Detailed analysis:

• CricutSync.exe will connect to Bridge.exe for data sync. Bridge.exe is listening on port 0.0.0.0:6999.
• When the sync starts, CricutSync.exe will connect to localhost:6999, which is 127.0.0.1:6999.
• However, TrendMicro Tmproxy is listening on port 127.0.0.1:6999. As a result, the connection of CricutSynce.exe is sent to Tmproxy instead of Bridge.exe.

Issues found:

• When starting up, Bridge.exe should check if any other application is using port 6999. If yes, it should use other ports.
• Bridge.exe binds to 0.0.0.0:6999. However, CricutSync.exe connects to it using 127.0.0.1:6999. This will only succeed if no other application is listening on 127.0.0.1:6999. In this case, TrendMicro Tmproxy is listening on the port, so the connection is intercepted by Tmproxy.

1. Unload the Client/Server Security Agent (CSA)/Security Agent (SA).
   1. Right-click the Trend Micro icon in your system tray near your computer's clock, and then select the option that applies to you.
      • For WFBS 6.0: Unload Client/Server Security Agent
      • For WFBS 7.0/8.0/9.0: Exit Worry-Free Business Security
   2. Enter the password and click OK.
2. Modify the TmProxy registry key.
   1. Open the Registry Editor.
      Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
   2. Go to the registry path: HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC\TmProxy.
   3. Replace the TmProxy port address from "6999" to "7000" in decimal values.
      The Dword value will show the following:
      Dwords: ProxyPort = 1b58 (7000)
3. Restart the CSA/SA client.
   • For WFBS 6.0: Click Start > All Programs > Trend Micro Client-Server Security Agent > Client-Server Security Agent.
   • For WFBS 7.0/8.0/9.0: Click Start > All Programs > Trend Micro Worry-Free Business Security Agent > Worry-Free Business.