7c9a6e3486e9ecf4fbca5229130f2389919fda47dcb3899fc16c9c9454ddfea4

Resubmissions

09-10-2024 08:55

241009-kvh32a1ell 7

09-10-2024 08:50

241009-kr3y2avfka 7

09-10-2024 08:44

241009-knc87svarc 7

Analysis

max time kernel
95s
max time network
80s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09-10-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe
Size

45.3MB
MD5

830ce929f8cb966e2f98111e5d56f7e7
SHA1

c4c9a979e2292293c6d66220456db483109a3a80
SHA256

7c9a6e3486e9ecf4fbca5229130f2389919fda47dcb3899fc16c9c9454ddfea4
SHA512

4e87e2cf14c7a2fb2f88b0d8a949ad8da8e3f03763dd50c0ac6f91851f715a3d6514a97eea3a4a6ec2cf3531b9cc76994f9ebfcadc13b6ff9d3833cefec208d3
SSDEEP

786432:nXa8wIXEZ+9pac8hSlZn/y3a+Q8cho46sFpSsCK9Ew7M22nM7dJ6PrXu1w:KUpa5ST/yK+l4r6MEZ22nMkXu1w

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
1852	vcredist_x86.exe
2024	vcredist_x86.exe
2236	VC_redist.x86.exe
2408	vcredist_x64.exe
4164	vcredist_x64.exe
2680	VC_redist.x64.exe
380	J1979Tester.exe

Loads dropped DLL 5 IoCs

pid	Process
2024	vcredist_x86.exe
4164	vcredist_x64.exe
380	J1979Tester.exe
380	J1979Tester.exe
380	J1979Tester.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2aaf1df0-eb13-4099-9992-962bb4e596d1} = "\"C:\\ProgramData\\Package Cache\\{2aaf1df0-eb13-4099-9992-962bb4e596d1}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
15	4952	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in System32 directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
380	J1979Tester.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-73F19.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-FJVNB.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-0H43K.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-AI2KE.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File opened for modification	C:\Program Files (x86)\GODIAG\J1979Tester\CChartu.dll	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\is-5BNUA.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\is-P8LOH.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-OK25B.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-FRB7J.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-VTDHB.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-G3GB4.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-0JQMI.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-EMDD1.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-72HUJ.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-B4E9R.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-R5CSR.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-CF8SJ.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-2AVPO.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-H9N3B.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-JO0TK.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-9N21V.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-4KQ7K.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-KBA7M.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-MAPN2.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-CR61Q.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-T22E6.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-8S2NB.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-S685F.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-9FJHS.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-U6ODE.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File opened for modification	C:\Program Files (x86)\GODIAG\J1979Tester\uranus_p1.dll	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\is-8SRC4.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-6AU4N.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-MNKCG.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-U2UEQ.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-02EVQ.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-AN57K.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-I3S97.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\is-EMF3I.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-D2PL8.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-HNJDK.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-K9F2F.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-PGQ8E.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-U4QDE.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-A7DJN.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-7L92A.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\is-TRJ9G.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-B5EOI.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-3LHVT.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-JQE8V.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File opened for modification	C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\GODIAG_PT32.dll	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-K9BSU.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-9SMHC.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-SHLLB.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-LELBN.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-GJ4OQ.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-K7NSU.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File opened for modification	C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x86.exe	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-A3EVT.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-2UH16.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-QNKTH.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File opened for modification	C:\Program Files (x86)\GODIAG\unins000.dat	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-K8R1O.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
File created	C:\Program Files (x86)\GODIAG\J1979Tester\resource\is-O7GMG.tmp	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58365d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58365d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A181A302-3F6D-4BAD-97A8-A426A6499D78}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39AB.tmp	msiexec.exe
File created	C:\Windows\Installer\e58366f.msi	msiexec.exe
File created	C:\Windows\Installer\e583670.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e583670.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3851.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4136	4164	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J1979Tester.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\203A181AD6F3DAB4798A4A626A94D987	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A181A302-3F6D-4BAD-97A8-A426A6499D78}v14.31.31103\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\PackageCode = "09139770F15A2384695CFEF667B84B3C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A181A302-3F6D-4BAD-97A8-A426A6499D78}v14.31.31103\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\VC_Runtime_Minimum	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Version = "236943743"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.31.31103"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.31.31103"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\ = "{2aaf1df0-eb13-4099-9992-962bb4e596d1}"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Version = "14.31.31103.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{A181A302-3F6D-4BAD-97A8-A426A6499D78}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\Provider	msiexec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
4952	msiexec.exe
380	J1979Tester.exe
380	J1979Tester.exe
380	J1979Tester.exe
380	J1979Tester.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2100	vssvc.exe
Token: SeRestorePrivilege	2100	vssvc.exe
Token: SeAuditPrivilege	2100	vssvc.exe
Token: SeShutdownPrivilege	2680	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2680	VC_redist.x64.exe
Token: SeSecurityPrivilege	4952	msiexec.exe
Token: SeCreateTokenPrivilege	2680	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2680	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2680	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2680	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2680	VC_redist.x64.exe
Token: SeTcbPrivilege	2680	VC_redist.x64.exe
Token: SeSecurityPrivilege	2680	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2680	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2680	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2680	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2680	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2680	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2680	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2680	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2680	VC_redist.x64.exe
Token: SeBackupPrivilege	2680	VC_redist.x64.exe
Token: SeRestorePrivilege	2680	VC_redist.x64.exe
Token: SeShutdownPrivilege	2680	VC_redist.x64.exe
Token: SeDebugPrivilege	2680	VC_redist.x64.exe
Token: SeAuditPrivilege	2680	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2680	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2680	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2680	VC_redist.x64.exe
Token: SeUndockPrivilege	2680	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2680	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2680	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2680	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2680	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2680	VC_redist.x64.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4320	3940	GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe	73
PID 3940 wrote to memory of 4320	3940	GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe	73
PID 3940 wrote to memory of 4320	3940	GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe	73
PID 4320 wrote to memory of 1852	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	74
PID 4320 wrote to memory of 1852	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	74
PID 4320 wrote to memory of 1852	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	74
PID 1852 wrote to memory of 2024	1852	vcredist_x86.exe	76
PID 1852 wrote to memory of 2024	1852	vcredist_x86.exe	76
PID 1852 wrote to memory of 2024	1852	vcredist_x86.exe	76
PID 2024 wrote to memory of 2236	2024	vcredist_x86.exe	77
PID 2024 wrote to memory of 2236	2024	vcredist_x86.exe	77
PID 2024 wrote to memory of 2236	2024	vcredist_x86.exe	77
PID 4320 wrote to memory of 2408	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	85
PID 4320 wrote to memory of 2408	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	85
PID 4320 wrote to memory of 2408	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	85
PID 2408 wrote to memory of 4164	2408	vcredist_x64.exe	86
PID 2408 wrote to memory of 4164	2408	vcredist_x64.exe	86
PID 2408 wrote to memory of 4164	2408	vcredist_x64.exe	86
PID 4164 wrote to memory of 2680	4164	vcredist_x64.exe	87
PID 4164 wrote to memory of 2680	4164	vcredist_x64.exe	87
PID 4164 wrote to memory of 2680	4164	vcredist_x64.exe	87
PID 4320 wrote to memory of 380	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	92
PID 4320 wrote to memory of 380	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	92
PID 4320 wrote to memory of 380	4320	GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp	92

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe
"C:\Users\Admin\AppData\Local\Temp\GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\is-H892E.tmp\GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H892E.tmp\GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp" /SL5="$501F0,46699292,832512,C:\Users\Admin\AppData\Local\Temp\GODIAG_J1979TesterSetup_vc_x86_2v1(1).exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x86.exe
    "C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x86.exe" /q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\Temp\{40EA6EF8-CBD4-4B82-8110-BD33BACEB336}\.cr\vcredist_x86.exe
      "C:\Windows\Temp\{40EA6EF8-CBD4-4B82-8110-BD33BACEB336}\.cr\vcredist_x86.exe" -burn.clean.room="C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=540 /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2024
    - - C:\Windows\Temp\{9D74F689-EC2C-401F-86DF-CAB4BB182E8F}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{9D74F689-EC2C-401F-86DF-CAB4BB182E8F}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B2DD06BA-F81C-4A8E-825E-3CAC7E32B382} {7E90F114-CFF0-46D2-B949-536158BD29CB} 2024
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2236
- - C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x64.exe
    "C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x64.exe" /q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\Temp\{362CCB65-FF89-485F-8B5F-CDE0EE57AB1B}\.cr\vcredist_x64.exe
      "C:\Windows\Temp\{362CCB65-FF89-485F-8B5F-CDE0EE57AB1B}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Windows\Temp\{618340F3-7DA9-45DA-AD1E-A1463DD9E6E9}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{618340F3-7DA9-45DA-AD1E-A1463DD9E6E9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{79B8C57B-1E30-4ECA-BB54-FBC04B9D9322} {8F2AD9F3-CF88-48B5-916A-945F6557E89C} 4164
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1356
        5⤵
        Program crash
        
        PID:4136
- - C:\Program Files (x86)\GODIAG\J1979Tester\J1979Tester.exe
    "C:\Program Files (x86)\GODIAG\J1979Tester\J1979Tester.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4368

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:392

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e583662.rbs

Filesize
17KB

MD5
4e5c31a0dbe80708fdec0c30e61e8730

SHA1
d6ee6ee578f8afbdcfe9d8920683dd2dd453e332

SHA256
521221b07f2e7ebe14c37bdb0a31d211305c7ac47863f9d9ae66d09fbec0921e

SHA512
c215dd359e59cfb94e23026fdaa58a99f548f6a7d32aa5bb9c5cea800e9a876a09c47044bae29b370920fef0530ca19f1ad35dcc1225861134960a792afebd7a

Download Submit
C:\Config.Msi\e58366e.rbs

Filesize
16KB

MD5
f7f4c470d593864e59f71447f1239cd7

SHA1
ab4a00fed0c3c339bdabe0247bd46747e6457514

SHA256
83dd8019b58e651112f5905d2adfa70e224d96d83b4dc4d8d525f5453d1e84ea

SHA512
662085de02f2a1b73b35d98de97c0b1243431833500de3fdcc136e1002a13646dd20effe555a246b34490ee69acecff439932039f4ac18a6cb5106ed7526b63e

Download Submit
C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x64.exe

Filesize
24.1MB

MD5
4a85bfd44f09ef46679fafcb1bab627a

SHA1
7741a5cad238ce3e4ca7756058f2a67a57fee9d1

SHA256
37ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b

SHA512
600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98

Download Submit
C:\Program Files (x86)\GODIAG\GODIAG J2534 Driver\Patch\vcredist_x86.exe

Filesize
13.1MB

MD5
d3b594464f2312cde31af3f2aa516f9e

SHA1
15fe8e70c3c5582b70df173cd9b580331677735a

SHA256
b7ae307237f869e09f7413691a2cd1944357b5cee28049c0a0d3430b47bb3edc

SHA512
ccb19250b90eb629c35a897aba6d0ab16402305d9ec16b97b902fc810cde5d215cf8149a273cc8f8cae5a4b0665b116c085fe3b01a3ab3860c44f20ca95d6e83

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\CChartu.dll

Filesize
5.2MB

MD5
53f956cf25d7bef4659ef07a0006618e

SHA1
dba33b9fb32142fb4ab28af98f436486ac4aab5f

SHA256
4857146b4124e616636acfc2a1f4ff47c6f8e63fa2042e8400ee2c2538859261

SHA512
a3ffde890183d96036428f0f2bb8d37d07c4eb7ddc697bc6f3277b68115b70f97574ceb5f18c530a9678e6386975ef1d69c409e1f5c96a8b1b8326828f6f2cb1

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\DuiLib_u.dll

Filesize
561KB

MD5
cd97681b7b3d2cad116fd1cf0f2413a1

SHA1
c43df7b5ccc6fcf2e43fe1f125c2c4d9787e9389

SHA256
ce599439ef4714e8b41e6317d7be6e24c4000895ecc791068d4fb7cdd054a1d3

SHA512
adf4bb347ee49fa3ea0aa198f81f6cc873bd5553491ccf5636d71999feb00b4daf8c3c7e19d2cca733cff35492736414a71ef05b0756cc294a1c3f52a3b48129

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\J1979Tester.exe

Filesize
486KB

MD5
601065bcd46ab8819493f18bbdac64bd

SHA1
976be08de842235253591ca48b96887bb3276831

SHA256
fbdf92f15fa3d9ef04c670f184fcfe694c2e5c46fb4c2b217b3110e313d998f2

SHA512
782e24a06c7483cc951219db858869706228bf37c048e259252ee3ea95524bae477fa08d05a7fddce55f5db8a7dcda19995585ff039a591a221f817fd8cb0d47

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\Connect_button.png

Filesize
18KB

MD5
2fbefc1678d3f7325f541fa8e04f09c2

SHA1
70c92c10fa02b40c7059dd380c9b0b035429219a

SHA256
5b1e0f863b308e64c018934de0ce2478678d193f1ce6db45acb323f6fb873dd7

SHA512
d0e162b74cc2d2a78a4a9477553b12a6cda8a15905bfbba6066108a51310c91237e3c87007738822d0dadc1eb393b69c4b4df1fac681036c9403a1e748bc0959

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\Disconnect_button.png

Filesize
18KB

MD5
53b896bf8fcad7c8fe6373583abb2df6

SHA1
85d46433379d23ff66dd01dd503b0727e76b2d9d

SHA256
23ebaa63e40ce214c0f922180ebfb2a243951e06f3a835406aa78330d579f856

SHA512
6be8aa1a9da1be3c73b2fa20b1c5fca5faef2e84c03dcc56453ba5aae02b5bc4b9837b12fd2c7dfe1c483ce1cb3b6b60f9ff910ab6d35bef217003b75c91b6ca

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\basic_info.xml

Filesize
1KB

MD5
d456fd4fe1b19bc9a1eef3cd56cf882a

SHA1
ac17af0ee474c849e36cfe29b3afa92138e8e498

SHA256
d07e960eecea1b4306bccff510b6fda3827735dbd25ff03c93c25c690fb50ba8

SHA512
911fa1592ff31185a482fd42be6df6e7404c3e4470145370ace78753028de677f53db5345175114300a413d47bdc2c3813b65d8a67715e640d9434b7e3b5d227

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\cloud.png

Filesize
3KB

MD5
1e111562215edb1a2f078a061154b8f6

SHA1
7853f8d627e45d98c63fc4c87562fef5f1ee74e7

SHA256
9fc023d7a8f23fc5a5ed1f4ad09e634fc8dc91ceb1d5e762fb55f4fea7b7f6eb

SHA512
a0c8c2439498dfbdf826d40d3faf4167c0962227064a9ae7bad1e40a070ac1ba6589be7fc8dc914582d7c2d271ad3798be17d65dfa174ed6132b6921dc27b88a

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\commmon.png

Filesize
2KB

MD5
7f372b76b4ab45eb4d03f4553760d83b

SHA1
a144192a809c24607d50449c93b62ad5a3a594ab

SHA256
516773e747d13448e34ed52368f104f7cb1d701c1984d1071a0e25417890e0fb

SHA512
99fa80e0ee0014c70a1097a7f9cabbfc8e2e26f3a3aa69a3bebc435a11b71401bdbcc5901153bb1c9a74bf689889f7c3b31a4f1559c36536875fb08e3224161e

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\dtc_info.xml

Filesize
965B

MD5
6b09f452184aa8a8f40e3f6ea75a0aa6

SHA1
c197d8dd3f7db682fe3ff18ecd6c079ef687178c

SHA256
ddec07afec2f0af0e4b3e4dd302c3dd197c6316a40b50ff2c3f8e0b892852048

SHA512
721fa8367ee8a9941c58badb007c43e1b8dacd3c4c6b6426c3a96386ddb204e5805ebf9fc374c90214ce044a3de052ea0fee4131d64c48274b2ed6ad0d2f9092

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\firewall.png

Filesize
2KB

MD5
a130b6b25065c602ed59ef4fa23e0599

SHA1
c591e35171827c7033d328ac5a5b8e034b102aaa

SHA256
a18e8f5ed5748a07a008780afa26ac12486fbb1a65bb55c348252bcfa1e7ff78

SHA512
1e12f637ea41f05635b99a7051f04f538bd4b805f462a09e3bbbc4b197789317594d58d7c9c3ba24e54c890f1ff123a064595aadb95e57a9c5f008fd1a48ec7b

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\horizontal_border.bmp

Filesize
792B

MD5
43ecddf4394d0c053f06483a1821c399

SHA1
00d1b4f666d33d1e95a4177c786720b56a086164

SHA256
b2a5123a1272bfa72e514ed758bbd3dc47d9442faded976f392fb2d61ad3db81

SHA512
a3d9a7995f418ca83d37f8b89b4b558dfe8beef084e8a6e964f1ae77fbc47c87a75b20944bf6a1e7b7abeeb1b3174f80c9214fc187bad9401c28523586e2d69f

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\icon.png

Filesize
3KB

MD5
0360e02a8b05dbf4c186447e2ea2a4e5

SHA1
09069cc230468d745e46d04c4b1e868b80c3534d

SHA256
a9951f0bd4c8805e5add70a4c65041a8d346ed4bc033fe4ed9146ed50b1db2a3

SHA512
cb0bab122d6179c2c6834f4b65efbe970489175c0607f9d98b87fc7992b74da1b3a4071eb486101657ecf3c970e6c8fc4b9957ba86bc3b8f668a69822a137e79

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\list_header_bg.png

Filesize
12KB

MD5
9f89397af5c39aff4536b9efeb09ed68

SHA1
6130c98ebc188602e1104b7faca4ee4ad3f2918c

SHA256
6827a224d1551e5d1f5a1646ca9b6cbc83028291f18ed78a15f49cc098db5062

SHA512
9fb5022835d91db5cc745038c1c1e890b48fed0e86804ab2f6920a8c962b94e59e4470918c9523c189d8db93a840d8cf3c64d8d01a5e8601a7a80ef14faf11b0

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\list_header_sep.png

Filesize
12KB

MD5
ac2057afb31b2727f74e8561c6eda132

SHA1
f81618c1bafb3a03879422da5408307e3e6c55da

SHA256
4c02e981bf55866b41383aa9b41a1c78965333336e103f2934a4d06dc4ac5b42

SHA512
5036e1805adb08f261a3044d267b4085b683706df1b757d2abaec135051aee3fa630dbb7143d4449e674903d20a952494fdba3226e8a58c401ed313ad8021338

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\logo_godiag.png

Filesize
7KB

MD5
9e95dcad21866410756de33322404425

SHA1
9d5fbfbc741130e62bff9dd64444622d9b549908

SHA256
005cd132031fbf823f370b999a19771405b6e83ba82f695a2faa84c473ea27d0

SHA512
d93c367f376e99ff085536588cdff9d11900573d73066b6932348a5028166a41ff210f041f29bdaef290f5087e1a36a1bf165baa6232fcf0426ac3cd617a94db

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\messages.xml

Filesize
106KB

MD5
cf80d95abde8b172f21eb051e1aa284c

SHA1
015a189f584ce5bd94c26a00155e2562761d244c

SHA256
a1150eda7b43f21c83522e6efd338cfc7f92054023e1da6e762294e30792fd50

SHA512
05f6a1bdd5c58d31299896d2012ed43facd3be87f900fa3fdb5559f9d4a2d4e8af69301ec920822f6fd892db6cf1923b32377e41c8b3b2cde928ac1f00228416

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\networkshield.png

Filesize
1KB

MD5
6192d138a1d9e8355e9a053ab01e16cf

SHA1
835f49289ade35bedb5df332bfbf2f2cb43558fc

SHA256
d8a512f36b19f27b15ff0945fe4b3a9720383c613fcdaa9c6b0208876b44ce1a

SHA512
09bcfb55c917ca03b6d1c71f0c6047b97a8133394f67715d7a1409988481f28778f4e224f4a22508fe6c963d1ac3b50f14e02401a04163f7aca615d95249b976

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\obd2_dtc.xml

Filesize
24.2MB

MD5
c3bba2604d61016deaf0bff0d34cc8a1

SHA1
e0f96c36844323597f683941a12861b72530f500

SHA256
df54929ea64ef9d4ecda03d5637696c9d80af5ce06b26ea4f061e7ebf1efca0f

SHA512
83b87d4f1b0838a52d97e96ff8b4a92fb52734e71325ac101cbc600a45073d530dea0e324ba0f649a84802dacab05df526ca8aa08cf3d600d5b48f5ca94416fd

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\obd2_param.xml

Filesize
4.6MB

MD5
01329251f01243875e84e0b39a3cd6f3

SHA1
1df59bac788d51a4378c0dd03c702e78b7a82fb6

SHA256
3c91ef3171b556fb5535ccd080f95b65cd66e172f27efd70adb65ea5c0fb1213

SHA512
2f4fb05da6d31d735a13ae56839278987bf03abc0380eb2965e16189f2c0de13d0342eb54336a3cd554d9f50fe10efffe84d065b40fcd232b8206a7f31d101c1

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\preventnumber.png

Filesize
1KB

MD5
d5bf741efe0848994304c5948a8ce460

SHA1
740d80a2f42a8424119ef31234fd013da95269d2

SHA256
4cc576fc3642e4546c495066acfd583874b1a14b61ab4c543cecb4a34622c7db

SHA512
9241f450ea73ac886b76f9d4ac6e2bef94c3a0ece0bf95876a466e65a92263397004dad55890f1f3419e7564728a4cb1a32565cf898289a8ef1a45420d195b3b

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\skin_godiag.xml

Filesize
8KB

MD5
60dc2789d564b85c69341f0068d26f0b

SHA1
acbac55546b0d81ee1a727a0f07a600f188a7d99

SHA256
746aeffa22b658ecbd1b88dd47a57b1640b20e6721fad7d7b19790cc46c045be

SHA512
da6c0cc827a9af01565df6b8eb65b7e6f5eb96a17530de66fa523a3fd4d564afb34fbee0dc022bce3b31d004761610244bc5ad58ff6ac35108331bb8e36d9801

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\sys_dlg_close.png

Filesize
4KB

MD5
343ba1e491962af20bf695eba1aad514

SHA1
4789d130e8de2cbc8e2c53921ad84e62acaef96b

SHA256
ee3e5508b33ac6cc1f166055554b4db375e65f1a34a8f17cb18bad714980243a

SHA512
ecf29268fddaad1740b2444af3b9b94d62fe730f2efc74aa421b79530b4a2f2e5073f7f45a448ba657d5e0ccc1fff5799d6cce9d94b2f3ab2ff216d989e2e1aa

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\sys_dlg_menu.png

Filesize
3KB

MD5
0d231a7fe768f2c7d61789588105bf83

SHA1
b0309457d684e62aea2e57ce604bfc68a725d65b

SHA256
deed3e88853438717409e7a468a48201efb5c9288f25a53ddbf350514864af63

SHA512
a2339a6f9958964c8cf39037a1377ba13e1d3f8e49a6e98c398aae868092181757b99384c53116fea28675173db2e922e15dfe8e71ca4e40e66c38cea199b5d7

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\sys_dlg_min.png

Filesize
3KB

MD5
b7ce98114634f489875948f289acabf1

SHA1
011df2e974f1b41f10c7a706611fbcc1111d87ac

SHA256
bf5265f42be008cb6d5714fcffa194c3618259b0a9f7cfd7477131afe9ccf251

SHA512
6fcdda15f02e6687cf767933248b60d146be756a2a7605bb3baaf07c48d216935544a001c9d546327b781aec95cbf8e712ef2d3e7a7e9a367f681df5c9129ba6

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\tabbar_normal.png

Filesize
4KB

MD5
44933d9a77f71120ad4a9d1f2451f966

SHA1
52d81d95f6a5eaa8e1a99e3ab247a39db4ef79e7

SHA256
10a31e358e7f91cd480efa0a73e02990016499d7fbbf7db07107dc6d699e3987

SHA512
5f99ed2e18dfaa8ccaf152ae83882fe6962f0893d851ba06c40233f05eb00cd93c21ede3b1b7a283ba1ba78d3fbbe3dd736ff5ad112cc6c1bde284fe5d6c30b9

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\tabbar_pushed.png

Filesize
4KB

MD5
0c6c434482fa994627a590495fbc615b

SHA1
c8918bca4632ad054caf1d8e1fffeae0501602fe

SHA256
fac3e5dd3fc308372d49e15df37f003264b964dcbc5f5fbd829c8170c0915a39

SHA512
624d042abaffe778adc882690c2aa04d7ee64aa0d5bc51b8e7af81f3f77891003ffc60de077f0b295d52d9fb0527fb833efaadbd7765903d6e36df8ee13d4248

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\toolbar_normal.png

Filesize
2KB

MD5
31d9e60c03c8059b80c0b63d271d9c4f

SHA1
f0ee4322559f982b08f9d0ef378074335bb74bad

SHA256
c3f229825b6943a242e277b7afdce82c0e4b6c1ebf99797b103b5e832bb1b9e4

SHA512
19371e21fad7d1b03bfcd7f8adad8faa9d91e537f0dc82e9f3c03b17b68e1813a55a1af4b5186b71b174cb81d1cddbbbb33f27bfaf175b69d3a7d0eccd0c856e

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\toolbar_pushed.png

Filesize
4KB

MD5
6669c90541bdc5454834e7fab8b252ca

SHA1
265c2ab10d83feaf313ac3d025edf976a10c207f

SHA256
0785764cb13c122e50beb10716fee7cd99183e61d5658f9d323ab53c3ba6e10d

SHA512
204478297c8bbc2a5940c5ce0c08a862b69622c81e9c9e8df18e3401016c796a604b5136ec3a1c96fcf9b29661e4e76af14e87dde1a4b3bcd475fbd631b271f6

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\resource\vehicle_information.xml

Filesize
5KB

MD5
eb6f764c36010d8c637aa7535ffd0249

SHA1
d2e30638211db9a0256f5b214a7152227ccc0c7b

SHA256
9a1dd03db35b5855a3f20acbef90c8bec54f18f71d5b9045167161d0e0420a1c

SHA512
b6009aa3dd7b1f16814dbe8fb822462c778d0787ba0d17a56ff93edd693ce0164ef5d698926e2b76f3159cdab4fd91ff8ec94f22251beb01031910b1b8bbfbe5

Download Submit
C:\Program Files (x86)\GODIAG\J1979Tester\setting.ini

Filesize
152B

MD5
3dd8d224cba94b0478aa756a74282400

SHA1
a47cd9d6ec05f8bab5a74c45f17ebca68460e5d3

SHA256
24578a6a8a415e95dff766f6c75a3395492b1986e8fb2c45558c4ee47a850296

SHA512
f27e863357eb6950117595bfc54fdaaa7214c5bfe491fb5f8753a9205bddef06cae2e3bcf3be9cbb8f5d8335c7df28e4502e9ca8f3f403d1014b7851b9e3dd10

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20241009085223_000_vcRuntimeMinimum_x64.log

Filesize
2KB

MD5
8830f7766d73fe8cf9a10dc2944f7f1d

SHA1
b6bd0e5305d64d6366e53df81cb37ae69bc836ad

SHA256
af6b0eec904801034a9379af903ce538b682f7c1b2f4314cb5ec749b48a49157

SHA512
e3bc6ba6a913b50471d6de97b69d0f655bffad97708e1533448d5b1397216d6c408935059a8dd96b400b18f8ebc38bafa7f5ec966de43ada95051a5ae35cc3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20241009085223_001_vcRuntimeAdditional_x64.log

Filesize
2KB

MD5
3d2b062f80422c46c0f94158dc15682d

SHA1
e329daa632794d754d6979c3b9dc59497f351725

SHA256
ea979a88624e154fff76c76723a525433f4da40292131b751bef8a32502c7859

SHA512
8e6612d8eba11694030fe7d40331391967c17cfe16d9cfba59994a615114a496054c23dac1bd789755e36c560d54238211d6dad87bcbb86e5b2f9ac229160ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H892E.tmp\GODIAG_J1979TesterSetup_vc_x86_2v1(1).tmp

Filesize
3.0MB

MD5
b7324c3483e923456fbbfab84a453b89

SHA1
740af0bff1684fad8dff9802f8167af690929dee

SHA256
643a942b5303d6b47f64201b60d258634d5b6d6a105edfede31accb4fed38dd4

SHA512
5fa501015e1721ce0166c7bd7be314fb763f0c9f223317aa89aa4fd74f9b725efa82d7a54d70be5b6fd4b4e3f0ad3569c4038fad4ce60ac026e857b75b4403e1

Download Submit
C:\Windows\Temp\{362CCB65-FF89-485F-8B5F-CDE0EE57AB1B}\.cr\vcredist_x64.exe

Filesize
635KB

MD5
9bd591625766a7330708b2c6380dc1d7

SHA1
18018a3d12278187a8dc26eae538a799511bbdfc

SHA256
21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

SHA512
58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

Download Submit
C:\Windows\Temp\{40EA6EF8-CBD4-4B82-8110-BD33BACEB336}\.cr\vcredist_x86.exe

Filesize
634KB

MD5
0082d66b4bd5a3f6254dd749fe372cb6

SHA1
9c06222e24276ba02a05767eed04cacdf00e54cf

SHA256
c78b97480214fd42f989eb3b2da72e325e1f6855adb7d4660deeca6ca63d5025

SHA512
727d329dba144ad58996f16de6c1272899fba6a4fa0fbfa7b14454d84ec250e0efe709a46249bcf486f61907aa08fd1c13aa447c7e773030dbff96c08f859f6a

Download Submit
C:\Windows\Temp\{618340F3-7DA9-45DA-AD1E-A1463DD9E6E9}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

Filesize
5.4MB

MD5
6ce5097b19cf57527651840bb438adf3

SHA1
49d0b725e5819a076562fd007490eca0bbb69003

SHA256
f24a3bc5df7e7c07c0d13f46348c989eae7f597f428b20cc9044bba47785b7f0

SHA512
9152301c4f87018d166b624d73919fc2da7e7ef74b2c1ecf8ad01c31c2b2239013cc3bc22237c81940ae96a5fd1b3698d260c3d3e0a9d0318cdc053e28328d83

Download Submit
C:\Windows\Temp\{618340F3-7DA9-45DA-AD1E-A1463DD9E6E9}\cab5046A8AB272BF37297BB7928664C9503

Filesize
879KB

MD5
8e288dd0b5e0468ed8ae01ee566e77e8

SHA1
fbd11237ae3300a2202444d339601d1ac6bbf310

SHA256
c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1

SHA512
facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04

Download Submit
C:\Windows\Temp\{618340F3-7DA9-45DA-AD1E-A1463DD9E6E9}\vcRuntimeAdditional_x64

Filesize
180KB

MD5
e6df9f55e20905f77b136844a3844dd6

SHA1
b7c1fb12bda508a62fdd9ffa9e870cae50605aaa

SHA256
f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0

SHA512
7c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713

Download Submit
C:\Windows\Temp\{618340F3-7DA9-45DA-AD1E-A1463DD9E6E9}\vcRuntimeMinimum_x64

Filesize
180KB

MD5
143a2b9f1c0ebc3421b52e9adcb4db2e

SHA1
06e01b8cc855fd9a31f99b430f8c8745e706c677

SHA256
5d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954

SHA512
7e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05

Download Submit
C:\Windows\Temp\{9D74F689-EC2C-401F-86DF-CAB4BB182E8F}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
\Program Files (x86)\GODIAG\GODIAG J2534 Driver\GODIAG_PT32.dll

Filesize
5.9MB

MD5
37892e4a919d7c4c3635d5f450cbeb7d

SHA1
5c6fe031f79ab5217daaaf470c5cd9de14661192

SHA256
823853e4c5080b1fc69dbcf228ceefa68752ce782e9f373927edeb9e15722f12

SHA512
7ea9c9aaaf2374363f7cd659e91c574fe671c628905de701fe180331d2c2b9970e9ba08645707cea8c13f202e366ead4679234ce003df8fb22ebd4122dc09f2a

Download Submit
\Windows\Temp\{9D74F689-EC2C-401F-86DF-CAB4BB182E8F}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/380-446-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/380-447-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/380-449-0x00000000719C0000-0x000000007236D000-memory.dmp

Filesize
9.7MB

Download
memory/3940-8-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3940-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3940-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/3940-454-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4320-315-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4320-14-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4320-12-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4320-10-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4320-207-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4320-6-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/4320-453-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download