sync_device?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073 Found HTTPS PUT request to https://rmm.syncromsp.com//device_api/device Found HTTPS POST request to https://rmm.syncromsp.com/device_api/metric Found HTTPS GET request to https://rmm.syncromsp.com/device_api/check_active?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073 Found HTTPS GET request to https://rmm.syncromsp.com/device_api/sync_device?device_uuid=04525f09-bbbd-4752-8d21-603edb23f073&api_version=1 Found HTTPS GET request to https://storage.googleapis.com/kabuto-assets/syncro_favicon.ico61:T3401,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1824114,"policy_id":5474342,"folder_id":4958242}}" HTTP/1.1 201 Created Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"13b1bd962db97e04fc588ce7cdd1fbce" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 6b80277e8644b14c3685c36a57428548 X-Runtime: 0.112923 with response body ==>7B2275756964223A2230343532356630392D626262642D343735322D386432312D363033656462323366303733222C22636F6D70757465725F75756964223A22....... "POST /device_api/metric HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 140 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"device_uuid":"04525f09-bbbd-4752-8d21-603edb23f073","event_name":"Kabuto_Client_Version","event_params":"{\"version\":\"1.0.199.18369\"}"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"cf86d7ac56317324e1994d1bc9cf6f63" Cache-Control: max-age=0 private must-revalidate X-Request-Id: f4edb5a4a3b3fb415464a22ecc20b173 X-Runtime: 0.018652 with no response body62:T74b9,"Syncro.Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\Syncro.Installer.exe]- [targetUID: 00000000-00003216] "Telerik.Windows.Controls.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Controls.Navigation.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Navigation.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Controls.Input.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Input.dll]- [targetUID: 00000000-00000924] "Syncro.Service.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.exe]- [targetUID: 00000000-00000924] "Telerik.Windows.Controls.ConversationalUI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.ConversationalUI.dll]- [targetUID: 00000000-00000924] "System.Text.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Json.dll]- [targetUID: 00000000-00000924] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Newtonsoft.Json.dll]- [targetUID: 00000000-00000924] "MetroFramework.Fonts.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.Fonts.dll]- [targetUID: 00000000-00000924] "RepairTech.Common.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll]- [targetUID: 00000000-00000924] "Telerik.Windows.Data.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Data.dll]- [targetUID: 00000000-00000924] "Syncro.App.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll]- [targetUID: 00000000-00000924] "NuGet.Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\NuGet.Squirrel.dll]- [targetUID: 00000000-00000924] "7za-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x64.dll]- [targetUID: 00000000-00000924] "MetroFramework.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.dll]- [targetUID: 00000000-00000924] "Mono.Cecil.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Mono.Cecil.dll]- [targetUID: 00000000-00000924] "7za-x86.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x86.dll]- [targetUID: 00000000-00000924] "Autofac.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Autofac.dll]- [targetUID: 00000000-00000924] "websocket-sharp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\websocket-sharp.dll]- [targetUID: 00000000-00000924] "Microsoft.Win32.TaskScheduler.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.TaskScheduler.dll]- [targetUID: 00000000-00000924] "Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Squirrel.dll]- [targetUID: 00000000-00000924] "ICSharpCode.SharpZipLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ICSharpCode.SharpZipLib.dll]- [targetUID: 00000000-00000924] "System.Diagnostics.DiagnosticSource.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.DiagnosticSource.dll]- [targetUID: 00000000-00000924] "Syncro.Uninstaller.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.exe]- [targetUID: 00000000-00000924] "SevenZipSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SevenZipSharp.dll]- [targetUID: 00000000-00000924] "SharpSnmpLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SharpSnmpLib.dll]- [targetUID: 00000000-00000924] "System.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Memory.dll]- [targetUID: 00000000-00000924] "Serilog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.dll]- [targetUID: 00000000-00000924] "CSharpFunctionalExtensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\CSharpFunctionalExtensions.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll]- [targetUID: 00000000-00000924] "RepairTech.Common.Wpf.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Wpf.dll]- [targetUID: 00000000-00000924] "Syncro.Contracts.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll]- [targetUID: 00000000-00000924] "JetBrains.Annotations.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\JetBrains.Annotations.dll]- [targetUID: 00000000-00000924] "System.Numerics.Vectors.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Numerics.Vectors.dll]- [targetUID: 00000000-00000924] "Flurl.Http.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.Http.dll]- [targetUID: 00000000-00000924] "System.IO.Pipelines.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.IO.Pipelines.dll]- [targetUID: 00000000-00000924] "Microsoft.Web.XmlTransform.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Web.XmlTransform.dll]- [targetUID: 00000000-00000924] "Interop.WUApiLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.WUApiLib.dll]- [targetUID: 00000000-00000924] "System.Text.Encodings.Web.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Encodings.Web.dll]- [targetUID: 00000000-00000924] "System.ValueTuple.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ValueTuple.dll]- [targetUID: 00000000-00000924] "Syncro.Uninstaller.Tools.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.Tools.exe]- [targetUID: 00000000-00000924] "Microsoft.Extensions.Logging.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Logging.Abstractions.dll]- [targetUID: 00000000-00000924] "Microsoft.Extensions.Options.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Options.dll]- [targetUID: 00000000-00000924] "Microsoft.Extensions.DependencyInjection.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.DependencyInjection.Abstractions.dll]- [targetUID: 00000000-00000924] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Runner.exe]- [targetUID: 00000000-00000924] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.Service.Runner.exe]- [targetUID: 00000000-00000924] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.App.Runner.exe]- [targetUID: 00000000-00000924] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.Runner.exe]- [targetUID: 00000000-00000924] "FluentCommandLineParser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\FluentCommandLineParser.dll]- [targetUID: 00000000-00000924] "Microsoft.Extensions.Caching.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Memory.dll]- [targetUID: 00000000-00000924] "Microsoft.Extensions.Primitives.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Primitives.dll]- [targetUID: 00000000-00000924] "Splat.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Splat.dll]- [targetUID: 00000000-00000924] "Microsoft.Extensions.Caching.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Abstractions.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "System.Security.Cryptography.Algorithms.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Algorithms.dll]- [targetUID: 00000000-00000924] "System.Security.Cryptography.X509Certificates.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.X509Certificates.dll]- [targetUID: 00000000-00000924] "Flurl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.dll]- [targetUID: 00000000-00000924] "Interop.IWshRuntimeLibrary.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.IWshRuntimeLibrary.dll]- [targetUID: 00000000-00000924] "RollbarSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RollbarSharp.dll]- [targetUID: 00000000-00000924] "Serilog.Sinks.Console.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.Console.dll]- [targetUID: 00000000-00000924] "System.Diagnostics.EventLog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.EventLog.dll]- [targetUID: 00000000-00000924] "Syncro.Uninstaller.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Uninstaller.resources.dll]- [targetUID: 00000000-00000924] "System.Security.AccessControl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.AccessControl.dll]- [targetUID: 00000000-00000924] "Serilog.Sinks.File.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.File.dll]- [targetUID: 00000000-00000924] "System.Runtime.InteropServices.RuntimeInformation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.InteropServices.RuntimeInformation.dll]- [targetUID: 00000000-00000924] "System.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.dll]- [targetUID: 00000000-00000924] "System.Threading.Tasks.Extensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Threading.Tasks.Extensions.dll]- [targetUID: 00000000-00000924] "System.Net.IPNetwork.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Net.IPNetwork.dll]- [targetUID: 00000000-00000924] "Microsoft.Win32.Registry.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.Registry.dll]- [targetUID: 00000000-00000924] "Microsoft.Bcl.AsyncInterfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Bcl.AsyncInterfaces.dll]- [targetUID: 00000000-00000924] "System.Buffers.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Buffers.dll]- [targetUID: 00000000-00000924] "System.Security.Cryptography.Encoding.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Encoding.dll]- [targetUID: 00000000-00000924] "System.Security.Cryptography.Primitives.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Primitives.dll]- [targetUID: 00000000-00000924] "Interop.NetFwTypeLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.NetFwTypeLib.dll]- [targetUID: 00000000-00000924] "System.ServiceProcess.ServiceController.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ServiceProcess.ServiceController.dll]- [targetUID: 00000000-00000924] "Phoenix.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Phoenix.dll]- [targetUID: 00000000-00000924] "Syncro.Service.Models.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Models.dll]- [targetUID: 00000000-00000924] "System.Runtime.CompilerServices.Unsafe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.CompilerServices.Unsafe.dll]- [targetUID: 00000000-00000924] "System.Security.Principal.Windows.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Principal.Windows.dll]- [targetUID: 00000000-00000924] "Destructurama.Attributed.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Destructurama.Attributed.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Service.Configuration.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Service.Services.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Services.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Serilog.Formatting.Compact.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Formatting.Compact.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.App.resources.dll]- [targetUID: 00000000-00000924] "DeltaCompressionDotNet.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\DeltaCompressionDotNet.dll]- [targetUID: 00000000-00000924] "Syncro.Service.Interfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Interfaces.dll]- [targetUID: 00000000-00000924] "UrlCombineLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\UrlCombineLib.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000924] "Syncro.App.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll.config]- [targetUID: 00000000-00000924] "Syncro.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll.config]- [targetUID: 00000000-00000924] "RepairTech.Common.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll.config]- [targetUID: 00000000-00000924] "Syncro.Contracts.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll.config]- [targetUID: 00000000-00000924] "Syncro.Service.Configuration.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll.config]- [targetUID: 00000000-00000924]63:T5c8,"PUT //device_api/device/addon HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Content-Length: 198 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"1017de3e3c6fa5e9ecbc2dd64b761521" Cache-Control: max-age=0 private must-revalidate X-Request-Id: c39d87362067930fdf3a484df15fe595 X-Runtime: 0.006949 with no response body "PUT //device_api/device HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Content-Length: 192 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 20:18:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"6f571a65879a4db2476acf7b1fae4027" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 95979c4849696deb43fe5e07ead6a767 X-Runtime: 0.052253 with no response body64:T2d7a,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload:==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1824114,"policy_id":5474342,"folder_id":4958242}}"65:T781,Spawned process "b__0\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"18122081594200941067,2772,109,,GetWindowTextW,user32.dll,\"1041:14:51.767\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00003404.00000001.257553.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003020.00000001.257537.00250000.00000004.mdmp\n 00000000-00003020.00000002.257566.00250000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionFullPaths\" (Indicator: \"GetVersion\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"144113280672,2792,3024,,RtlGetVersion,NTDLL.dll,\"252:52:11.681\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003404.00000000.256265.00270000.00000004.mdmp\")\n Found reference to API \"GetVersionStructured\" (Indicator: \"GetVersion\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"GetVersionHumanReadable\" (Indicator: \"GetVersion\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%processor_architecture%\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Syncro.Installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Syncro.Installer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SYNCRO.INSTALLER.EXE\")\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SYNCRO.INSTALLER.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.010F0000.00000004.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.010F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Syncro (UID: 00000000-00003020)\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Syncro\\logs (UID: 00000000-00003020)\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00003020)\n \"Syncro.Installer.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003404)\n \"Syncro.Installer.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Syncro.Installer.exe\" --jwt-payload \"eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJ2ZXJzaW9uIjoxLCJ\" - (UID: 00000000-00003020)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.010F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\GitLab-Runner\\builds\\MvqzSHEmm\\0\\syncromsp\\team-rmm-agent\\kabuto-app\\Kabuto.App.Runner\\obj\\Release\\Syncro.App.Runner.pdb\"\n \"C:\\GitLab-Runner\\builds\\MvqzSHEmm\\0\\syncromsp\\team-rmm-agent\\kabuto-app\\Kabuto.Service.Runner\\obj\\Release\\Syncro.Service.Runner.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"CloseServiceHandleSafeHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"O SEEK penalty is checking for the '{physicalDrive}' drive. DeviceIoControl: {message}\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found reference to API \"OTATE device is checking for the '{physicalDrive}' drive. DeviceIoControl: {message}\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegDisablePredefinedCache\" (Indicator: \"RegDisablePredefinedCache\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.010F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"b__0\" (Indicator: \"MoveFile\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$35","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"CreateSymbolicLinkW\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"RmRegisterResources\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"RmStartSession\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"RmEndSession\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"RmGetList\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"AttachConsole\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"GetSystemMenu\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed unmanaged function \"EnableMenuItem\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"xtension of JsonFormatter by subclassing is obsolete and will be removed in a future Serilog version. Write a custom formatter based on JsonValueFormatter instead. See https://github.com/serilog/serilog/pull/819.\" (Indicator: \"github.com\")\n \"RepositoryUrl&https://github.com/serilog/serilog.git\" (Indicator: \"github.com\")\n \"Extension of JsonFormatter by subclassing is obsolete and will be removed in a future Serilog version. Write a custom formatter based on JsonValueFormatter instead. See https://github.com/serilog/serilog/pull/819.\" (Indicator: \"github.com\")\n \"RepositoryUrl-https://github.com/serilog/serilog-sinks-file\" (Indicator: \"github.com\")\n \"RepositoryUrl0https://github.com/serilog/serilog-sinks-console\" (Indicator: \"github.com\")\n \"RepositoryUrl$https://github.com/tmenier/Flurl.git\" (Indicator: \"github.com\")\n \"RepositoryUrl*https://github.com/JamesNK/Newtonsoft.Json\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75C50000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 64250000\n \"Syncro.Installer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 64250000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Syncro.Installer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 750D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 690E0000\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 69890000\n \"Syncro.Installer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 69890000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 766C0000\n \"Syncro.Installer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 766C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"100011000e03926b@ADVAPI32.dll\"\n \"0d000e002203926b@ADVAPI32.dll\"\n \"0d000e00fe02926b@ADVAPI32.dll\"\n \"0b000c00cc02926b@ADVAPI32.dll\"\n \"10001100da02926b@ADVAPI32.dll\"\n \"15001600b09e8c6b@ADVAPI32.dll\"\n \"0e000f00609f8c6b@ADVAPI32.dll\"\n \"0e000f00bc9f8c6b@ADVAPI32.dll\"\n \"11001200e0a78c6b@ADVAPI32.dll\"\n \"1100120074a88c6b@ADVAPI32.dll\"\n \"12001300b8a88c6b@ADVAPI32.dll\"\n \"1200130010a98c6b@ADVAPI32.dll\"\n \"1400150058d78c6b@ADVAPI32.dll\"\n \"1400150070d78c6b@ADVAPI32.dll\"\n \"1400150088d78c6b@ADVAPI32.dll\"\n \"17001800a0d78c6b@ADVAPI32.dll\"\n \"0d000e00b8d78c6b@ADVAPI32.dll\"\n \"11001200c8d78c6b@ADVAPI32.dll\"\n \"11001200dcd78c6b@ADVAPI32.dll\"\n \"0f0010001cd98c6b@ADVAPI32.dll\"\n \"140015005cd98c6b@ADVAPI32.dll\"\n \"1400150074d98c6b@ADVAPI32.dll\"\n \"0c000d00bcd98c6b@ADVAPI32.dll\"\n \"0c000d00ccd98c6b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" was detected as \".NET\" and name: \"Library\"\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\")\n \"Syncro.Installer.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x589c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x589a20\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"@ECHO OFFGOTO %PROCESSOR_ARCHITECTURE%:AMD64\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\installutil.exe\" /ShowCallStack /LogFile=%ALLUSERSPROFILE%/Syncro/logs/ServiceInstall.log \"%~dp0Syncro.Service.Runner.exe\"IF NOT %ERRORLEVEL% == 0 (GOTO Error)GOTO Success:X86\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\installutil.exe\" /ShowCallStack /LogFile=%ALLUSERSPROFILE%/Syncro/logs/ServiceInstall.log \"%~dp0Syncro.Service.Runner.exe\"IF NOT %ERRORLEVEL% == 0 (GOTO Error)GOTO Success:Successsc failure Syncro reset= 60 actions= restart/5000/restart/10000/restart/60000sc start SyncroGOTO End:ErrorEXIT /B %ERRORLEVEL%:End\" [Source: aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Syncro.Installer.exe\" (UID: 00000000-00003404) was launched with new environment variables: \"USERDNSDOMAIN=\"A1DLVj9Yow\"\"\n Process \"Syncro.Installer.exe\" (UID: 00000000-00003404) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Syncro.Installer.exe\" with commandline \"--jwt-payload \"eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJ2ZXJzaW9u ...\" (UID: 00000000-00003404)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Syncro.Installer.exe\" with commandline \"--jwt-payload \"eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJ2ZXJzaW9u ...\" (UID: 00000000-00003404)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 2299940)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: F3:58:81:1B:0C:1E:F9:11:D4:E3:C9:AA:60:05:6F:C9:3F:A5:DB:2C; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" connecting to \"\\ThemeApiPort\"\n \"Syncro.Installer.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"b__0\" (Indicator: \"CreateService\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"CreateServiceController\" (Indicator: \"CreateService\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Syncro.Installer.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Syncro.Installer20260403.log\" has type \"ASCII text with CRLF LF line terminators\"- Location: [%ALLUSERSPROFILE%\\Syncro\\logs\\Syncro.Installer20260403.log]- [targetUID: 00000000-00003404]\n \"MasterInstaller20260403.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%ALLUSERSPROFILE%\\Syncro\\logs\\MasterInstaller20260403.log]- [targetUID: 00000000-00003020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Syncro.Installer.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" writes file \"c:\\programdata\\syncro\\logs\\masterinstaller20260403.log\"\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\syncro.installer.exe\"\n \"Syncro.Installer.exe\" writes file \"c:\\programdata\\syncro\\logs\\syncro.installer20260403.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" writes a file \"C:\\ProgramData\\Syncro\\logs\\MasterInstaller20260403.log\"\n \"Syncro.Installer.exe\" writes a file \"C:\\ProgramData\\Syncro\\logs\\Syncro.Installer20260403.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping \"; Source: \"00000000-00003020.00000000.255616.00250000.00000004.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003404-00000C2C-3018481523\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003020)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003404-00000C2C-3018465184\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003404-00000C2C-3019400275\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003404-00000C2C-3019400796\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed namespace \"System.Net.Security\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"{1}\"; filename=\"{2}\"\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found string \"Content-Disposition: form-data; name=\"{1}\"\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://syncromsp.com\"\n Found HTTPS url \"https://go.microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00003404\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource process \"00000000-00003404\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateWindowStation\" (Indicator: \"CreateWindowStation\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"CreateDesktop\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"WTSQuerySessionInformation\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"WTSEnumerateSessions\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE74074926D0DC43909B7D6A6CCA08]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows event information","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-977","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp\")\n Found string \"ERROR_IPSEC_IKE_KERBEROS_ERROR\" (Indicator: \"kerberos\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003404.00000001.257553.00FF0000.00000004.mdmp\")\n Found string \"\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003404.00000001.257553.00FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"144113280672,2792,3024,,RtlGetVersion,NTDLL.dll,\"252:52:11.681\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003404.00000000.256265.00270000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003404.00000000.256265.00270000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"WTSQuerySessionInformation\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" tries to directly access volume data \"C:\"\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Syncro.Installer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"6552,1908,3120,,FindNextFileW,kernel32.dll,\"252:52:06.814\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003020.00000001.257537.00250000.00000004.mdmp, 00000000-00003020.00000002.257566.00250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessions\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"\n Observed function \"get_ProcessName\" in \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00003404.00000001.257553.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp, 00000000-00003404.00000001.257553.00B90000.00000004.mdmp\")\n Found string \"streamer_password_ttl&\" (Indicator: \"password\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp\")\n Found string \"auth_password\" (Indicator: \"password\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp\")\n Found string \"encryption_password\" (Indicator: \"password\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00003404.00000001.257553.00FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003404.00000001.257553.008E0000.00000004.mdmp\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003404.00000001.257553.008E0000.00000004.mdmp\n \"OFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B7F56D3D-2AD3-4021-9D36-3B9E9C9FBE33}\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003404.00000001.257553.008E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"k__BackingField\" (Indicator: \"\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\")\n Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp, 00000000-00003404.00000001.257553.00D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00003020.00000000.255616.00250000.00000004.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003404.00000001.257553.00910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Syncro.Installer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"ELECT Version FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found string \"ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"ServiceController\" (Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found string \"ServiceControllerStatus\" (Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp, 00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found string \"reateServiceController\" (Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found string \"b__0\" (Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")\n Found string \"CreateServiceController\" (Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Syncro.Installer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003404)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ailed to CreateProcessWithToken, fallback to CreateProcessAsUser\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found reference to API \"ailed to CreateProcessWithToken, fallback to CreateProcessAsUser\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n Found reference to API \"ommand runas standard user with PID: {pid} Command: {command}\" (Indicator: \"runas \"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003404.00000001.257553.00A80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Syncro.Installer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" opened \"\\Device\\KsecDD\"\n \"Syncro.Installer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"| Out-String -Stream -Width 120\" (Indicator: \"Out-String\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Syncro.Installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" at 00000000-00003020-00000105-10521977\n \"Syncro.Installer.exe\" at 00000000-00003404-00000105-5723032","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3020)\n \"Syncro.Installer.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3404)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" has section name .text with entropy \"7.976289146691211\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"ELECT Version FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00003404.00000001.257553.008E0000.00000004.mdmp\")\n \"ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}\" (Indicator: \" win32_process\"; Source: \"00000000-00003404.00000001.257553.00A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"69f0d6310000569f61\" (Indicator: \"000569\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" sleeping for \"1566804069\" milliseconds\n \"Syncro.Installer.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" has resource with unusual entropy \"RT_ICON:7.971101165852461\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" wrote 26880 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.PictureBox::set_TabIndex(System.Int32) at bb732bd54a72126e7b6f1e56d39f8418-60000a3-NETProgressView~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect syncro RMM tool file \"sample.bin\"\n YARA signature to detect kabuto RMM tool process \"00000000-00003404\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Fody\" matched file \"sample.bin\" as \"Detects executables manipulated with Fody\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$54","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Syncro.Installer.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"1\"}\n \"Syncro.Installer.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"2\"}\n \"Syncro.Installer.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"4\"}\n \"Syncro.Installer.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"5\"}\n \"Syncro.Installer.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"6\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at bb732bd54a72126e7b6f1e56d39f8418-6000046-FileLockerUtil~WhoIsLocking","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" claims program is from Mon May 27 21:58:46 2047","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"},{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" allocated memory in \"C:\\aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" wrote 1500 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\" (Handle: 844)\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\" (Handle: 844)\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\" (Handle: 844)\n \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Syncro.Installer.exe\" (Handle: 844)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69cf4e8b67ffd8f9d10abb88"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"MetroFramework.dll\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"Squirrel.dll\"\n Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.ZipFile\" in \"Squirrel.dll\"\n Observed function \"System.IO.Compression.ZipArchive\" in \"Squirrel.dll\"\n Observed function \"System.IO.Compression.ZipArchiveEntry\" in \"Squirrel.dll\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"Telerik.Windows.Data.dll\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"Telerik.Windows.Data.dll\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"| ConvertTo-Json -Compress\" (Indicator: \"ConvertTo-Json\"; File: \"AMSI\")\n Found string \"et-MpThreat | ConvertTo-Json -Compress\" (Indicator: \"ConvertTo-Json\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.ReflectionOnlyLoadFrom\" in \"NuGet.Squirrel.dll\"\n Observed function \"System.Reflection.ReflectionOnlyLoad\" in \"NuGet.Squirrel.dll\"\n Observed function \"System.Reflection.Load\" in \"Mono.Cecil.dll\"\n Observed function \"System.Reflection.LoadFrom\" in \"Microsoft.Win32.TaskScheduler.dll\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"Squirrel.dll\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"ICSharpCode.SharpZipLib.dll\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"ICSharpCode.SharpZipLib.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"$55","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$56","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"Syncro.Installer.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp3E90.tmp\" to \"%ALLUSERSPROFILE%\\Syncro\\Images\\logo.ico\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Syncro.Installer.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"NtQueryInformationProcess\" in \"Squirrel.dll\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005232.00000000.151686.0B33B000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005232.00000000.151686.0B33B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"ICSharpCode.SharpZipLib.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"$57","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"ICSharpCode.SharpZipLib.dll\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"ICSharpCode.SharpZipLib.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"ICSharpCode.SharpZipLib.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RNGCryptoServiceProvider\" and TypeReference \".ctor\" in \"websocket-sharp.dll\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"websocket-sharp.dll\"\n Observed namespace \"System.Security.Cryptography.RNGCryptoServiceProvider\" and TypeReference \".ctor\" in \"ICSharpCode.SharpZipLib.dll\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"ICSharpCode.SharpZipLib.dll\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"ICSharpCode.SharpZipLib.dll\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$58","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\\\" (File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000924-00000C2C-1348488609\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"file/memory contains long string with (Indicator: \".drivetype\"; File: \"Interop.IWshRuntimeLibrary.dll\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005232.00000000.151686.0B33B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"Microsoft.Win32.TaskScheduler.dll\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET Endpoint Antivirus\" (Indicator: \"set \"; File: \"AMSI\")\n Found string \"SET File Security\" (Indicator: \"set \"; File: \"AMSI\")\n Found string \"SET Management Agent\" (Indicator: \"set \"; File: \"AMSI\")\n Found string \"SET Server Security\" (Indicator: \"set \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005232.00000000.151686.0B33B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"OpenProcessToken\" in \"Microsoft.Win32.TaskScheduler.dll\"\n Observed API \"LoadLibrary\" in \"Microsoft.Win32.TaskScheduler.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000924-00000C2C-1372801181\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Syncro.Service.Runner.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Syncro.Installer.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00000924)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"Syncro.Installer.exe\" called \"MoveFileW\" with parameter %TEMP%\\tmp3E90.tmp & %ALLUSERSPROFILE%\\Syncro\\Images\\logo.ico (UID: 00000000-00000924)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"rmm.syncromsp.com\"\n \"production.kabutoservices.com\"\n \"admin.syncroapi.com\"\n \"storage.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"20.242.180.219:443\"\n \"54.209.235.231:443\"\n \"104.26.15.34:443\"\n \"142.251.218.187:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005232.00000000.151686.0B33B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005232.00000000.151686.0B33B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$59","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"Squirrel.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$5a","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"%PROGRAMFILES%\\\\RepairTech\\\\Syncro\\\\install.bat\"\" (UID: 00000000-00006212)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\.\\pipe\\FingKitHost","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$5b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Syncro.Installer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 7C940000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"7za-x64.dll\" has an writable section named \".data\"\n \"7za-x86.dll\" has an writable section named \".data\"\n \"7za-x86.dll\" has an writable section named \".sxdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"vast Antivirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"vast Pro Antivirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"vast! Antivirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"OMODO Antivirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"cAfee AntiVirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"orton AntiVirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"anda Antivirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"ymantec AntiVirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"hecking AntiVirus\" (Indicator: \"antivirus\") in Source: AMSI\n \"nstalled_BitDefender\" (Indicator: \"bitdefender\") in Source: AMSI","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"admin.syncroapi.com\"\n \"mangerhelp.syncroapi.com\"\n \"production.kabutoservices.com\"\n \"rmm.syncromsp.com\"\n \"storage.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Mono.Cecil.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"7za-x86.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"websocket-sharp.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to access scheduled task (.NET)","description":"file/memory contains long string(File: \"Syncro.Uninstaller.exe\")","origin":"File/Memory","mitre_attack_id":"T1053.002","relevance":1,"id":"string-939","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00003216.00000000.150432.04890000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00003216.00000000.150432.04890000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00003216.00000000.150432.04890000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00003216.00000000.150432.04890000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00003216.00000000.150432.1D5F0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00003216.00000000.150432.1D5F0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00003216.00000000.150432.1D5F0000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00003216.00000000.150432.1D5F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"aa074b990ef39f77e3d07f2a3ead60e1d87b5c073ea6ec5e3760356d131cd15f.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dotnet code contains ability to schedule task","description":"Observed namespace \"Microsoft.Win32.TaskScheduler\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1053.002","relevance":1,"id":"static-130","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"tmp3E90.tmp\" has type \"MS Windows icon resource - 3 icons 16x16 32 bits/pixel 32x32 32 bits/pixel\" - Location: [%TEMP%\\tmp3E90.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$5c","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69ceceef3efcf1220504407d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"