Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{be826f5f-eda5-45a2-a3fe-c2cb5c1b9842}' = '"%ALLUSERSPROFILE%\Package Cache\{be826f5f-eda5-45a2-a3fe-c2cb5c1b9842}\VC_red...
Modifies file system
Creates the following files
- %TEMP%\vc_redist.x86.exe
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1049\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1055\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1055\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\2052\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\2052\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\3082\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\3082\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20201002182333.log
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.be\vc_redist.x86.exe
- %ALLUSERSPROFILE%\package cache\{be826f5f-eda5-45a2-a3fe-c2cb5c1b9842}\vc_redist.x86.exe
- %ALLUSERSPROFILE%\package cache\{be826f5f-eda5-45a2-a3fe-c2cb5c1b9842}\state.rsm
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\windows7_msu_x64
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\vcruntimeminimum_x86
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\vcruntimeadditional_x86
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\cab54a5cabbe7274d8a22eb58060aab7623
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\cabb3e1576d1fefbb979e13b1a5379e0b16
- C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\8dc1965148a9664397c459e64f55e6d3.tmp
- C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\33b2b04ae91f1d4ea33e78a6fa13188a.tmp
- C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\8abf8f800c2eec4e809e2183964c69a0.tmp
- C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\e5adc0f73d690c479215cfec2b3d06e9.tmp
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1049\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\38785537-00fe-4fd2-9134-f61e8dc05341\source.cab
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1046\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1045\license.rtf
- %WINDIR%\temp\{2504041c-c30d-42fe-a0d6-4cd864838917}\.cr\vc_redist.x86.exe
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\wixstdba.dll
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\thm.xml
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\logo.png
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1028\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1028\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1029\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1029\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1031\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1031\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1036\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1036\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1040\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1040\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1041\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1041\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1042\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1042\license.rtf
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1045\thm.wxl
- %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.ba\1046\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\38785537-00fe-4fd2-9134-f61e8dc05341\package.cab
Deletes the following files
- %WINDIR%\softwaredistribution\scanfile\38785537-00fe-4fd2-9134-f61e8dc05341\source.cab
Moves the following files
- from %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\windows7_msu_x64 to %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64
- from %ALLUSERSPROFILE%\package cache\.unverified\windows7_msu_x64 to %ALLUSERSPROFILE%\package cache\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\packages\patch\x64\windows6.1-kb2999226-x64.msu
- from %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\vcruntimeminimum_x86 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x86
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeminimum_x86 to %ALLUSERSPROFILE%\package cache\{42163859-095f-469b-a0b0-7748500570d1}v14.27.29112\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi
- from %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\cab54a5cabbe7274d8a22eb58060aab7623 to %ALLUSERSPROFILE%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623
- from %ALLUSERSPROFILE%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623 to %ALLUSERSPROFILE%\package cache\{42163859-095f-469b-a0b0-7748500570d1}v14.27.29112\packages\vcruntimeminimum_x86\cab1.cab
- from %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\vcruntimeadditional_x86 to %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x86
- from %ALLUSERSPROFILE%\package cache\.unverified\vcruntimeadditional_x86 to %ALLUSERSPROFILE%\package cache\{526b224d-6b70-4a2a-9d03-ce304b5125d6}v14.27.29112\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi
- from %WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\cabb3e1576d1fefbb979e13b1a5379e0b16 to %ALLUSERSPROFILE%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16
- from %ALLUSERSPROFILE%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16 to %ALLUSERSPROFILE%\package cache\{526b224d-6b70-4a2a-9d03-ce304b5125d6}v14.27.29112\packages\vcruntimeadditional_x86\cab1.cab
- from C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\8dc1965148a9664397c459e64f55e6d3.tmp to C:\cce4aab7f9d8470034eaee3474\wsusscan.cab
- from C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\33b2b04ae91f1d4ea33e78a6fa13188a.tmp to C:\cce4aab7f9d8470034eaee3474\windows6.1-kb2999226-x64.cab
- from C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\8abf8f800c2eec4e809e2183964c69a0.tmp to C:\cce4aab7f9d8470034eaee3474\windows6.1-kb2999226-x64-pkgproperties.txt
- from C:\cce4aab7f9d8470034eaee3474\$dpx$.tmp\e5adc0f73d690c479215cfec2b3d06e9.tmp to C:\cce4aab7f9d8470034eaee3474\windows6.1-kb2999226-x64.xml
Network activity
TCP
- 'ak#.ms':443
- 'download.visualstudio.microsoft.com':443
UDP
- DNS ASK ak#.ms
- DNS ASK download.visualstudio.microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\vc_redist.x86.exe' /install /quiet /norestart
- '%WINDIR%\temp\{2504041c-c30d-42fe-a0d6-4cd864838917}\.cr\vc_redist.x86.exe' -burn.clean.room="%TEMP%\vc_redist.x86.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{18A2C042-359C-4EC3-8744-8AD9CAEBD9FC} {4C880AA0-959E-4385-9624-6171929EB6CB} 2936
- '%WINDIR%\temp\{3bc40448-c83e-46c0-a65d-ce0d1bfc05f1}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{18A2C042-359C-4EC3-8744-8AD9CAEBD9FC} {4C880AA0-959E-4385-9624-6171929EB6CB} 2936' (with hidden window)
Executes the following
- '<SYSTEM32>\wusa.exe' "%ALLUSERSPROFILE%\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu" /quiet /norestart
