26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 78:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL/RemoteAdmin.Servably Sample cfaa0dfa8af6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cfaa0dfa8af6…. Malware family: MSIL/RemoteAdmin.Servably. Threat score 100/100. 4/27 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290","keywords":["Malicious","MSIL/RemoteAdmin.Servably","malware analysis","sandbox report","threat intelligence","cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290"],"about":{"@type":"SoftwareApplication","name":"ContractDocument-v1-4906582.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL/RemoteAdmin.Servably","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9f4,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "MetroFramework.Fonts.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "MetroFramework.Fonts.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "NuGet.Squirrel.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "NuGet.Squirrel.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "MetroFramework.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Mono.Cecil.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "websocket-sharp.dll" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "websocket-sharp.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "Microsoft.Win32.TaskScheduler.dll"28:T54e,Found reference to API "[SC] ChangeServiceConfig2 SUCCESS" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004748.00000000.123219.35E40000.00000004.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004748.00000000.123219.45A1B000.00000002.mdmp")29:T22a7,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") file/memory contains long string with (Indicator: "Aes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "RC2"; File: "ICSharpCode.SharpZipLib.dll") file/memory contains long string with (Indicator: "Aes"; File: "SevenZipSharp.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMAC"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "Rijndael"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "SharpSnmpLib.dll") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Uninstaller.Tools.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.Service.Runner.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "SHA384"; File: "Syncro.App.Runner.exe") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "Microsoft.Extensions.Caching.Memory.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACMD5"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA1"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA256"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "HMACSHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "IncrementalHash"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RC2"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSAEncryptionPadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "RSASignaturePadding"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA1CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA256CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA384CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "SHA512CryptoServiceProvider"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "TripleDES"; File: "System.Security.Cryptography.Algorithms.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "ECDsa"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.X509Certificates.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "SHA1Managed"; File: "RollbarSharp.dll") file/memory contains long string with (Indicator: "AsnEncodedData"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsnEncodedDataEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "Oid"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidCollection"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "OidEnumerator"; File: "System.Security.Cryptography.Encoding.dll") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptographicException"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "CryptoStream"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "HMAC"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeyedHashAlgorithm"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "KeySizes"; File: "System.Security.Cryptography.Primitives.dll") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "System.Security.Cryptography.Primitives.dll")2a:T5b6,Observed namespace "System" and MemberReference "GetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System" and MemberReference "GetMethods" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection.Emit" and MemberReference "SetGetMethod" in "Telerik.Windows.Data.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethods" in "NuGet.Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "MetroFramework.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "websocket-sharp.dll" Observed namespace "System" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Diagnostics" and MemberReference "GetMethod" in "Microsoft.Win32.TaskScheduler.dll" Observed namespace "System.Reflection" and MemberReference "GetGetMethod" in "Squirrel.dll" Observed namespace "System" and MemberReference "GetMethod" in "Squirrel.dll" Observed namespace "System.Reflection" and MemberReference "GetMethodFromHandle" in "Syncro.Uninstaller.exe"2b:Tf39,cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin has big resource with name: "Installer.Syncro.Installer.exe" size: "5728512" and abnormal entropy:"7.980971065815129" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "165016" and abnormal entropy:"6.13687702150476" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/generictransparent.baml" size: "179273" and abnormal entropy:"6.305550879430742" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblue.baml" size: "178610" and abnormal entropy:"6.307279016171147" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2019.baml" size: "155338" and abnormal entropy:"6.13659563339989" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows11.baml" size: "194937" and abnormal entropy:"6.050952859583138" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows7.baml" size: "177967" and abnormal entropy:"6.307373232539465" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvisualstudio2013.baml" size: "171042" and abnormal entropy:"6.290332332448034" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericsummer.baml" size: "177420" and abnormal entropy:"6.294725185085658" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericexpressiondark.baml" size: "172045" and abnormal entropy:"6.308550398540881" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericfluent.baml" size: "165511" and abnormal entropy:"6.131583930484628" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8.baml" size: "161298" and abnormal entropy:"6.315678054578238" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericgreen.baml" size: "155447" and abnormal entropy:"6.1971925989048104" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericwindows8touch.baml" size: "160176" and abnormal entropy:"6.251792892655352" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericmaterial.baml" size: "169738" and abnormal entropy:"6.169199089027241" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficeblack.baml" size: "178375" and abnormal entropy:"6.307575327553487" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2019.baml" size: "162566" and abnormal entropy:"6.1183753746257095" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericvista.baml" size: "178253" and abnormal entropy:"6.297443958952364" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2013.baml" size: "167435" and abnormal entropy:"6.3035493159972225" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericoffice2016.baml" size: "164564" and abnormal entropy:"6.133823015434066" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericofficesilver.baml" size: "178265" and abnormal entropy:"6.305982984542167" Telerik.Windows.Controls.Input.dll has big resource with name: "themes/genericcrystal.baml" size: "160635" and abnormal entropy:"6.1435739242667955" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericoffice2016touch.baml" size: "67707" and abnormal entropy:"6.170595835395746" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/generictransparent.baml" size: "67445" and abnormal entropy:"6.203426270272531" Telerik.Windows.Controls.ConversationalUI.dll has big resource with name: "themes/genericofficeblue.baml" size: "67290" and abnormal entropy:"6.206582184995473"2c:T8a2," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:52:55 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept Accept-Encoding Content-Encoding: gzip ETag: W/"73f62b329f3c7a9845f3140632719bb1" Cache-Control: max-age=0 private must-revalidate X-Request-Id: cc7e8674892b6aa790449d0ef1b22cb7 X-Runtime: 0.006603 with response body ==>7B226C616E6775616765223A22656E222C226272616E64696E675F636F6C6F72223A367D....... "GET /syncro/main/updates/RELEASES HTTP/1.1 Host: production.kabutoservices.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Tue 03 Mar 2026 15:52:57 GMT Content-Type: application/octet-stream Content-Length: 825 Connection: keep-alive Server: nginx Last-Modified: Wed 28 Jan 2026 13:14:42 GMT ETag: "697a0bc2-339" Accept-Ranges: bytes with response body ==>424244393041324635434443373444363945393234423932423136363946433234354130313136382053796E63726F2D312E302E3139332E31383130342D6465....... "GET /api/syncro_device/installers/policy_id.json?customer_id=1807323&folder_id=4906582 HTTP/1.1 Host: admin.syncroapi.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Tue 03 Mar 2026 15:53:05 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare set-cookie: __cflb=02DiuJNvuXtZHcB9NdSBGwREMxfehGcfs1u73JoKynjL8; HttpOnly; SameSite=Lax; Path=/; Expires=Wed 04 Mar 2026 14:53:05 GMT X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: Origin X-Requested-With Content-Type Accept Authorization ETag: W/"c44e2012d95d9dbaf3ea8dff1fa20257" Content-Security-Policy: default-src 'self' https: wss:; font-src 'self' https: data:; img-src 'self' https: data: http: blob:; object-src 'none'; script-src 'self' https: 'unsafe-inline' 'unsafe-eval' assets.services.repairshopr.com assets.services.syncromsp.com blob:; style-src 'self' https: 'unsafe-inline' assets.services.repairshopr.com assets.services.syncromsp.com X-Request-Id: 55752954f4fdc9b3fd92a7dccd486d45 X-Runtime: 0.022184 X-S-Info: 01001a-56d8557564-4g5f9 Vary: Origin cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qQnYeH6E6HBBX92ZgPJ1f8TTdc7TR%2BfBIZPQjmphDJDbhuVPOAZLpZz6XsVy%2Bts76nOGplE2dx7ZBLG7kDts6KqTSAGaD5jez1kd6hY%2B7txikg%3D%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Content-Encoding: gzip CF-RAY: 9d69cfe0bc98cefe-SJC with response body ==>7B22706F6C6963795F6964223A6E756C6C7D....... "GET //device_api/sync_device?device_uuid=b461d818-f3fc-47fa-84c9-b0d3d9751687 HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:06 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"0d30037518a51ea3472d38cb4070b100" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 81dcd33dd4602b5b228de62a500cc9a1 X-Runtime: 0.040923 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /device_api/check_active?device_uuid=b461d818-f3fc-47fa-84c9-b0d3d9751687 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"d6ac3e0d77fa327cec24f17260302a23" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 92d2e19f7eead34ee3fd87bbddca8523 X-Runtime: 0.008824 with response body ==>7B22616374697665223A747275652C22756E696E7374616C6C6564223A6E756C6C7D....... "GET /device_api/sync_device?device_uuid=b461d818-f3fc-47fa-84c9-b0d3d9751687&api_version=1 HTTP/1.1 Host: rmm.syncromsp.com Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"150290a4e3ce00368b85eef853408c0f" Cache-Control: max-age=0 private must-revalidate X-Request-Id: a31e7e59588eb7b3f870ae11fdafbce1 X-Runtime: 0.046481 with response body ==>7B22646576696365223A7B22616374697665223A747275652C227265717565737461626C655F616C65727473223A5B5D2C22637573746F6D65725F6E616D6522....... "GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK X-GUploader-UploadID: AGQBYWxnqdJQK0Hhwd0SZlGuwXC2Jx9g_Qz1aqCOxk3jUXQiZgyiqS4je9rNTugN8_8y50iqRphkscA x-goog-generation: 1504833424652915 x-goog-metageneration: 2 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 15086 x-goog-hash: crc32c=PcufuA== x-goog-hash: md5=lAz69MO+eeGC9gN1kA/Csw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Content-Length: 15086 Server: UploadServer Date: Tue 03 Mar 2026 15:11:41 GMT Expires: Tue 03 Mar 2026 16:11:41 GMT Cache-Control: public max-age=3600 Age: 2503 Last-Modified: Fri 08 Sep 2017 01:17:04 GMT ETag: "940cfaf4c3be79e182f60375900fc2b3" Content-Type: image/vnd.microsoft.icon Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>000001000300101000000100200068040000360000002020000001002000C2A8100000C29E0400003030000001002000C2A82500004615000028000000100000....... "GET /kabuto-assets/syncro_favicon.ico HTTP/1.1 Host: storage.googleapis.com Accept-Encoding: gzip, deflate Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK X-GUploader-UploadID: AGQBYWxnqdJQK0Hhwd0SZlGuwXC2Jx9g_Qz1aqCOxk3jUXQiZgyiqS4je9rNTugN8_8y50iqRphkscA x-goog-generation: 1504833424652915 x-goog-metageneration: 2 x-goog-stored-content-encoding: identity x-goog-stored-content-length: 15086 x-goog-hash: crc32c=PcufuA== x-goog-hash: md5=lAz69MO+eeGC9gN1kA/Csw== x-goog-storage-class: MULTI_REGIONAL Accept-Ranges: bytes Content-Length: 15086 Server: UploadServer Date: Tue 03 Mar 2026 15:11:41 GMT Expires: Tue 03 Mar 2026 16:11:41 GMT Cache-Control: public max-age=3600 Age: 2504 Last-Modified: Fri 08 Sep 2017 01:17:04 GMT ETag: "940cfaf4c3be79e182f60375900fc2b3" Content-Type: image/vnd.microsoft.icon Vary: Origin Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>000001000300101000000100200068040000360000002020000001002000C2A8100000C29E0400003030000001002000C2A82500004615000028000000100000.......4e:T2512," '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '" (Indicator: " Win32_ntlogevent"; File: "AMSI") Found string "ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'" (Indicator: " Win32_LogicalDisk"; File: "AMSI") Found string ";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\" (Indicator: " Win32_OperatingSystem"; File: "AMSI") Found string "ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'" (Indicator: " Win32_Service"; File: "AMSI") Found string "elect * from Win32_Process" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT * FROM Win32_Process WHERE Handle = '{0}'" (Indicator: " Win32_Process"; File: "AMSI") Found string "ELECT Version FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "AMSI")6a:T5db,Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00000824.00000000.123544.34000000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001448.00000000.121440.03420000.00000004.mdmp, 00000000-00001448.00000001.123360.03420000.00000004.mdmp, 00000000-00001448.00000002.123879.03420000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001448.00000000.121440.03420000.00000004.mdmp, 00000000-00001448.00000001.123360.03420000.00000004.mdmp, 00000000-00001448.00000002.123879.03420000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00001448.00000000.121440.03420000.00000004.mdmp, 00000000-00001448.00000001.123360.03420000.00000004.mdmp, 00000000-00001448.00000002.123879.03420000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00001448.00000000.121440.03420000.00000004.mdmp, 00000000-00001448.00000001.123360.03420000.00000004.mdmp, 00000000-00001448.00000002.123879.03420000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004748.00000000.123219.35E40000.00000004.mdmp")6b:T419,Found reference to API "b__34_0" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to API "b__34_1" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to API "DeleteFileSafe" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to API "DeleteFileIfExistSafe" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to API "DeleteFileInternal" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin") Found reference to API "DeleteFileIfExist" (Indicator: "DeleteFile"; File: "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin")6c:Tad1," "{"shop_api_key":"HkwyrKdJ_66D-CZwC_ryfQ","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1807323,"folder_id":4906582}}" HTTP/1.1 201 Created Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:06 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"929c28f7278d664b0e583af4660106d6" Cache-Control: max-age=0 private must-revalidate X-Request-Id: b41f9784a2dd9d662f8fdc7d58c695f1 X-Runtime: 0.075017 with response body ==>7B2275756964223A2262343631643831382D663366632D343766612D383463392D623064336439373531363837222C22636F6D70757465725F75756964223A22....... "POST /device_api/metric HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 140 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload::==> "{"device_uuid":"b461d818-f3fc-47fa-84c9-b0d3d9751687","event_name":"Kabuto_Client_Version","event_params":"{\"version\":\"1.0.198.18354\"}"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"9ccc20e1eab2fb7389c191f2478d63ef" Cache-Control: max-age=0 private must-revalidate X-Request-Id: d5d5d7de7248a80ab76fe555398a5d2f X-Runtime: 0.018831 with no response body "POST /device_api/clear_alert HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 80 Accept-Encoding: gzip, deflate" with payload::==> "{"device_uuid":"b461d818-f3fc-47fa-84c9-b0d3d9751687","trigger":"no_av_trigger"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"b94d8de7fc1dc8f63a0a511addc03dec" Cache-Control: max-age=0 private must-revalidate X-Request-Id: e831ee3d6dd4fbdb4d58962c52440f2b X-Runtime: 0.012269 with response body ==>7B22616C657274735F636C6561726564223A307D....... "POST /device_api/clear_alert HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 89 Accept-Encoding: gzip, deflate" with payload::==> "{"device_uuid":"b461d818-f3fc-47fa-84c9-b0d3d9751687","trigger":"device_manager_trigger"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"b94d8de7fc1dc8f63a0a511addc03dec" Cache-Control: max-age=0 private must-revalidate X-Request-Id: e37ce5a595f76b7d3be8d5ea1564fa04 X-Runtime: 0.011197 with response body ==>7B22616C657274735F636C6561726564223A307D....... "POST /device_api/clear_alert HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 88 Accept-Encoding: gzip, deflate" with payload::==> "{"device_uuid":"b461d818-f3fc-47fa-84c9-b0d3d9751687","trigger":"failed_logins_trigger"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"797af3a9855032928b916d2840073abf" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 77f6fe43a906346f28e54a74e141b9db X-Runtime: 0.011808 with response body ==>7B22616C657274735F636C6561726564223A307D....... "POST /device_api/clear_alert HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 87 Accept-Encoding: gzip, deflate" with payload::==> "{"device_uuid":"b461d818-f3fc-47fa-84c9-b0d3d9751687","trigger":"low_hd_space_trigger"}" HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"797af3a9855032928b916d2840073abf" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 348d343e1604a9f3487360bd95b0a2ce X-Runtime: 0.012906 with response body ==>7B22616C657274735F636C6561726564223A307D....... "POST /device_api/alert HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 178 Accept-Encoding: gzip, deflate" with payload::==> "{"device_uuid":"b461d818-f3fc-47fa-84c9-b0d3d9751687","trigger":"firewall_trigger","description":"The public static and private static Windows Firewalls are currently disabled."}" HTTP/1.1 201 Created Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"c699069c751943d82f560347d3218781" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 8e084e55ff044bec86f2822b6ef4254e X-Runtime: 0.091975 with response body ==>7B226964223A3539353639343837397D.......70:T74b9,"Telerik.Windows.Controls.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Telerik.Windows.Controls.dll]- [targetUID: 00000000-00005952] "Syncro.Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\Syncro.Installer.exe]- [targetUID: 00000000-00001448] "Telerik.Windows.Controls.Navigation.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Telerik.Windows.Controls.Navigation.dll]- [targetUID: 00000000-00005952] "Telerik.Windows.Controls.Input.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Telerik.Windows.Controls.Input.dll]- [targetUID: 00000000-00005952] "Syncro.Service.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.exe]- [targetUID: 00000000-00005952] "Telerik.Windows.Controls.ConversationalUI.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Telerik.Windows.Controls.ConversationalUI.dll]- [targetUID: 00000000-00005952] "System.Text.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Text.Json.dll]- [targetUID: 00000000-00005952] "Newtonsoft.Json.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Newtonsoft.Json.dll]- [targetUID: 00000000-00005952] "MetroFramework.Fonts.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\MetroFramework.Fonts.dll]- [targetUID: 00000000-00005952] "RepairTech.Common.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\RepairTech.Common.Tools.dll]- [targetUID: 00000000-00005952] "Telerik.Windows.Data.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Telerik.Windows.Data.dll]- [targetUID: 00000000-00005952] "Syncro.App.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.App.dll]- [targetUID: 00000000-00005952] "NuGet.Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\NuGet.Squirrel.dll]- [targetUID: 00000000-00005952] "7za-x64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\7za-x64.dll]- [targetUID: 00000000-00005952] "MetroFramework.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\MetroFramework.dll]- [targetUID: 00000000-00005952] "Mono.Cecil.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Mono.Cecil.dll]- [targetUID: 00000000-00005952] "7za-x86.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\7za-x86.dll]- [targetUID: 00000000-00005952] "Autofac.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Autofac.dll]- [targetUID: 00000000-00005952] "websocket-sharp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\websocket-sharp.dll]- [targetUID: 00000000-00005952] "Microsoft.Win32.TaskScheduler.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Win32.TaskScheduler.dll]- [targetUID: 00000000-00005952] "Squirrel.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Squirrel.dll]- [targetUID: 00000000-00005952] "ICSharpCode.SharpZipLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ICSharpCode.SharpZipLib.dll]- [targetUID: 00000000-00005952] "System.Diagnostics.DiagnosticSource.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Diagnostics.DiagnosticSource.dll]- [targetUID: 00000000-00005952] "Syncro.Uninstaller.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Uninstaller.exe]- [targetUID: 00000000-00005952] "SevenZipSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\SevenZipSharp.dll]- [targetUID: 00000000-00005952] "SharpSnmpLib.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\SharpSnmpLib.dll]- [targetUID: 00000000-00005952] "System.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Memory.dll]- [targetUID: 00000000-00005952] "Serilog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Serilog.dll]- [targetUID: 00000000-00005952] "CSharpFunctionalExtensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\CSharpFunctionalExtensions.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Tools.dll]- [targetUID: 00000000-00005952] "RepairTech.Common.Wpf.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\RepairTech.Common.Wpf.dll]- [targetUID: 00000000-00005952] "Syncro.Contracts.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Contracts.dll]- [targetUID: 00000000-00005952] "JetBrains.Annotations.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\JetBrains.Annotations.dll]- [targetUID: 00000000-00005952] "System.Numerics.Vectors.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Numerics.Vectors.dll]- [targetUID: 00000000-00005952] "Flurl.Http.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Flurl.Http.dll]- [targetUID: 00000000-00005952] "System.IO.Pipelines.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.IO.Pipelines.dll]- [targetUID: 00000000-00005952] "Microsoft.Web.XmlTransform.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Web.XmlTransform.dll]- [targetUID: 00000000-00005952] "Interop.WUApiLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Interop.WUApiLib.dll]- [targetUID: 00000000-00005952] "System.Text.Encodings.Web.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Text.Encodings.Web.dll]- [targetUID: 00000000-00005952] "System.ValueTuple.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.ValueTuple.dll]- [targetUID: 00000000-00005952] "Syncro.Uninstaller.Tools.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Uninstaller.Tools.exe]- [targetUID: 00000000-00005952] "Microsoft.Extensions.Logging.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Extensions.Logging.Abstractions.dll]- [targetUID: 00000000-00005952] "Microsoft.Extensions.Options.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Extensions.Options.dll]- [targetUID: 00000000-00005952] "Microsoft.Extensions.DependencyInjection.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Extensions.DependencyInjection.Abstractions.dll]- [targetUID: 00000000-00005952] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.Service.Runner.exe]- [targetUID: 00000000-00005952] "Syncro.Service.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.Runner.exe]- [targetUID: 00000000-00005952] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\Syncro.App.Runner.exe]- [targetUID: 00000000-00005952] "Syncro.App.Runner.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.App.Runner.exe]- [targetUID: 00000000-00005952] "FluentCommandLineParser.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\FluentCommandLineParser.dll]- [targetUID: 00000000-00005952] "Microsoft.Extensions.Caching.Memory.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Extensions.Caching.Memory.dll]- [targetUID: 00000000-00005952] "Microsoft.Extensions.Primitives.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Extensions.Primitives.dll]- [targetUID: 00000000-00005952] "Splat.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Splat.dll]- [targetUID: 00000000-00005952] "Microsoft.Extensions.Caching.Abstractions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Extensions.Caching.Abstractions.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\en\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "System.Security.Cryptography.Algorithms.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Security.Cryptography.Algorithms.dll]- [targetUID: 00000000-00005952] "System.Security.Cryptography.X509Certificates.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Security.Cryptography.X509Certificates.dll]- [targetUID: 00000000-00005952] "Flurl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Flurl.dll]- [targetUID: 00000000-00005952] "Interop.IWshRuntimeLibrary.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Interop.IWshRuntimeLibrary.dll]- [targetUID: 00000000-00005952] "Serilog.Sinks.Console.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Serilog.Sinks.Console.dll]- [targetUID: 00000000-00005952] "RollbarSharp.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\RollbarSharp.dll]- [targetUID: 00000000-00005952] "System.Diagnostics.EventLog.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Diagnostics.EventLog.dll]- [targetUID: 00000000-00005952] "Syncro.Uninstaller.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\en\Syncro.Uninstaller.resources.dll]- [targetUID: 00000000-00005952] "System.Security.AccessControl.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Security.AccessControl.dll]- [targetUID: 00000000-00005952] "Serilog.Sinks.File.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Serilog.Sinks.File.dll]- [targetUID: 00000000-00005952] "System.Runtime.InteropServices.RuntimeInformation.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Runtime.InteropServices.RuntimeInformation.dll]- [targetUID: 00000000-00005952] "System.Runtime.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Runtime.dll]- [targetUID: 00000000-00005952] "System.Threading.Tasks.Extensions.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Threading.Tasks.Extensions.dll]- [targetUID: 00000000-00005952] "System.Net.IPNetwork.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Net.IPNetwork.dll]- [targetUID: 00000000-00005952] "Microsoft.Win32.Registry.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Win32.Registry.dll]- [targetUID: 00000000-00005952] "Microsoft.Bcl.AsyncInterfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Microsoft.Bcl.AsyncInterfaces.dll]- [targetUID: 00000000-00005952] "System.Buffers.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Buffers.dll]- [targetUID: 00000000-00005952] "System.Security.Cryptography.Encoding.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Security.Cryptography.Encoding.dll]- [targetUID: 00000000-00005952] "System.Security.Cryptography.Primitives.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Security.Cryptography.Primitives.dll]- [targetUID: 00000000-00005952] "Interop.NetFwTypeLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Interop.NetFwTypeLib.dll]- [targetUID: 00000000-00005952] "System.ServiceProcess.ServiceController.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.ServiceProcess.ServiceController.dll]- [targetUID: 00000000-00005952] "Phoenix.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Phoenix.dll]- [targetUID: 00000000-00005952] "Syncro.Service.Models.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.Models.dll]- [targetUID: 00000000-00005952] "System.Runtime.CompilerServices.Unsafe.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Runtime.CompilerServices.Unsafe.dll]- [targetUID: 00000000-00005952] "System.Security.Principal.Windows.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\System.Security.Principal.Windows.dll]- [targetUID: 00000000-00005952] "Destructurama.Attributed.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Destructurama.Attributed.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\el-GR\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ru-RU\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ar-SA\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ja-JP\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Service.Configuration.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.Configuration.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\fr-FR\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\de-DE\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\es-ES\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\fi-FI\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Service.Services.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.Services.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\cs-CZ\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\pt-BR\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\sl-SI\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\nl-NL\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\it-IT\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\da-DK\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\zh-CHS\Syncro.App.resources.dll]- [targetUID: 00000000-00005952] "Serilog.Formatting.Compact.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Serilog.Formatting.Compact.dll]- [targetUID: 00000000-00005952] "Syncro.Service.Interfaces.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.Interfaces.dll]- [targetUID: 00000000-00005952] "DeltaCompressionDotNet.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\DeltaCompressionDotNet.dll]- [targetUID: 00000000-00005952] "UrlCombineLib.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\UrlCombineLib.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\sl-SI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\fr-FR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ja-JP\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ru-RU\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\de-DE\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\es-ES\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\fi-FI\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\da-DK\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\pt-BR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\ar-SA\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\nl-NL\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\el-GR\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\zh-CHS\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\en\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\cs-CZ\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.Tools.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\it-IT\Syncro.Tools.resources.dll]- [targetUID: 00000000-00005952] "Syncro.App.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.App.dll.config]- [targetUID: 00000000-00005952] "RepairTech.Common.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\RepairTech.Common.Tools.dll.config]- [targetUID: 00000000-00005952] "Syncro.Tools.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Tools.dll.config]- [targetUID: 00000000-00005952] "Syncro.Service.Configuration.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Service.Configuration.dll.config]- [targetUID: 00000000-00005952] "Syncro.Contracts.dll.config" has type "Unknown"- Location: [%PROGRAMFILES%\RepairTech\Syncro\app-1.0.198.18354\Syncro.Contracts.dll.config]- [targetUID: 00000000-00005952]71:T4456," HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"f16222e7fa5db31637ee672674dc0d33" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 6159edaa56df065d4cc19d9b481f177a X-Runtime: 0.039592 with no response body "PUT //device_api/device HTTP/1.1 Content-Type: application/json Host: rmm.syncromsp.com Content-Length: 192 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"047b35e4c27e40c5f151186b0f8858a3" Cache-Control: max-age=0 private must-revalidate X-Request-Id: ee704b1522e2f8848ebe779218302f97 X-Runtime: 0.056171 with no response body "PUT /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 14041 Accept-Encoding: gzip, deflate" Response ==> HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Tue 03 Mar 2026 15:53:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Vary: Accept-Encoding Content-Encoding: gzip ETag: W/"6f3e4b6f4b9a09cb94ee1da6ac24ffaa" Cache-Control: max-age=0 private must-revalidate X-Request-Id: 5181c29d6806c225d18b7a3759b87c1a X-Runtime: 0.065145 with no response body74:T2d66,"POST /device_api/device HTTP/1.1 Content-Type: application/json; charset=UTF-8 Host: rmm.syncromsp.com Content-Length: 11422 Accept-Encoding: gzip, deflate Connection: Keep-Alive" with payload:==> "{"shop_api_key":"HkwyrKdJ_66D-CZwC_ryfQ","device":{"customer_company_name":"","customer_name":"DESKTOP-FVVF82A","customer_installed":true,"customer_phone_number":"","requestable_alerts":["app_crash_trigger","bsod_trigger","defrag_trigger","device_manager_trigger","firewall_trigger","low_hd_space_trigger","no_av_trigger","smart_failure_trigger"],"applications":[{"name":"","vendor":"","installation_date":"","location":"","version":""},{"name":"Adobe Flash Player 32 NPAPI","vendor":"Adobe Systems Incorporated","installation_date":"","location":"","version":"32.0.0.101"},{"name":"Google Chrome","vendor":"Google LLC","installation_date":"2024-03-08T08:00:00Z","location":"C:\\Program Files\\Google\\Chrome\\Application","version":"122.0.6261.112"},{"name":"Microsoft Edge","vendor":"Microsoft Corporation","installation_date":"2022-11-21T08:00:00Z","location":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application","version":"107.0.1418.56"},{"name":"Microsoft Edge Update","vendor":"","installation_date":"","location":"","version":"1.3.171.37"},{"name":"Microsoft Visual C++ 2022 X86 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{080D8397-60F4-44B3-BB95-FBB950CB0B4E}v14.34.31938\\packages\\vcRuntimeAdditional_x86\\","version":"14.34.31938"},{"name":"Python Launcher","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\","version":"3.11.7966.0"},{"name":"Java 8 Update 161","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Program Files (x86)\\Java\\jre1.8.0_161\\","version":"8.0.1610.12"},{"name":"Java Auto Updater","vendor":"Oracle Corporation","installation_date":"2018-03-05T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Oracle\\Java\\jre1.8.0_161\\","version":"2.8.161.12"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}v14.34.31938\\packages\\vcRuntimeMinimum_x86\\","version":"14.34.31938"},{"name":"Adobe Reader XI (11.0.20)","vendor":"Adobe Systems Incorporated","installation_date":"2022-09-13T07:00:00Z","location":"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\","version":"11.0.20"},{"name":"Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"","location":"","version":"14.34.31938.0"},{"name":"NVM for Windows 1.1.12","vendor":"Ecor Ventures LLC","installation_date":"2024-07-15T07:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Roaming\\nvm\\","version":"1.1.12"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"","location":"C:\\Program Files\\Microsoft Office","version":"14.0.6029.1000"},{"name":"Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{0AE39060-F209-4D05-ABC7-54B8F9CFA32E}v14.34.31938\\packages\\vcRuntimeMinimum_amd64\\","version":"14.34.31938"},{"name":"Python 3.11.0 pip Bootstrap (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Core Interpreter (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{1ED03561-12AC-4A6A-AA85-583281BF0121}v3.11.150.0\\","version":"3.11.150.0"},{"name":"UpdateAssistant","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\b6375be055b307f0b793e52799af726d\\img\\","version":"1.19.0.0"},{"name":"Windows Setup Remediations (x64) (KB4023057)","vendor":"","installation_date":"","location":"","version":""},{"name":"Python 3.11.0 Tcl/Tk Support (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Development Libraries (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Microsoft Visual C++ 2022 X64 Additional Runtime - 14.34.31938","vendor":"Microsoft Corporation","installation_date":"2023-03-10T08:00:00Z","location":"C:\\ProgramData\\Package Cache\\{7DA37AE3-D8AE-49B1-9BDC-23CA0AB9FF22}v14.34.31938\\packages\\vcRuntimeAdditional_amd64\\","version":"14.34.31938"},{"name":"Microsoft Office Access MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office 2010 Service Pack 1 (SP1)","vendor":"Microsoft","installation_date":"","location":"","version":""},{"name":"Microsoft Office Excel MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office PowerPoint MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Publisher MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Outlook MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Word MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (French) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proof (Spanish) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Proofing (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Office 32-bit Components 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared 32-bit MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office InfoPath MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office OneNote MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Groove MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Shared Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Access Setup Metadata MUI (English) 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Microsoft Office Professional Plus 2010","vendor":"Microsoft Corporation","installation_date":"2022-03-22T07:00:00Z","location":"C:\\Program Files\\Microsoft Office\\","version":"14.0.6029.1000"},{"name":"Python 3.11.0 Add to Path (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{ACF8763C-83E8-4BE1-B67C-DF86C2E1240A}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Executables (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{B28E4BED-428C-40CB-9A29-41E46263246D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Utility Scripts (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{BD29D023-6B95-47FE-B480-598840EB9A28}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Standard Library (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Documentation (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Python 3.11.0 Test Suite (64-bit)","vendor":"Python Software Foundation","installation_date":"2022-11-09T08:00:00Z","location":"C:\\Users\\HAPUBWS\\AppData\\Local\\Package Cache\\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}v3.11.150.0\\","version":"3.11.150.0"},{"name":"Update for Windows 10 for x64-based Systems (KB4023057)","vendor":"Microsoft Corporation","installation_date":"2019-01-29T08:00:00Z","location":"C:\\WINDOWS\\SoftwareDistribution\\Download\\1eb060e9b9d3cbeb39c83f2a9722294e\\img\\","version":"2.53.0.0"},{"name":"Python 3.11.0 (64-bit)","vendor":"Python Software Foundation","installation_date":"","location":"","version":"3.11.150.0"}],"language":"en","agent_type":"windows","customer_id":1807323,"folder_id":4906582}}"75:T781,Spawned process "b__37_0\" (Indicator: \"CreateDirectory\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"CreateDirectoryWithParents\" (Indicator: \"CreateDirectory\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"CreateDirectoryIfNotExist\" (Indicator: \"CreateDirectory\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"O SEEK penalty is checking for the '{physicalDrive}' drive. DeviceIoControl: {message}\" (Indicator: \"DeviceIoControl\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"OTATE device is checking for the '{physicalDrive}' drive. CreateFile failed: {message}\" (Indicator: \"CreateFile\"; File: \"AMSI\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataTaskAsync\" in \"Squirrel.dll\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileTaskAsync\" in \"Squirrel.dll\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001448.00000000.121440.03420000.00000004.mdmp, 00000000-00001448.00000001.123360.03420000.00000004.mdmp, 00000000-00001448.00000002.123879.03420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\"\n Observed function \"Process.Start\" in \"MetroFramework.dll\"\n Observed function \"Process.Start\" in \"Microsoft.Win32.TaskScheduler.dll\"\n Observed function \"Process.Start\" in \"Squirrel.dll\"\n Observed function \"ProcessUtils.StartHiddenApp\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$45","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$47","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process k__BackingField\" (Indicator: \"\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"{0}] http ping to {1}: error, status: {2}, message: {3}\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"http ping to\" (Indicator: \"ping\"; File: \"AMSI\")\n Found string \"ot App.Runner Heartbeat Ping\" (Indicator: \"ping\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Syncro.Installer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$69","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"file/memory contains long string(File: \"Syncro.Uninstaller.exe\")\n file/memory contains long string(File: \"Syncro.Uninstaller.Tools.exe\")\n file/memory contains long string(File: \"System.ServiceProcess.ServiceController.dll\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"file/memory contains long string(File: \"System.Security.Principal.Windows.dll\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"Syncro.Tools.dll\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005952-00000C2C-866598759\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005952-00000C2C-866598783\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005952-00000C2C-868067815\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005952-00000C2C-868067844\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Syncro.Installer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005952)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"Syncro.Uninstaller.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005952-00000C2C-872084415","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004748.00000000.123219.45A1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Syncro.Installer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Syncro.Installer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"C1F1AAB4C5ABDC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001448.00000000.121440.03420000.00000004.mdmp, 00000000-00001448.00000001.123360.03420000.00000004.mdmp, 00000000-00001448.00000002.123879.03420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"| Out-String -Stream -Width 120\" (Indicator: \"Out-String\"; File: \"AMSI\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Syncro.Installer.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\Syncro.Installer.exe]- [targetUID: 00000000-00001448]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Syncro.Installer.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\Syncro.Installer.exe.log]- [targetUID: 00000000-00005952]\n Dropped file: \"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin.exe.log]- [targetUID: 00000000-00001448]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"custom-logo.png\" has type \"PNG image data 500 x 120 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"chat-bubbles-icon.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Telerik.Windows.Controls.ConversationalUI.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"MetroFramework.Fonts.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"NuGet.Squirrel.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"MetroFramework.dll\" was detected as \"Morphine v1.2 (DLL)\"\n \"Mono.Cecil.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"7za-x86.dll\" was detected as \"Microsoft visual C++ 6.0 DLL\"\n \"websocket-sharp.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Syncro.Uninstaller.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" '\" (Indicator: \" win32_ntlogevent\"; File: \"AMSI\")\n \"ELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND Type = 'Error' AND EventCode = '1001' AND TimeWritten > '\" (Indicator: \" win32_ntlogevent\"; File: \"AMSI\")\n \"ELECT * FROM win32_logicaldisk WHERE deviceId='{0}:'\" (Indicator: \" win32_logicaldisk\"; File: \"AMSI\")\n \";$registryPath = '';$os = Get-WmiObject -Class Win32_OperatingSystem;$os64 = $os.OSArchitecture -eq '64-bit'if ($os64) { $registryPath = 'HKLM:\\\" (Indicator: \" win32_operatingsystem\"; File: \"AMSI\")\n \"ELECT * FROM Win32_Service WHERE Name LIKE 'Syncro%'\" (Indicator: \" win32_service\"; File: \"AMSI\")\n \"elect * from Win32_Process\" (Indicator: \" win32_process\"; File: \"AMSI\")\n \"ELECT * FROM Win32_Process WHERE Handle = '{0}'\" (Indicator: \" win32_process\"; File: \"AMSI\")\n \"ELECT Version FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET REMOTE_ACCESS Observed Remote Management Software Domain (syncromsp .com in TLS SNI)\" (SID: 2036347, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET REMOTE_ACCESS Observed SyncroMSP Remote Management Software Domain (kabutoservices .com in TLS SNI)\" (SID: 2042880, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$6f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69a703b05049cfafda0111b7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"