24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 76:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/MSIL.Agent Sample aeeeda70cbbe… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aeeeda70cbbe…. Malware family: Trojan/MSIL.Agent. Threat score 100/100. 3/27 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c","keywords":["Malicious","Trojan/MSIL.Agent","malware analysis","sandbox report","threat intelligence","aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/MSIL.Agent","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9f4,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "NuGet.Squirrel.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "NuGet.Squirrel.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "MetroFramework.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "websocket-sharp.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "Microsoft.Win32.TaskScheduler.dll"26:T5c5,Found reference to API "nexpected error in ChangeServiceConfig: {0}" (Indicator: "ChangeServiceConfig"; File: "AMSI") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00005016.00000000.145084.6E40B000.00000002.mdmp") Found reference to API "[SC] ChangeServiceConfig2 SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006328.00000000.144760.35720000.00000004.mdmp")27:T230a,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") file/memory contains long string with (Indicator: "Aes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "RC2"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "Aes"; File: "SevenZipSharp.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "Rijndael"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Uninstaller.Tools.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "Microsoft.Extensions.Caching.Memory.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RC2"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSAEncryptionPadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSASignaturePadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA1CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA256CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "AsnEncodedData"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeyedHashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") Found reference to "ile cache service AES Encryption with HKDF" (Indicator: "HKDF"; File: "AMSI")28:T5b6,Observed namespace "System" and MemberReference "GetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System" and MemberReference "GetMethods" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection.Emit" and MemberReference "SetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethods" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "MetroFramework.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "websocket-sharp.dll" Observed namespace "System" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "Squirrel.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Syncro.Uninstaller.exe"29:Tf39,aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin has big resource with name: "Installer.Syncro.Installer.exe" size: "5728512" and abnormal entropy:"7.980971065815129" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "165016" and abnormal entropy:"6.13687702150476" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/generictransparent.baml" size: "179273" and abnormal entropy:"6.305550879430742" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblue.baml" size: "178610" and abnormal entropy:"6.307279016171147" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2019.baml" size: "155338" and abnormal entropy:"6.13659563339989" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows11.baml" size: "194937" and abnormal entropy:"6.050952859583138" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows7.baml" size: "177967" and abnormal entropy:"6.307373232539465" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2013.baml" size: "171042" and abnormal entropy:"6.290332332448034" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericsummer.baml" size: "177420" and abnormal entropy:"6.294725185085658" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericexpressiondark.baml" size: "172045" and abnormal entropy:"6.308550398540881" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericfluent.baml" size: "165511" and abnormal entropy:"6.131583930484628" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8.baml" size: "161298" and abnormal entropy:"6.315678054578238" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericgreen.baml" size: "155447" and abnormal entropy:"6.1971925989048104" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8touch.baml" size: "160176" and abnormal entropy:"6.251792892655352" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericmaterial.baml" size: "169738" and abnormal entropy:"6.169199089027241" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblack.baml" size: "178375" and abnormal entropy:"6.307575327553487" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2019.baml" size: "162566" and abnormal entropy:"6.1183753746257095" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvista.baml" size: "178253" and abnormal entropy:"6.297443958952364" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2013.baml" size: "167435" and abnormal entropy:"6.3035493159972225" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016.baml" size: "164564" and abnormal entropy:"6.133823015434066" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficesilver.baml" size: "178265" and abnormal entropy:"6.305982984542167" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericcrystal.baml" size: "160635" and abnormal entropy:"6.1435739242667955" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "67707" and abnormal entropy:"6.170595835395746" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/generictransparent.baml" size: "67445" and abnormal entropy:"6.203426270272531" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericofficeblue.baml" size: "67290" and abnormal entropy:"6.206582184995473"2a:T9a0," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:30 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Accept-Encoding Content-Encoding: gzip ETag: W/"7800842ddc3c504c909c514b3a47e6b7" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 00191a804511f9d06861dbf074d5a0f2 X-Runtime: 0.006676 with response body ==>7B226C616E6775616765223A22656E222C226272616E64696E675F636F6C6F72223A367D....... "GET /syncro/main/updates/RELEASES HTTP/1.1 Host: production.kabutoservices.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 13:28:31 GMT Content-Type: application/octet-stream Content-Length: 825 Connection: keep-alive Server: nginx Last-Modified: Thu 19 Mar 2026 09:21:39 GMT ETag: "69bbc023-339" Accept-Ranges: bytes with response body ==>363144413237464630384641303643383743313342363332313146313631313439344538303043462053796E63726F2D312E302E3139352E31383131342D6465....... "GET /api/syncro_device/installers/policy_id.json?customer_id=1823871&folder_id=4957195 HTTP/1.1 Host: admin.syncroapi.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Thu 02 Apr 2026 13:28:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare set-cookie: __cflb=02DiuJNvuXtZHcB9NdSBGwREMxfehGcfsVTpiHFsdEeSY; HttpOnly; SameSite=Lax; Path=/; Expires=Fri 03 Apr 2026 12:28:39 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Authorization ETag: W/"f9244d1ee035bbd87ce499430243923e" Content-Security-Policy: default-src 'self' https: wss:; font-src 'self' https: data:; img-src 'self' https: data: http: blob:; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' assets.services.repairshopr.com assets.services.syncromsp.com blob:; style-src 'self' https: 'unsafe-inline' assets.services.repairshopr.com assets.services.syncromsp.com X-Request-Id: 5691df604ae4644741448a42de58fb75 X-Runtime: 0.022592 X-S-Info: 951cd0-64857748df-9557m Vary: Origin cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GbF78xTmWLyUq0571vup2WtDvozdzm%2BgqKHGM87Uf0dEAKGz9BOCl6wABpdJ44t9BetexEfP5NpmjfRtTEN8VTXPjOJIM5zT3sbjYHD66Rlo8fb02rzkgiKmluuHw7jRE9GCvKU%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: 9e602d8b4c99f31f-SJC with response body ==>7B22706F6C6963795F6964223A353437333136347D....... "GET //device_api/sync_device?device_uuid=6dc343a9-168a-4aec-ad1c-7112c974775d HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:40 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"fb6578436f294acbc682d5fe8721e30f" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 3945f0c0c953ab0adf3d0bc5d02347f1 X-Runtime: 0.036955 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /device_api/check_active?device_uuid=6dc343a9-168a-4aec-ad1c-7112c974775d HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"66e64e19889fece32b94c4ddbc792979" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 0dbabf3c56c5d7006b24ca90f20fb535 X-Runtime: 0.008422 with response body ==>7B22616374697665223A747275652C22756E696E7374616C6C6564223A6E756C6C7D....... "GET /device_api/sync_device?device_uuid=6dc343a9-168a-4aec-ad1c-7112c974775d&api_version=1 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"8203434124c7e659bd1aa3c1ac49bd6a" Cache-Control: max-age=0 private must-revalidate X-Request-Id: b7a1df3f9fe36ca4eb91916a19b806a8 X-Runtime: 0.044984 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK X-GUploader-UploadID: AMNfjG0-ijI4enJeS6mlL82TyrlC3B1wzZY10D8VUMxWvQVTllhjG4k0wQxxUtUq0EJ81TXipRPGRXo x-goog-generation: 1504833424652915 x-goog-metageneration: 2 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 15086 x-goog-hash: crc32c=PcufuA== x-goog-hash: md5=lAz69MO+eeGC9gN1kA/Csw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Content-Length: 15086 Server: UploadServer Date: Thu 02 Apr 2026 13:02:58 GMT Expires: Thu 02 Apr 2026 14:02:58 GMT Cache-Control: public max-age=3600 Age: 1555 Last-Modified: Fri 08 Sep 2017 01:17:04 GMT ETag: "940cfaf4c3be79e182f60375900fc2b3" Content-Type: image/vnd.microsoft.icon Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>000001000300101000000100200068040000360000002020000001002000C2A8100000C29E0400003030000001002000C2A82500004615000028000000100000.......4a:T1d61," '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'" (Indicator: " Win32_LogicalDisk"; File: "AMSI") Found string ";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\" (Indicator: " Win32_OperatingSystem"; File: "AMSI") Found string "ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'" (Indicator: " Win32_Service"; File: "AMSI") Found string "elect * from Win32_Process" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT * FROM Win32_Process WHERE Handle = '{0}'" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}" (Indicator: " Win32_Process"; File: "AMSI")68:T5db,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001544.00000000.143523.02CF0000.00000004.mdmp, 00000000-00001544.00000001.145442.02CF0000.00000004.mdmp, 00000000-00001544.00000002.145682.02CF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001544.00000000.143523.02CF0000.00000004.mdmp, 00000000-00001544.00000001.145442.02CF0000.00000004.mdmp, 00000000-00001544.00000002.145682.02CF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00001544.00000000.143523.02CF0000.00000004.mdmp, 00000000-00001544.00000001.145442.02CF0000.00000004.mdmp, 00000000-00001544.00000002.145682.02CF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00001544.00000000.143523.02CF0000.00000004.mdmp, 00000000-00001544.00000001.145442.02CF0000.00000004.mdmp, 00000000-00001544.00000002.145682.02CF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00005016.00000000.145084.3A6A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00006328.00000000.144760.35720000.00000004.mdmp")69:T4a7,Found reference to API "b__34_0" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "b__34_1" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "DeleteFileSafe" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "DeleteFileIfExistSafe" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "DeleteFileInternal" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "DeleteFileIfExist" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin")6a:Tb4c," "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1823871,"policy_id":5473164,"folder_id":4957195}}" HTTP/1.1 201 Created Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"1c7e56058d1908a51384a216a09eb19a" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 82f24c3825be1f13598688b9121c784f X-Runtime: 0.109105 with response body ==>7B2275756964223A2236646333343361392D313638612D346165632D616431632D373131326339373437373564222C22636F6D70757465725F75756964223A22....... "POST /device_api/metric HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 140 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"device_uuid":"6dc343a9-168a-4aec-ad1c-7112c974775d","event_name":"Kabuto_Client_Version","event_params":"{\"version\":\"1.0.199.18369\"}"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"31ec60be6a4526265d8fde3afbe1e386" Cache-Control: max-age=0 private must-revalidate X-Request-Id: ce4d61107a07de1db6a0902cfa04291b X-Runtime: 0.019807 with no response body6e:T74b9,"Syncro.Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\Syncro.Installer.exe]- [targetUID: 00000000-00001544] "Telerik.Windows.Controls.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.dll]- [targetUID: 00000000-00000008] "Telerik.Windows.Controls.Navigation.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Navigation.dll]- [targetUID: 00000000-00000008] "Telerik.Windows.Controls.Input.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.Input.dll]- [targetUID: 00000000-00000008] "Syncro.Service.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.exe]- [targetUID: 00000000-00000008] "Telerik.Windows.Controls.ConversationalUI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Controls.ConversationalUI.dll]- [targetUID: 00000000-00000008] "System.Text.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Json.dll]- [targetUID: 00000000-00000008] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Newtonsoft.Json.dll]- [targetUID: 00000000-00000008] "MetroFramework.Fonts.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.Fonts.dll]- [targetUID: 00000000-00000008] "RepairTech.Common.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll]- [targetUID: 00000000-00000008] "Telerik.Windows.Data.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Telerik.Windows.Data.dll]- [targetUID: 00000000-00000008] "Syncro.App.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll]- [targetUID: 00000000-00000008] "NuGet.Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\NuGet.Squirrel.dll]- [targetUID: 00000000-00000008] "7za-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x64.dll]- [targetUID: 00000000-00000008] "MetroFramework.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\MetroFramework.dll]- [targetUID: 00000000-00000008] "Mono.Cecil.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Mono.Cecil.dll]- [targetUID: 00000000-00000008] "7za-x86.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\7za-x86.dll]- [targetUID: 00000000-00000008] "Autofac.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Autofac.dll]- [targetUID: 00000000-00000008] "websocket-sharp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\websocket-sharp.dll]- [targetUID: 00000000-00000008] "Microsoft.Win32.TaskScheduler.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.TaskScheduler.dll]- [targetUID: 00000000-00000008] "Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Squirrel.dll]- [targetUID: 00000000-00000008] "ICSharpCode.SharpZipLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ICSharpCode.SharpZipLib.dll]- [targetUID: 00000000-00000008] "System.Diagnostics.DiagnosticSource.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.DiagnosticSource.dll]- [targetUID: 00000000-00000008] "Syncro.Uninstaller.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.exe]- [targetUID: 00000000-00000008] "SevenZipSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SevenZipSharp.dll]- [targetUID: 00000000-00000008] "SharpSnmpLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\SharpSnmpLib.dll]- [targetUID: 00000000-00000008] "System.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Memory.dll]- [targetUID: 00000000-00000008] "Serilog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.dll]- [targetUID: 00000000-00000008] "CSharpFunctionalExtensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\CSharpFunctionalExtensions.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll]- [targetUID: 00000000-00000008] "RepairTech.Common.Wpf.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Wpf.dll]- [targetUID: 00000000-00000008] "Syncro.Contracts.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll]- [targetUID: 00000000-00000008] "JetBrains.Annotations.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\JetBrains.Annotations.dll]- [targetUID: 00000000-00000008] "System.Numerics.Vectors.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Numerics.Vectors.dll]- [targetUID: 00000000-00000008] "Flurl.Http.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.Http.dll]- [targetUID: 00000000-00000008] "System.IO.Pipelines.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.IO.Pipelines.dll]- [targetUID: 00000000-00000008] "Microsoft.Web.XmlTransform.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Web.XmlTransform.dll]- [targetUID: 00000000-00000008] "Interop.WUApiLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.WUApiLib.dll]- [targetUID: 00000000-00000008] "System.Text.Encodings.Web.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Text.Encodings.Web.dll]- [targetUID: 00000000-00000008] "System.ValueTuple.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ValueTuple.dll]- [targetUID: 00000000-00000008] "Syncro.Uninstaller.Tools.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Uninstaller.Tools.exe]- [targetUID: 00000000-00000008] "Microsoft.Extensions.Logging.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Logging.Abstractions.dll]- [targetUID: 00000000-00000008] "Microsoft.Extensions.Options.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Options.dll]- [targetUID: 00000000-00000008] "Microsoft.Extensions.DependencyInjection.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.DependencyInjection.Abstractions.dll]- [targetUID: 00000000-00000008] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Runner.exe]- [targetUID: 00000000-00000008] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.Service.Runner.exe]- [targetUID: 00000000-00000008] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.App.Runner.exe]- [targetUID: 00000000-00000008] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.Runner.exe]- [targetUID: 00000000-00000008] "FluentCommandLineParser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\FluentCommandLineParser.dll]- [targetUID: 00000000-00000008] "Microsoft.Extensions.Caching.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Memory.dll]- [targetUID: 00000000-00000008] "Microsoft.Extensions.Primitives.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Primitives.dll]- [targetUID: 00000000-00000008] "Splat.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Splat.dll]- [targetUID: 00000000-00000008] "Microsoft.Extensions.Caching.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Extensions.Caching.Abstractions.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "System.Security.Cryptography.Algorithms.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Algorithms.dll]- [targetUID: 00000000-00000008] "System.Security.Cryptography.X509Certificates.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.X509Certificates.dll]- [targetUID: 00000000-00000008] "Flurl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Flurl.dll]- [targetUID: 00000000-00000008] "Interop.IWshRuntimeLibrary.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.IWshRuntimeLibrary.dll]- [targetUID: 00000000-00000008] "RollbarSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RollbarSharp.dll]- [targetUID: 00000000-00000008] "Serilog.Sinks.Console.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.Console.dll]- [targetUID: 00000000-00000008] "System.Diagnostics.EventLog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Diagnostics.EventLog.dll]- [targetUID: 00000000-00000008] "Syncro.Uninstaller.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Uninstaller.resources.dll]- [targetUID: 00000000-00000008] "System.Security.AccessControl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.AccessControl.dll]- [targetUID: 00000000-00000008] "Serilog.Sinks.File.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Sinks.File.dll]- [targetUID: 00000000-00000008] "System.Runtime.InteropServices.RuntimeInformation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.InteropServices.RuntimeInformation.dll]- [targetUID: 00000000-00000008] "System.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.dll]- [targetUID: 00000000-00000008] "System.Threading.Tasks.Extensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Threading.Tasks.Extensions.dll]- [targetUID: 00000000-00000008] "System.Net.IPNetwork.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Net.IPNetwork.dll]- [targetUID: 00000000-00000008] "Microsoft.Win32.Registry.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Win32.Registry.dll]- [targetUID: 00000000-00000008] "Microsoft.Bcl.AsyncInterfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Microsoft.Bcl.AsyncInterfaces.dll]- [targetUID: 00000000-00000008] "System.Buffers.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Buffers.dll]- [targetUID: 00000000-00000008] "System.Security.Cryptography.Encoding.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Encoding.dll]- [targetUID: 00000000-00000008] "System.Security.Cryptography.Primitives.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Cryptography.Primitives.dll]- [targetUID: 00000000-00000008] "Interop.NetFwTypeLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Interop.NetFwTypeLib.dll]- [targetUID: 00000000-00000008] "System.ServiceProcess.ServiceController.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.ServiceProcess.ServiceController.dll]- [targetUID: 00000000-00000008] "Phoenix.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Phoenix.dll]- [targetUID: 00000000-00000008] "Syncro.Service.Models.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Models.dll]- [targetUID: 00000000-00000008] "System.Runtime.CompilerServices.Unsafe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Runtime.CompilerServices.Unsafe.dll]- [targetUID: 00000000-00000008] "System.Security.Principal.Windows.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\System.Security.Principal.Windows.dll]- [targetUID: 00000000-00000008] "Destructurama.Attributed.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Destructurama.Attributed.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Service.Configuration.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Service.Services.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Services.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Serilog.Formatting.Compact.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Serilog.Formatting.Compact.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.App.resources.dll]- [targetUID: 00000000-00000008] "DeltaCompressionDotNet.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\DeltaCompressionDotNet.dll]- [targetUID: 00000000-00000008] "Syncro.Service.Interfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Interfaces.dll]- [targetUID: 00000000-00000008] "UrlCombineLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\UrlCombineLib.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fr-FR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ru-RU\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\cs-CZ\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\zh-CHS\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\el-GR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\nl-NL\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\da-DK\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\sl-SI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\es-ES\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\de-DE\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ar-SA\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\ja-JP\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\it-IT\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\fi-FI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\en\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\pt-BR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00000008] "Syncro.App.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.App.dll.config]- [targetUID: 00000000-00000008] "Syncro.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Tools.dll.config]- [targetUID: 00000000-00000008] "RepairTech.Common.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\RepairTech.Common.Tools.dll.config]- [targetUID: 00000000-00000008] "Syncro.Contracts.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Contracts.dll.config]- [targetUID: 00000000-00000008] "Syncro.Service.Configuration.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.199.18369\Syncro.Service.Configuration.dll.config]- [targetUID: 00000000-00000008]6f:T3a46," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"f052ad6e9b606162431a9eb38d85ea56" Cache-Control: max-age=0 private must-revalidate X-Request-Id: e7dd46d75de0ceab2f04312cae8a8405 X-Runtime: 0.006894 with no response body "PUT //device_api/device HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Content-Length: 192 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Thu 02 Apr 2026 13:28:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"d089f9db4b5708f67a0e109425e14ccd" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 9143cdfbaeb6c642864dca3cbdf917f5 X-Runtime: 0.063878 with no response body72:T2d7a,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11442 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload:==> "{"shop_api_key":"k9GHWOXYNfhE9OLU_bTc4w","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1823871,"policy_id":5473164,"folder_id":4957195}}"73:T781,Spawned process "b__37_0\" (Indicator: \"CreateDirectory\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"CreateDirectoryWithParents\" (Indicator: \"CreateDirectory\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"CreateDirectoryIfNotExist\" (Indicator: \"CreateDirectory\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataTaskAsync\" in \"Squirrel.dll\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileTaskAsync\" in \"Squirrel.dll\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001544.00000000.143523.02CF0000.00000004.mdmp, 00000000-00001544.00000001.145442.02CF0000.00000004.mdmp, 00000000-00001544.00000002.145682.02CF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\"\n Observed function \"Process.Start\" in \"MetroFramework.dll\"\n Observed function \"Process.Start\" in \"Microsoft.Win32.TaskScheduler.dll\"\n Observed function \"Process.Start\" in \"Squirrel.dll\"\n Observed function \"ProcessUtils.StartHiddenApp\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$42","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process k__BackingField\" (Indicator: \"\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"{0}] http ping to {1}: error, status: {2}, message: {3}\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"ot App.Runner Heartbeat Ping\" (Indicator: \"ping\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Syncro.Installer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$67","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"file/memory contains long string(File: \"Syncro.Uninstaller.exe\")\n file/memory contains long string(File: \"Syncro.Uninstaller.Tools.exe\")\n file/memory contains long string(File: \"System.ServiceProcess.ServiceController.dll\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"System.Security.Principal.Windows.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Syncro.Installer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000008)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$68","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000008-00000C2C-1247569656","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005016.00000000.145084.6E40B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Syncro.Installer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Syncro.Installer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"F3E96B1A22C3DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Syncro.Installer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001544.00000000.143523.02CF0000.00000004.mdmp, 00000000-00001544.00000001.145442.02CF0000.00000004.mdmp, 00000000-00001544.00000002.145682.02CF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Syncro.Installer.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\Syncro.Installer.exe]- [targetUID: 00000000-00001544]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Syncro.Installer.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Syncro.Installer.exe.log]- [targetUID: 00000000-00000008]\n Dropped file: \"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin.exe.log]- [targetUID: 00000000-00001544]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"custom-logo.png\" has type \"PNG image data 500 x 120 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"chat-bubbles-icon.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"aeeeda70cbbea0074f171b0da50aead64e9280d94e95714263d47d720eb7c71c.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Telerik.Windows.Controls.ConversationalUI.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"MetroFramework.Fonts.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"NuGet.Squirrel.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"MetroFramework.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"Mono.Cecil.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"7za-x86.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"websocket-sharp.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Syncro.Uninstaller.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" '\" (Indicator: \" win32_ntlogevent\"; File: \"AMSI\")\n \"ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '\" (Indicator: \" win32_ntlogevent\"; File: \"AMSI\")\n \"ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'\" (Indicator: \" win32_logicaldisk\"; File: \"AMSI\")\n \";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\\\" (Indicator: \" win32_operatingsystem\"; File: \"AMSI\")\n \"ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'\" (Indicator: \" win32_service\"; File: \"AMSI\")\n \"elect * from Win32_Process\" (Indicator: \" win32_process\"; File: \"AMSI\")\n \"ELECT * FROM Win32_Process WHERE Handle = '{0}'\" (Indicator: \" win32_process\"; File: \"AMSI\")\n \"ELECT ExecutablePath FROM Win32_Process WHERE ProcessId = {0}\" (Indicator: \" win32_process\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET REMOTE_ACCESS Observed SyncroMSP Remote Management Software Domain (kabutoservices .com in TLS SNI)\" (SID: 2042880, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET REMOTE_ACCESS Observed Remote Management Software Domain (syncromsp .com in TLS SNI)\" (SID: 2036347, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$6d","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69ce6ed832e466e83503cb07"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"