Analysis
- max time kernel
151s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 12:34
General
- Target Install_Waves_Central.exe
- Size 173.8MB
- Sample260722-pr49ba1ycs
- SHA256 91c1ced9a6d3d1f04ce3968d2c686b1f214164da096aa42765532503d42e10ad
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 16 IoCs
- Loads dropped DLL 18 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 11 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install_Waves_Central.exe"C:\Users\Admin\AppData\Local\Temp\Install_Waves_Central.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2005\vcredist_x86_2005.sp1.MFC.exe"resources\res\external\Redistributables\2005\vcredist_x86_2005.sp1.MFC.exe" /q2⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi3⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2008\vcredist_x86_2008_sp1.exe"resources\res\external\Redistributables\2008\vcredist_x86_2008_sp1.exe" /q2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\f:\e9e6ff5e76b0027e5afd\install.exef:\e9e6ff5e76b0027e5afd\.\install.exe /q3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2012\vcredist_x86_2012.exe"resources\res\external\Redistributables\2012\vcredist_x86_2012.exe" /repair /q /norestart2⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2012\vcredist_x86_2012.exe"C:\Program Files\Waves Central\resources\res\external\Redistributables\2012\vcredist_x86_2012.exe" /repair /q /norestart -burn.unelevated BurnPipe.{3468E7D9-113C-46A3-9E8A-E3FCD3D3384A} {B4EFD3A4-40D6-4F1B-A082-1C31C4EDB3F6} 41083⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 11644⤵
- Program crash
-
-
-
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2012\vcredist_x64_2012.exe"resources\res\external\Redistributables\2012\vcredist_x64_2012.exe" /repair /q /norestart2⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2012\vcredist_x64_2012.exe"C:\Program Files\Waves Central\resources\res\external\Redistributables\2012\vcredist_x64_2012.exe" /repair /q /norestart -burn.unelevated BurnPipe.{04FEDED8-A75D-487B-B86B-F0E046F5956B} {248270D3-3454-4AB8-AD53-C7989ABD814C} 60003⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 9924⤵
- Program crash
-
-
-
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2013\vcredist_x64_2013.exe"resources\res\external\Redistributables\2013\vcredist_x64_2013.exe" /repair /q /norestart2⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2013\vcredist_x64_2013.exe"C:\Program Files\Waves Central\resources\res\external\Redistributables\2013\vcredist_x64_2013.exe" /repair /q /norestart -burn.unelevated BurnPipe.{7304E51F-BB31-4E79-B63D-7C85663CCF24} {D6DC85F1-A0C1-41ED-9CE3-3DCFF18FC294} 50163⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2015andUp\VC_redist.x86.exe"resources\res\external\Redistributables\2015andUp\VC_redist.x86.exe" /repair /q /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{095DB0D5-CEF6-4249-80E3-696B95511CC7}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{095DB0D5-CEF6-4249-80E3-696B95511CC7}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Program Files\Waves Central\resources\res\external\Redistributables\2015andUp\VC_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=556 /repair /q /norestart3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Waves Central\resources\res\external\Redistributables\2015andUp\VC_redist.x64.exe"resources\res\external\Redistributables\2015andUp\VC_redist.x64.exe" /repair /q /norestart2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{C75EC3C9-F2F8-41E4-A971-4F844BCEF56C}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{C75EC3C9-F2F8-41E4-A971-4F844BCEF56C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Waves Central\resources\res\external\Redistributables\2015andUp\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /repair /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CC6878B517ABCE31641B343FEEE19DD22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored /burn.runonce1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored -burn.unelevated BurnPipe.{EB61D1BA-AF99-424F-8E64-131B884DDAB1} {0B7B2892-8691-44BD-8167-FFA87E94E8D7} 21283⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 252 -p 1852 -ip 18521⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log" /repair /quiet /norestart ignored /burn.runonce1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored -burn.unelevated BurnPipe.{83EEF0ED-C6F5-4EEE-8907-90D6B9CC96F9} {9F776864-4988-4034-BE1B-80B9CDAAD335} 18123⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4596 -ip 45961⤵
-
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe"C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe" -burn.unelevated BurnPipe.{FE216CEA-EE64-4DFE-8DEF-E031E5954453} {82437F34-32D8-4D3A-859B-8BF465ABFCC0} 48683⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 10004⤵
- Program crash
-
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored -burn.unelevated BurnPipe.{1B8A0C8E-0048-4E34-9FAD-A6DF72963E47} {2768AB49-D2DD-45EC-A2C5-1DCDC71D9238} 58723⤵
-
-
-
C:\Program Files\Waves Central\Waves Central.exe"C:\Program Files\Waves Central\Waves Central.exe"1⤵
-
C:\Program Files\Waves Central\Waves Central.exe"C:\Program Files\Waves Central\Waves Central.exe" --type=gpu-process --field-trial-handle=1580,4229145219870432485,15495483672112049866,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Waves Central" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 /prefetch:22⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where powershell.exe"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\where.exewhere powershell.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -command "&{'{0}.{1}' -f $PSVersionTable.PSVersion.Major, $PSVersionTable.PSVersion.Minor}""2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "&{'{0}.{1}' -f $PSVersionTable.PSVersion.Major, $PSVersionTable.PSVersion.Minor}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\Waves Central\Waves Central.exe"C:\Program Files\Waves Central\Waves Central.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,4229145219870432485,15495483672112049866,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Waves Central" --standard-schemes=central-internal --secure-schemes --bypasscsp-schemes --cors-schemes --fetch-schemes=central-internal --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1948 /prefetch:82⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session 2>nul"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\net.exenet session3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic logicaldisk where "DeviceID='C:'" get FreeSpace"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk where "DeviceID='C:'" get FreeSpace3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noLogo -noExit "Register-WMIEvent -Query 'SELECT * FROM Win32_DeviceChangeEvent WHERE (EventType = 2 OR EventType = 3) GROUP WITHIN 4' -Action { [System.Console]::WriteLine('Devices Changed') }"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Waves Central\Waves Central.exe"C:\Program Files\Waves Central\Waves Central.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Waves Central" --standard-schemes=central-internal --secure-schemes --bypasscsp-schemes --cors-schemes --fetch-schemes=central-internal --service-worker-schemes --streaming-schemes --app-path="C:\Program Files\Waves Central\resources\app.asar" --no-sandbox --no-zygote --touch-events=enabled --field-trial-handle=1580,4229145219870432485,15495483672112049866,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2504 /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\central-updater\pending\Waves Central Setup 16.7.2.exe"C:\Users\Admin\AppData\Local\central-updater\pending\Waves Central Setup 16.7.2.exe" --updated /S --force-run2⤵
-
C:\Users\Admin\AppData\Local\Temp\nsbB39E.tmp\old-uninstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsbB39E.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /allusers --keep-shortcuts --updated _?=C:\Program Files\Waves Central3⤵
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log" /repair /quiet /norestart ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored2⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored -burn.unelevated BurnPipe.{693489E6-8D3B-4503-A123-5B2EA711E5C8} {CD61A501-D72A-4FF7-BBA7-68814A2809BF} 27803⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 9804⤵
- Program crash
-
-
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored -burn.unelevated BurnPipe.{65C6BCA9-2A9F-48C2-8B3C-C9C958AF354D} {720F2426-A651-4BDC-835D-48A48BE7C253} 20883⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 9924⤵
- Program crash
-
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{9BA60C24-A968-4787-9D24-DECB399D6CC2} {8E3D8BF4-48CC-4C14-8CE5-4DD944DFD339} 21083⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 11764⤵
- Program crash
-
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log" /repair /quiet /norestart ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored -burn.unelevated BurnPipe.{2120012E-0867-4A80-A794-39F64929FA1C} {EDF4C929-D9F6-4A44-A9F8-49C4220C8274} 49003⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 8924⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2508 -ip 25081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3020 -ip 30201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1520 -ip 15201⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log" /repair /quiet /norestart ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{9D3A71D1-5528-4C7B-A9A5-A0BCA046EA14} {714D741F-99CD-4C23-AE14-5F60F2E9410F} 55403⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 12164⤵
- Program crash
-
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{976B5C2B-4ACC-430D-8944-FFD50FC4C88F} {8EC1821F-E056-4293-86E1-692D64C30CEF} 2043⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 9924⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3948 -ip 39481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3672 -ip 36721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 2648 -ip 26481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4980 -ip 49801⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log" /repair /quiet /norestart ignored ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D8056603-7F34-44DB-951C-D4C38D06A992} {40FF4564-B429-4672-9069-BC0B6E9F02A7} 61323⤵
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{EF76DBF8-FF7A-4AA3-8FA2-FC8F2C3811D8} {A444E0C0-3302-47B6-8FD2-6B06FA6F7C00} 38963⤵
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5B620829-B2DE-4F86-99E6-A29829F3DF63} {22730CE0-D7A8-4755-A3FB-11BD4807ADEE} 38003⤵
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260722140348.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D4D2443D-231B-4CA7-9059-AB54B40430DD} {F186BD8C-ECEC-4AC5-B797-527865D63582} 49603⤵
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log" /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored2⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260722140343.log /repair /quiet /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{06C18D25-B56A-4DA3-A151-53DE0D23BC1A} {C684A341-949D-4CCC-AE7E-F3E2FB0FCEA6} 14843⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a400f.rbs
e5a4013.rbs
e5a401a.rbs
e5a402d.rbs
e5a4036.rbs
e5a403d.rbs
e5a4050.rbs
e5a4057.rbs
e5a406a.rbs
e5a4071.rbs
e5a4084.rbs
e5a408b.rbs
e5a4092.rbs
e5a40a5.rbs
e5a40ac.rbs
e5a40b3.rbs
e5a40c6.rbs
e5a40d9.rbs
e5a40e0.rbs
e5a40f3.rbs
e5a40fa.rbs
e5a4101.rbs
vcredist_x86_2005.sp1.MFC.EXE
vcredist_x86_2008_sp1.exe
vcredist_x64_2012.exe
vcredist_x86_2012.exe
V13-online-common.yaml
state.rsm
state.rsm
state.rsm
vcredis1.cab
vcredist.msi
VWL9ED1.tmp
dd_vcredistMSI32F2.txt
dd_vcredist_x86_20260722140343.log
dd_vcredist_x86_20260722140343_0_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20260722140343_1_vcRuntimeAdditional_x86.log
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
hi.pak
hu.pak
id.pak
it.pak
ko.pak
mr.pak
nl.pak
sk.pak
sr.pak
resources.pak
vcredist_x64_2013.exe
V10-copy.yaml
V16-online-common.yaml
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
EmbedHTML.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
license.html
nsProcess.dll
nsis7z.dll
UAC.dll
wixstdba.dll
logo.png
wixstdba.dll
BootstrapperApplicationData.xml
vcredist_x86.exe
license.rtf
thm.wxl
thm.xml
BootstrapperApplicationData.xml
default.exc
data_0
data_2
data_3
Network Persistent State
Network Persistent State~RFe5bb0ce.TMP
CURRENT
MANIFEST-000001
b1d64198-a23e-4022-b552-c8f1fd7b971d.tmp
MSI4BB0.tmp
atl110.dll
mfc110.dll
mfc110chs.dll
mfc110cht.dll
mfc110deu.dll
mfc110enu.dll
mfc110esn.dll
mfc110fra.dll
mfc110ita.dll
mfc110jpn.dll
mfc110kor.dll
mfc110rus.dll
mfc110u.dll
mfcm110.dll
mfcm110u.dll
msvcp110.dll
msvcr110.dll
vcamp110.dll
vccorlib110.dll
vcomp110.dll
atl110.dll
mfc110.dll
mfc110chs.dll
mfc110cht.dll
mfc110deu.dll
mfc110enu.dll
mfc110esn.dll
mfc110fra.dll
mfc110ita.dll
mfc110jpn.dll
mfc110kor.dll
mfc110rus.dll
mfc110u.dll
mfcm110.dll
mfcm110u.dll
msvcp110.dll
msvcr110.dll
vcamp110.dll
vccorlib110.dll
vcomp110.dll
wixstdba.dll
install.exe
install.res.1033.dll
metadata-2
{238f5b48-1499-411d-a0b8-a67b7e100711}_OnDiskSnapshotProp
VC_RED.cab
eula.1028.txt
eula.1031.txt
eula.1033.txt
eula.1036.txt
eula.1040.txt
eula.1041.txt
eula.1042.txt
eula.1049.txt
eula.2052.txt
eula.3082.txt
globdata.ini
install.ini
install.res.1028.dll
install.res.1031.dll
install.res.1036.dll
install.res.1040.dll
install.res.1041.dll
install.res.1042.dll
install.res.1049.dll
install.res.2052.dll
install.res.3082.dll
vc_red.msi
vcredist.bmp
memory/3384-1434-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-2076-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-2218-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-1594-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-725-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-2675-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-4844-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-3718-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3384-482-0x000002416DC30000-0x000002416E5D4000-memory.dmp
memory/3556-1506-0x000001BCFF410000-0x000001BCFF458000-memory.dmp
memory/4616-1379-0x00000263F95A0000-0x00000263F95C2000-memory.dmp
memory/5552-1336-0x00007FFBEE090000-0x00007FFBEE091000-memory.dmp