Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{65e650ff-30be-469d-b63a-418d71ea1765}' = '"%PROGRAMDATA%\Package Cache\{65e650ff-30be-469d-b63a-418d71ea1765}\VC_redist....
Modifies file system
Creates the following files
- %TEMP%\vc_redist.x86.exe
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1049\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1055\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1055\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\2052\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\2052\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\3082\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\3082\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20200411200753.log
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.be\vc_redist.x86.exe
- %PROGRAMDATA%\package cache\{65e650ff-30be-469d-b63a-418d71ea1765}\vc_redist.x86.exe
- %PROGRAMDATA%\package cache\{65e650ff-30be-469d-b63a-418d71ea1765}\state.rsm
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\windows7_msu_x64
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\vcruntimeminimum_x86
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\vcruntimeadditional_x86
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\cab54a5cabbe7274d8a22eb58060aab7623
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\cabb3e1576d1fefbb979e13b1a5379e0b16
- C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\0607302711bbb543b94a7399714a9c43.tmp
- C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\1d4e48d984473e44b6eec42bd610b42d.tmp
- C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\a80061b77479594b9c825e3cf09c3986.tmp
- C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\8ba6169d44937b4bb8bea50c2e35f1c2.tmp
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1049\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\a661d7d8-2cf2-4123-b78d-3251c15087f6\source.cab
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1046\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1045\license.rtf
- %WINDIR%\temp\{1e02e6a1-1806-40da-be64-7db994c5cea9}\.cr\vc_redist.x86.exe
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\wixstdba.dll
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\thm.xml
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\logo.png
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1028\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1028\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1029\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1029\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1031\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1031\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1036\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1036\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1040\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1040\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1041\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1041\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1042\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1042\license.rtf
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1045\thm.wxl
- %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.ba\1046\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\a661d7d8-2cf2-4123-b78d-3251c15087f6\package.cab
Deletes the following files
- %WINDIR%\softwaredistribution\scanfile\a661d7d8-2cf2-4123-b78d-3251c15087f6\source.cab
Moves the following files
- from %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\windows7_msu_x64 to %PROGRAMDATA%\package cache\.unverified\windows7_msu_x64
- from %PROGRAMDATA%\package cache\.unverified\windows7_msu_x64 to %PROGRAMDATA%\package cache\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\packages\patch\x64\windows6.1-kb2999226-x64.msu
- from %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
- from %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi
- from %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\cab54a5cabbe7274d8a22eb58060aab7623 to %PROGRAMDATA%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623
- from %PROGRAMDATA%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623 to %PROGRAMDATA%\package cache\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\packages\vcruntimeminimum_x86\cab1.cab
- from %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\vcruntimeadditional_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeadditional_x86
- from %PROGRAMDATA%\package cache\.unverified\vcruntimeadditional_x86 to %PROGRAMDATA%\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi
- from %WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\cabb3e1576d1fefbb979e13b1a5379e0b16 to %PROGRAMDATA%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16
- from %PROGRAMDATA%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16 to %PROGRAMDATA%\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\cab1.cab
- from C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\0607302711bbb543b94a7399714a9c43.tmp to C:\deea7f14f8ebfa53fc50fdad222239\wsusscan.cab
- from C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\1d4e48d984473e44b6eec42bd610b42d.tmp to C:\deea7f14f8ebfa53fc50fdad222239\windows6.1-kb2999226-x64.cab
- from C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\a80061b77479594b9c825e3cf09c3986.tmp to C:\deea7f14f8ebfa53fc50fdad222239\windows6.1-kb2999226-x64-pkgproperties.txt
- from C:\deea7f14f8ebfa53fc50fdad222239\$dpx$.tmp\8ba6169d44937b4bb8bea50c2e35f1c2.tmp to C:\deea7f14f8ebfa53fc50fdad222239\windows6.1-kb2999226-x64.xml
Network activity
TCP
- 'ak#.ms':443
- 'download.visualstudio.microsoft.com':443
UDP
- DNS ASK ak#.ms
- DNS ASK download.visualstudio.microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\vc_redist.x86.exe' /install /quiet /norestart
- '%WINDIR%\temp\{1e02e6a1-1806-40da-be64-7db994c5cea9}\.cr\vc_redist.x86.exe' -burn.clean.room="%TEMP%\vc_redist.x86.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{3DA13CA2-0E0A-40DF-91FB-BCCF2FB5021A} {A313DAE7-6FA5-4B6D-B836-FF2D992455F1} 2676
- '%WINDIR%\temp\{6d42930e-f2b7-44ac-a62d-614c8b646676}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{3DA13CA2-0E0A-40DF-91FB-BCCF2FB5021A} {A313DAE7-6FA5-4B6D-B836-FF2D992455F1} 2676' (with hidden window)
Executes the following
- '<SYSTEM32>\wusa.exe' "%PROGRAMDATA%\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu" /quiet /norestart
