Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '{65e650ff-30be-469d-b63a-418d71ea1765}' = '"%PROGRAMDATA%\Package Cache\{65e650ff-30be-469d-b63a-418d71ea1765}\VC_redist....
- Windows Update
- %TEMP%\vc_redist.x86.exe
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1055\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\2052\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\2052\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\3082\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\3082\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\bootstrapperapplicationdata.xml
- %TEMP%\dd_vcredist_x86_20200419200803.log
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.be\vc_redist.x86.exe
- %PROGRAMDATA%\package cache\{65e650ff-30be-469d-b63a-418d71ea1765}\vc_redist.x86.exe
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1031\license.rtf
- %PROGRAMDATA%\package cache\{65e650ff-30be-469d-b63a-418d71ea1765}\state.rsm
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\vcruntimeminimum_x86
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\vcruntimeadditional_x86
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\cab54a5cabbe7274d8a22eb58060aab7623
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\cabb3e1576d1fefbb979e13b1a5379e0b16
- C:\29152d5b795aeca2de6a\$dpx$.tmp\537a6d8945b01e45b988fb172d63691a.tmp
- C:\29152d5b795aeca2de6a\$dpx$.tmp\53e90e74443cc34c9357cfbf3f5e7fae.tmp
- C:\29152d5b795aeca2de6a\$dpx$.tmp\29211ce5e792544589a78cf340e340f6.tmp
- C:\29152d5b795aeca2de6a\$dpx$.tmp\9c2b76af92e710458f88d5747097c4b8.tmp
- %WINDIR%\softwaredistribution\scanfile\aae738b5-81af-4216-a31f-ff89bb2d7a26\source.cab
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1049\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1055\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1049\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1046\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1046\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\wixstdba.dll
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\thm.xml
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\logo.png
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1028\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1028\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1029\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1029\license.rtf
- %WINDIR%\softwaredistribution\scanfile\aae738b5-81af-4216-a31f-ff89bb2d7a26\package.cab
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\windows7_msu_x64
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1031\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1036\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1040\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1040\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1041\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1041\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1042\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1042\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1045\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1045\license.rtf
- %WINDIR%\temp\{f77653ee-bbd4-42d7-a00c-972fef7ddb83}\.cr\vc_redist.x86.exe
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1036\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\aae738b5-81af-4216-a31f-ff89bb2d7a26\package.xml
- %WINDIR%\softwaredistribution\scanfile\aae738b5-81af-4216-a31f-ff89bb2d7a26\source.cab
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1042\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1045\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1045\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1046\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1046\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1049\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1049\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1055\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1055\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\2052\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\2052\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\3082\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\3082\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\logo.png
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\thm.xml
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\wixstdba.dll
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1042\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.be\vc_redist.x86.exe
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1041\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1040\thm.wxl
- %WINDIR%\softwaredistribution\scanfile\aae738b5-81af-4216-a31f-ff89bb2d7a26\package.xml
- %WINDIR%\softwaredistribution\download\7b6d74016eaebfd601d93340c4f35d8f\cbshandler\state
- %WINDIR%\softwaredistribution\download\7b6d74016eaebfd601d93340c4f35d8f\windows6.1-kb2999226-x64.cab
- %WINDIR%\softwaredistribution\scanfile\aae738b5-81af-4216-a31f-ff89bb2d7a26\package.cab
- C:\29152d5b795aeca2de6a\windows6.1-kb2999226-x64-pkgproperties.txt
- C:\29152d5b795aeca2de6a\windows6.1-kb2999226-x64.cab
- C:\29152d5b795aeca2de6a\windows6.1-kb2999226-x64.xml
- C:\29152d5b795aeca2de6a\wsusscan.cab
- %PROGRAMDATA%\package cache\{65e650ff-30be-469d-b63a-418d71ea1765}\state.rsm
- %PROGRAMDATA%\package cache\{65e650ff-30be-469d-b63a-418d71ea1765}\vc_redist.x86.exe
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1028\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1028\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1029\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1029\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1031\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1031\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1036\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1036\thm.wxl
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1040\license.rtf
- %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.ba\1041\license.rtf
- %WINDIR%\temp\{f77653ee-bbd4-42d7-a00c-972fef7ddb83}\.cr\vc_redist.x86.exe
- from %WINDIR%\softwaredistribution\datastore\logs\edb00001.log to %WINDIR%\softwaredistribution\datastore\logs\edbtmp.log
- from %WINDIR%\softwaredistribution\datastore\logs\edb.log to %WINDIR%\softwaredistribution\datastore\logs\edb00002.log
- from %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\windows7_msu_x64 to %PROGRAMDATA%\package cache\.unverified\windows7_msu_x64
- from %PROGRAMDATA%\package cache\.unverified\windows7_msu_x64 to %PROGRAMDATA%\package cache\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\packages\patch\x64\windows6.1-kb2999226-x64.msu
- from %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86
- from %PROGRAMDATA%\package cache\.unverified\vcruntimeminimum_x86 to %PROGRAMDATA%\package cache\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi
- from %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\cab54a5cabbe7274d8a22eb58060aab7623 to %PROGRAMDATA%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623
- from %PROGRAMDATA%\package cache\.unverified\cab54a5cabbe7274d8a22eb58060aab7623 to %PROGRAMDATA%\package cache\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\packages\vcruntimeminimum_x86\cab1.cab
- from %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\vcruntimeadditional_x86 to %PROGRAMDATA%\package cache\.unverified\vcruntimeadditional_x86
- from %PROGRAMDATA%\package cache\.unverified\vcruntimeadditional_x86 to %PROGRAMDATA%\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi
- from %WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\cabb3e1576d1fefbb979e13b1a5379e0b16 to %PROGRAMDATA%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16
- from %PROGRAMDATA%\package cache\.unverified\cabb3e1576d1fefbb979e13b1a5379e0b16 to %PROGRAMDATA%\package cache\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\packages\vcruntimeadditional_x86\cab1.cab
- from C:\29152d5b795aeca2de6a\$dpx$.tmp\537a6d8945b01e45b988fb172d63691a.tmp to C:\29152d5b795aeca2de6a\wsusscan.cab
- from C:\29152d5b795aeca2de6a\$dpx$.tmp\53e90e74443cc34c9357cfbf3f5e7fae.tmp to C:\29152d5b795aeca2de6a\windows6.1-kb2999226-x64.cab
- from C:\29152d5b795aeca2de6a\$dpx$.tmp\29211ce5e792544589a78cf340e340f6.tmp to C:\29152d5b795aeca2de6a\windows6.1-kb2999226-x64-pkgproperties.txt
- from C:\29152d5b795aeca2de6a\$dpx$.tmp\9c2b76af92e710458f88d5747097c4b8.tmp to C:\29152d5b795aeca2de6a\windows6.1-kb2999226-x64.xml
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- DNS ASK ak#.ms
- DNS ASK download.visualstudio.microsoft.com
- DNS ASK microsoft.com
- ClassName: 'MPWClass' WindowName: ''
- '%TEMP%\vc_redist.x86.exe' /install /quiet /norestart
- '%WINDIR%\temp\{f77653ee-bbd4-42d7-a00c-972fef7ddb83}\.cr\vc_redist.x86.exe' -burn.clean.room="%TEMP%\vc_redist.x86.exe" -burn.filehandle.attached=192 -burn.filehandle.self=200 /install /quiet /norestart
- '%WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{7B40FA1A-BD35-45F0-9E7B-1BA7674ABC73} {B1461933-BF8C-46A0-828A-8D26169F1C77} 816
- '%WINDIR%\temp\{c0266c1a-0984-4754-915d-a8cdc1dd2a62}\.be\vc_redist.x86.exe' -q -burn.elevated BurnPipe.{7B40FA1A-BD35-45F0-9E7B-1BA7674ABC73} {B1461933-BF8C-46A0-828A-8D26169F1C77} 816' (with hidden window)
- '<SYSTEM32>\wusa.exe' "%PROGRAMDATA%\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu" /quiet /norestart
- '%WINDIR%\syswow64\dxdiag.exe' /t %APPDATA%\dxdiag.txt