Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Pizza.Towe...TE.url
windows7-x64
1Pizza.Towe...TE.url
windows10-2004-x64
1Pizza.Towe...EE.url
windows7-x64
1Pizza.Towe...EE.url
windows10-2004-x64
1Pizza.Towe...up.exe
windows7-x64
7Pizza.Towe...up.exe
windows10-2004-x64
7Pizza.Towe...ll.bat
windows7-x64
8Pizza.Towe...ll.bat
windows10-2004-x64
7Pizza.Towe...st.exe
windows7-x64
7Pizza.Towe...st.exe
windows10-2004-x64
6Pizza.Towe...64.exe
windows7-x64
7Pizza.Towe...64.exe
windows10-2004-x64
7Pizza.Towe...86.exe
windows7-x64
7Pizza.Towe...86.exe
windows10-2004-x64
7Pizza.Towe...64.exe
windows7-x64
7Pizza.Towe...64.exe
windows10-2004-x64
7Pizza.Towe...86.exe
windows7-x64
7Pizza.Towe...86.exe
windows10-2004-x64
7Pizza.Towe...64.exe
windows7-x64
7Pizza.Towe...64.exe
windows10-2004-x64
7Pizza.Towe...86.exe
windows7-x64
7Pizza.Towe...86.exe
windows10-2004-x64
7Pizza.Towe...64.exe
windows7-x64
7Pizza.Towe...64.exe
windows10-2004-x64
7Pizza.Towe...86.exe
windows7-x64
7Pizza.Towe...86.exe
windows10-2004-x64
7Pizza.Towe...64.exe
windows7-x64
7Pizza.Towe...64.exe
windows10-2004-x64
7Pizza.Towe...86.exe
windows7-x64
7Pizza.Towe...86.exe
windows10-2004-x64
7Pizza.Towe...64.exe
windows7-x64
7Pizza.Towe...64.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2023, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
Pizza.Tower.v1.0.311/TORRENT SITE.url
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
Pizza.Tower.v1.0.311/TORRENT SITE.url
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Pizza.Tower.v1.0.311/WATCH MOVIES FOR FREE.url
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral4
Sample
Pizza.Tower.v1.0.311/WATCH MOVIES FOR FREE.url
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/dxwebsetup.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral6
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/dxwebsetup.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/install_all.bat
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral8
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/install_all.bat
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/oalinst.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral10
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/oalinst.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral12
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x86.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral14
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x86.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2008_x64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral16
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2008_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2008_x86.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral18
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2008_x86.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2010_x64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral20
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2010_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2010_x86.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral22
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2010_x86.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2012_x64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral24
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2012_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2012_x86.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral26
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2012_x86.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2013_x64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral28
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2013_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2013_x86.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral30
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2013_x86.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2015_2017_2019_x64.exe
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral32
Sample
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2015_2017_2019_x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
Pizza.Tower.v1.0.311/_Redist/_Redist/vcredist2005_x64.exe
-
Size
3.1MB
-
MD5
abde5e0a22a46434bd0df652a63fff44
-
SHA1
c5088da4be3f72b4af2f3156893bf1d2b1f6f6ec
-
SHA256
b1cbcde3791e0b1c6df3def43d8c05035c60fe2f6a2d8ba091abb4509fb43ef1
-
SHA512
4ebd8971dea1efb9a72fee071694da7c9d8c797b3564cec7e0044d24b01a13009013f4a43719b7e223214a6c43d50d56790751b9e91cd324d40809bf0d605d9f
-
SSDEEP
49152:RVgGXsOTkzq69oXxerpduZ6xJftGEkU0oEBL/txTroHENHTpPE6fIr6VAVP04PLJ:R7XFcDehoLtXEBv11TqZl04P5PqE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1916 VCREDI~2.EXE -
Loads dropped DLL 2 IoCs
pid Process 808 MsiExec.exe 808 MsiExec.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" VCREDI~2.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vcredist2005_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" vcredist2005_x64.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce VCREDI~2.EXE -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll msiexec.exe -
Drops file in Windows directory 57 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI854D.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80ENU.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338285.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80KOR.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339161.0\8.0.50727.4053.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203338410.0 msiexec.exe File created C:\Windows\Installer\e5776d6.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339161.0\8.0.50727.4053.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339253.0\8.0.50727.4053.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203339097.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80ESP.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80JPN.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338628.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\amd64_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_3ed5eb6c.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339097.0\vcomp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339238.0\8.0.50727.4053.policy msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203339161.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338410.0\msvcr80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338410.0\msvcp80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338410.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338410.0\msvcm80.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339113.0\8.0.50727.4053.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339191.0\8.0.50727.4053.policy msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338410.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_18a05f69.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339253.0\8.0.50727.4053.cat msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203339191.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80ITA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339097.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80FRA.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339097.0\amd64_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_19a62d03.manifest msiexec.exe File created C:\Windows\Installer\SourceHash{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80CHS.dll msiexec.exe File opened for modification C:\Windows\Installer\MSI9183.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339113.0\8.0.50727.4053.policy msiexec.exe File created C:\Windows\Installer\e5776d9.msi msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203338285.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203338941.0 msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfc80u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339238.0\8.0.50727.4053.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80CHT.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203339191.0\8.0.50727.4053.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfcm80u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203339238.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203339253.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338628.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e986d26e.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338628.0\mfc80.dll msiexec.exe File opened for modification C:\Windows\Installer\e5776d6.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338941.0\mfc80DEU.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203338628.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20230526203339113.0 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338285.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_79404cdd.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20230526203338285.0\ATL80.dll msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a8dca56a4fb650f70000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a8dca56a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900a8dca56a000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a8dca56a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 45 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00500054005d002700660025002b0027004b002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\9eab5ec6ac3d99b498a1d16c1c815acf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\PackageCode = "83DB259064B8669479679DCD441743AC" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Version = "134276920" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\PackageName = "vcredist.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Clients = 3a0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.ATL,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e005a00310021003d00520046007900460072005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0049004c005400540052005900320074004f005700650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFC,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e0069002a0048004e00530057007d0024007e005500650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.OpenMP,type="win32-policy",version="8.0.50727.4053",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 75003d007a007e004a0056003f004400410040005a007d003800620068004f003d007d0034007a00560043005f005200650064006900730074003e007e0078002d00360076007a0045007a007e003200650038004d006b0062004900640046007700550000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9eab5ec6ac3d99b498a1d16c1c815acf\VC_Redist msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9eab5ec6ac3d99b498a1d16c1c815acf\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4428 msiexec.exe 4428 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1016 msiexec.exe Token: SeIncreaseQuotaPrivilege 1016 msiexec.exe Token: SeSecurityPrivilege 4428 msiexec.exe Token: SeCreateTokenPrivilege 1016 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1016 msiexec.exe Token: SeLockMemoryPrivilege 1016 msiexec.exe Token: SeIncreaseQuotaPrivilege 1016 msiexec.exe Token: SeMachineAccountPrivilege 1016 msiexec.exe Token: SeTcbPrivilege 1016 msiexec.exe Token: SeSecurityPrivilege 1016 msiexec.exe Token: SeTakeOwnershipPrivilege 1016 msiexec.exe Token: SeLoadDriverPrivilege 1016 msiexec.exe Token: SeSystemProfilePrivilege 1016 msiexec.exe Token: SeSystemtimePrivilege 1016 msiexec.exe Token: SeProfSingleProcessPrivilege 1016 msiexec.exe Token: SeIncBasePriorityPrivilege 1016 msiexec.exe Token: SeCreatePagefilePrivilege 1016 msiexec.exe Token: SeCreatePermanentPrivilege 1016 msiexec.exe Token: SeBackupPrivilege 1016 msiexec.exe Token: SeRestorePrivilege 1016 msiexec.exe Token: SeShutdownPrivilege 1016 msiexec.exe Token: SeDebugPrivilege 1016 msiexec.exe Token: SeAuditPrivilege 1016 msiexec.exe Token: SeSystemEnvironmentPrivilege 1016 msiexec.exe Token: SeChangeNotifyPrivilege 1016 msiexec.exe Token: SeRemoteShutdownPrivilege 1016 msiexec.exe Token: SeUndockPrivilege 1016 msiexec.exe Token: SeSyncAgentPrivilege 1016 msiexec.exe Token: SeEnableDelegationPrivilege 1016 msiexec.exe Token: SeManageVolumePrivilege 1016 msiexec.exe Token: SeImpersonatePrivilege 1016 msiexec.exe Token: SeCreateGlobalPrivilege 1016 msiexec.exe Token: SeBackupPrivilege 4016 vssvc.exe Token: SeRestorePrivilege 4016 vssvc.exe Token: SeAuditPrivilege 4016 vssvc.exe Token: SeBackupPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeBackupPrivilege 2620 srtasks.exe Token: SeRestorePrivilege 2620 srtasks.exe Token: SeSecurityPrivilege 2620 srtasks.exe Token: SeTakeOwnershipPrivilege 2620 srtasks.exe Token: SeBackupPrivilege 2620 srtasks.exe Token: SeRestorePrivilege 2620 srtasks.exe Token: SeSecurityPrivilege 2620 srtasks.exe Token: SeTakeOwnershipPrivilege 2620 srtasks.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe Token: SeTakeOwnershipPrivilege 4428 msiexec.exe Token: SeRestorePrivilege 4428 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1016 msiexec.exe 1016 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1916 1456 vcredist2005_x64.exe 82 PID 1456 wrote to memory of 1916 1456 vcredist2005_x64.exe 82 PID 1456 wrote to memory of 1916 1456 vcredist2005_x64.exe 82 PID 1916 wrote to memory of 1016 1916 VCREDI~2.EXE 83 PID 1916 wrote to memory of 1016 1916 VCREDI~2.EXE 83 PID 1916 wrote to memory of 1016 1916 VCREDI~2.EXE 83 PID 4428 wrote to memory of 2620 4428 msiexec.exe 96 PID 4428 wrote to memory of 2620 4428 msiexec.exe 96 PID 4428 wrote to memory of 808 4428 msiexec.exe 98 PID 4428 wrote to memory of 808 4428 msiexec.exe 98 PID 4428 wrote to memory of 808 4428 msiexec.exe 98 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe"C:\Users\Admin\AppData\Local\Temp\Pizza.Tower.v1.0.311\_Redist\_Redist\vcredist2005_x64.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1016
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3D9C3B8998D3AA9AEF494F0394D77AF12⤵
- Loads dropped DLL
PID:808
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5e2fb6ba098e7c2a18cf3fcfed32a140b
SHA121c41b1bbf3fd62ef9da28eb81a2e3962c83e535
SHA256cae3d6392eaa4346516775180cf394bcebe6eb2cdd7348b7e93be0fcb27b046c
SHA5129a1de3cb3c483d1ddf86ae78a664080814eceaf4b5eeedbb45cfeb1733601c87916bf86531f032849c6772fbac5a15b810ccfc24095d32c9345811fb94948308
-
Filesize
3.0MB
MD55734983a4cb513efbcccc357641c4d7c
SHA15650512cd0c8ae451032a795a4e881c9cdc50776
SHA256bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a
SHA51293da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8
-
Filesize
3.0MB
MD55734983a4cb513efbcccc357641c4d7c
SHA15650512cd0c8ae451032a795a4e881c9cdc50776
SHA256bfc68a9e609ee8a850c21be8c459b99f09e34309b8113e43b12be7a27f0b445a
SHA51293da04b2f7a3f64dca8c2c5b4c62be1ba867e46424130af19f9f88e668fd6ee10db354ed3921605df936a1248be51fe8e8612f9542b01de3e0ef54be3356f2a8
-
Filesize
312KB
MD50aa0da68a91e9133715d9cde2a180ffb
SHA1892e941bed49b3404dad2aa33cd36b708e1443a9
SHA25664570910e03c337d4e1f8ab1b9fb8e4dc46fdccb93857a1e9c73b296c6850fe0
SHA512247dc48b39844fcfbfd46ef8eb1c72375b183f2d54361f5fe857d3a1b7275145cd0a9be8f287e037b46912a496a39a8855c20a63a8c663b60fc620b0b35e2313
-
Filesize
3.0MB
MD5391dddd564a9e8a20576fe05e5e1f25b
SHA184f17830075abea6e6a369dee6b93ac16a71f025
SHA256a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2
SHA51210358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
Filesize
3.0MB
MD5391dddd564a9e8a20576fe05e5e1f25b
SHA184f17830075abea6e6a369dee6b93ac16a71f025
SHA256a9a8dac04e3b38c2f8d33ee7cf6d658fa4ea089bbf9f4014eb61b9d5de7dc6a2
SHA51210358d52620178296c9033b257db960d3bf9b1219fa5b6f02f1173234686930616da708c5ac051b0c0c8892b3b66164093fc64698de43e56cf3b6f1d875e418f
-
Filesize
11.8MB
MD5fb87380974810e6007f9ed4933223a1d
SHA1c617a75af4dad4cc225e523b3ec0cb20f331abfe
SHA256a745fc33809d5bd214cb9189a88580241fb6dd4cca3525b066ee68f258870556
SHA512e929e4a77985aef17a4793906d2af20e8f9970d9d88a4957caa4c0b4568172195b6faebc76f14246f88426d1537cebbab118a832383e82d99bdc3ee67e975d82
-
\??\Volume{6aa5dca8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3e68e183-dd6b-4a27-ad93-81bd42e940e1}_OnDiskSnapshotProp
Filesize5KB
MD5648c77d489ee8b1ad075fee10f9d7651
SHA1aeebe8962cb190208d653fcb8d793cfd94e7ed8d
SHA256e2291647b1157932d235ae2e9133cdd0a06457c6fb467e6532f6761de736b4e8
SHA512a90193252599075216679d88b7037e42d585900f170418472e825eaa7e266c2a42949a8bf996cbc8aba583ef6c5be9f6c9be0c14506858ede08c526457c62c8d