409abac20f532fa40edb621a31baf3bad11675b55a7e2f9972aa02f31ec7a57b

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 13:17

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

UGEEWin_3.2.0.210804.exe
Size

23.5MB
MD5

b4cacf19c6ffff4c6eb568336869372e
SHA1

b938668629a78d373d850f7ffd555e5ebcb8c1d9
SHA256

3102d27a70c41f2e2abf9ca9465608ea5887857abc5bf5cacb7528ae90825c63
SHA512

436e6211ca9ab99a166f8ea20e657c77722c79873e28601e4385e692cb95ecd2fdc2f05e728e0f88d2f9e0d1881989a3c2e86e0fd3430270a69ab094150d9043
SSDEEP

393216:eAvWn7A7CaB6VvWRO4YbAvrA7CaESq4Ie1fvydH5Ua7e3W3e5XNmy+zxuaA67UnQ:47sRh7Y0vrsRESBIe1ydZUa7e35cVA69

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET5B4C.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET5B4C.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\vmulti.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET59E4.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET59E4.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\hidkmdf.sys	DrvInst.exe

Executes dropped EXE 4 IoCs

pid	Process
1228	UGEEWin_3.2.0.210804.tmp
1660	Listdlls.exe
1200	Listdlls64.exe
932	devcon.exe

Loads dropped DLL 12 IoCs

pid	Process
1764	UGEEWin_3.2.0.210804.exe
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp
1660	Listdlls.exe
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp
2016	Process not Found
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	UGEEWin_3.2.0.210804.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PenTablet = "C:\\Program Files\\Pentablet\\PenTablet.exe /mini"	UGEEWin_3.2.0.210804.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinTab32.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4E21.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	devcon.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4ED0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4EF0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_7c4a709680e8796d\vmulti.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\SysWOW64\is-JDR1F.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4ED0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4E21.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4E32.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4E52.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\WdfCoInstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\hidkmdf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_7c4a709680e8796d\vmulti.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\vmulti.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4E32.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\pentablethid.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4EF0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\system32\WinTab32.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\vmulti.sys	DrvInst.exe
File created	C:\Windows\system32\is-MEN8L.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Windows\System32\DriverStore\Temp\{648cf426-3349-2629-ecfa-b15628cf493f}\SET4E52.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Pentablet\PentabletUIService.exe	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\Qt5Gui.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qjpeg.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\Qt5Core.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-E8GBO.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-N0N0Q.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-S3KA6.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\platforms\is-HJ0MU.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-E7P6F.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-T16MR.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\Qt5Svg.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\msvcp100.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-QH535.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qwebp.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qtiff.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\unins000.dat	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-TV9MU.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-R0KMM.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-D9DF8.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-KJIVN.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qsvg.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\Qt5Widgets.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-ITNQQ.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\msvcr100.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\64\devcon.exe	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qicns.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\Qt5Xml.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-7Q6J4.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-NC75K.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\config\is-8AKI9.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-EU7J5.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\unins000.dat	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qgif.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\libSignBLE.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\64\DIFxCmd.exe	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-I93VG.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-PSV37.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-3BTTL.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\64\DIFxAPI.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\config\is-PSSSK.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-JHUAE.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qico.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qtga.dll	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\Qt5Network.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-A0JSI.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\config\is-V0ATK.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-JR2K7.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-66B02.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-16GDG.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\64\is-TGCGM.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-OO5VF.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-3KBUR.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qdds.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-DSH60.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-OK4T0.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-PV7K8.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\imageformats\qwbmp.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-V78FJ.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-TRS98.tmp	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\PenTablet.exe	UGEEWin_3.2.0.210804.tmp
File opened for modification	C:\Program Files\Pentablet\platforms\qwindows.dll	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-0FF4R.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\imageformats\is-D95AF.tmp	UGEEWin_3.2.0.210804.tmp
File created	C:\Program Files\Pentablet\is-LIUFM.tmp	UGEEWin_3.2.0.210804.tmp

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	devcon.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\setupact.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\setuperr.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
664	taskkill.exe
1004	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1660	Listdlls.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1200	Listdlls64.exe
1200	Listdlls64.exe
1200	Listdlls64.exe
1200	Listdlls64.exe
1200	Listdlls64.exe
1228	UGEEWin_3.2.0.210804.tmp
1228	UGEEWin_3.2.0.210804.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	1200	Listdlls64.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	1480	DrvInst.exe
Token: SeRestorePrivilege	932	devcon.exe
Token: SeLoadDriverPrivilege	932	devcon.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1592	DrvInst.exe
Token: SeLoadDriverPrivilege	1592	DrvInst.exe
Token: SeLoadDriverPrivilege	1592	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	1172	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	572	DrvInst.exe
Token: SeRestorePrivilege	1448	DrvInst.exe
Token: SeRestorePrivilege	1448	DrvInst.exe
Token: SeRestorePrivilege	1448	DrvInst.exe
Token: SeRestorePrivilege	1448	DrvInst.exe
Token: SeRestorePrivilege	1448	DrvInst.exe
Token: SeRestorePrivilege	1448	DrvInst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1228	UGEEWin_3.2.0.210804.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1764 wrote to memory of 1228	1764	UGEEWin_3.2.0.210804.exe	28
PID 1228 wrote to memory of 432	1228	UGEEWin_3.2.0.210804.tmp	29
PID 1228 wrote to memory of 432	1228	UGEEWin_3.2.0.210804.tmp	29
PID 1228 wrote to memory of 432	1228	UGEEWin_3.2.0.210804.tmp	29
PID 1228 wrote to memory of 432	1228	UGEEWin_3.2.0.210804.tmp	29
PID 1228 wrote to memory of 468	1228	UGEEWin_3.2.0.210804.tmp	30
PID 1228 wrote to memory of 468	1228	UGEEWin_3.2.0.210804.tmp	30
PID 1228 wrote to memory of 468	1228	UGEEWin_3.2.0.210804.tmp	30
PID 1228 wrote to memory of 468	1228	UGEEWin_3.2.0.210804.tmp	30
PID 432 wrote to memory of 664	432	cmd.exe	33
PID 432 wrote to memory of 664	432	cmd.exe	33
PID 432 wrote to memory of 664	432	cmd.exe	33
PID 432 wrote to memory of 1004	432	cmd.exe	35
PID 432 wrote to memory of 1004	432	cmd.exe	35
PID 432 wrote to memory of 1004	432	cmd.exe	35
PID 432 wrote to memory of 1924	432	cmd.exe	36
PID 432 wrote to memory of 1924	432	cmd.exe	36
PID 432 wrote to memory of 1924	432	cmd.exe	36
PID 1924 wrote to memory of 1660	1924	cmd.exe	37
PID 1924 wrote to memory of 1660	1924	cmd.exe	37
PID 1924 wrote to memory of 1660	1924	cmd.exe	37
PID 1924 wrote to memory of 1660	1924	cmd.exe	37
PID 1660 wrote to memory of 1200	1660	Listdlls.exe	38
PID 1660 wrote to memory of 1200	1660	Listdlls.exe	38
PID 1660 wrote to memory of 1200	1660	Listdlls.exe	38
PID 1660 wrote to memory of 1200	1660	Listdlls.exe	38
PID 432 wrote to memory of 1552	432	cmd.exe	39
PID 432 wrote to memory of 1552	432	cmd.exe	39
PID 432 wrote to memory of 1552	432	cmd.exe	39
PID 432 wrote to memory of 1976	432	cmd.exe	40
PID 432 wrote to memory of 1976	432	cmd.exe	40
PID 432 wrote to memory of 1976	432	cmd.exe	40
PID 432 wrote to memory of 1980	432	cmd.exe	41
PID 432 wrote to memory of 1980	432	cmd.exe	41
PID 432 wrote to memory of 1980	432	cmd.exe	41
PID 432 wrote to memory of 872	432	cmd.exe	42
PID 432 wrote to memory of 872	432	cmd.exe	42
PID 432 wrote to memory of 872	432	cmd.exe	42
PID 432 wrote to memory of 300	432	cmd.exe	43
PID 432 wrote to memory of 300	432	cmd.exe	43
PID 432 wrote to memory of 300	432	cmd.exe	43
PID 432 wrote to memory of 1940	432	cmd.exe	44
PID 432 wrote to memory of 1940	432	cmd.exe	44
PID 432 wrote to memory of 1940	432	cmd.exe	44
PID 432 wrote to memory of 828	432	cmd.exe	45
PID 432 wrote to memory of 828	432	cmd.exe	45
PID 432 wrote to memory of 828	432	cmd.exe	45
PID 432 wrote to memory of 1372	432	cmd.exe	46
PID 432 wrote to memory of 1372	432	cmd.exe	46
PID 432 wrote to memory of 1372	432	cmd.exe	46
PID 432 wrote to memory of 1992	432	cmd.exe	47
PID 432 wrote to memory of 1992	432	cmd.exe	47
PID 432 wrote to memory of 1992	432	cmd.exe	47
PID 432 wrote to memory of 1804	432	cmd.exe	48
PID 432 wrote to memory of 1804	432	cmd.exe	48
PID 432 wrote to memory of 1804	432	cmd.exe	48
PID 1228 wrote to memory of 932	1228	UGEEWin_3.2.0.210804.tmp	49
PID 1228 wrote to memory of 932	1228	UGEEWin_3.2.0.210804.tmp	49

C:\Users\Admin\AppData\Local\Temp\UGEEWin_3.2.0.210804.exe
"C:\Users\Admin\AppData\Local\Temp\UGEEWin_3.2.0.210804.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\is-5LLK7.tmp\UGEEWin_3.2.0.210804.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5LLK7.tmp\UGEEWin_3.2.0.210804.tmp" /SL5="$80022,24076297,169472,C:\Users\Admin\AppData\Local\Temp\UGEEWin_3.2.0.210804.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\EndWintab.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /t /im PenTablet.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /t /im PentabletService.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c listdlls.exe -d wintab32.dll /accepteula
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\Listdlls.exe
        
        listdlls.exe -d wintab32.dll /accepteula
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious use of WriteProcessMemory
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\Listdlls64.exe
        
        listdlls.exe -d wintab32.dll /accepteula
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Listdlls v3.2 - Listdlls "
      4⤵
      PID:1552
  - - C:\Windows\system32\find.exe
      find "pid:"
      4⤵
      PID:1976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Copyright (C) 1997-2016 Mark Russinovich "
      4⤵
      PID:1980
  - - C:\Windows\system32\find.exe
      find "pid:"
      4⤵
      PID:872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Sysinternals "
      4⤵
      PID:300
  - - C:\Windows\system32\find.exe
      find "pid:"
      4⤵
      PID:1940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Error opening System(4): "
      4⤵
      PID:828
  - - C:\Windows\system32\find.exe
      find "pid:"
      4⤵
      PID:1372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Access is denied. "
      4⤵
      PID:1992
  - - C:\Windows\system32\find.exe
      find "pid:"
      4⤵
      PID:1804
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\PSCC.bat""
    3⤵
    PID:468
- - C:\Program Files\Pentablet\64\devcon.exe
    "C:\Program Files\Pentablet\64\devcon.exe" install vmulti.inf pentablet\hid
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:932

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{267796cf-d659-1414-58db-d537dd9c6278}\vmulti.inf" "9" "6b1fe2f8b" "0000000000000578" "WinSta0\Default" "00000000000003E8" "208" "c:\program files\pentablet\64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem2.inf" "vmulti.inf:Vendor.NTAMD64.6.1:vmulti.Inst.Win7:6.1.7600.16385:pentablet\hid" "6b1fe2f8b" "0000000000000578" "00000000000005AC" "00000000000003AC"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\hid&Col01\1&2d595ca7&0&0000" "" "" "6d30ceb77" "0000000000000000" "00000000000005B4" "00000000000005B8"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\hid&Col02\1&2d595ca7&0&0001" "" "" "6955ccbf7" "0000000000000000" "000000000000061C" "0000000000000620"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1588

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\hid&Col04\1&2d595ca7&0&0003" "" "" "619fc8cf3" "0000000000000000" "0000000000000600" "0000000000000604"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\hid&Col03\1&2d595ca7&0&0002" "" "" "657acac73" "0000000000000000" "00000000000005E8" "00000000000005E4"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{6fbc7a38-99bd-4f15-9ae1-abafaa8ebed3} "(null)"
1⤵
PID:1972

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\hid&Col05\1&2d595ca7&0&0004" "" "" "6dc4c6d6f" "0000000000000000" "00000000000005F0" "00000000000005C4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:980

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1ec
1⤵
PID:1684

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Pentablet\64\devcon.exe

Filesize
88KB

MD5
f44245761bcf718a534974b431b8ce5c

SHA1
ee9ddb20529b1dad55383d9209d4d5c35c152571

SHA256
0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

SHA512
0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

Download Submit
C:\Program Files\Pentablet\64\vmulti.inf

Filesize
3KB

MD5
8caa6a96198b63517ce99095203dbe65

SHA1
666128119cf75897ff466a494d662bd3457a64c7

SHA256
72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

SHA512
2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5LLK7.tmp\UGEEWin_3.2.0.210804.tmp

Filesize
1.5MB

MD5
dca93f866f9a591f547ed8442841734a

SHA1
b8970ce7e09ff274fe331d7335e23087ebd71810

SHA256
a6d6e323f0fa2a630fe6fbf5d4e1d306cb8c2cb7a10e417ad105bdcef4cd6be1

SHA512
c14cea4f24d0620f65304b1b9019799e20850c3ea928ec6c119cb70171b1d3aeb71729347047e69b231f918f81b42939a6b91faddf3bbc7803278c9191b4718f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5LLK7.tmp\UGEEWin_3.2.0.210804.tmp

Filesize
1.5MB

MD5
dca93f866f9a591f547ed8442841734a

SHA1
b8970ce7e09ff274fe331d7335e23087ebd71810

SHA256
a6d6e323f0fa2a630fe6fbf5d4e1d306cb8c2cb7a10e417ad105bdcef4cd6be1

SHA512
c14cea4f24d0620f65304b1b9019799e20850c3ea928ec6c119cb70171b1d3aeb71729347047e69b231f918f81b42939a6b91faddf3bbc7803278c9191b4718f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\EndWintab.bat

Filesize
482B

MD5
aa9693d32653eaa7181228624b2dfd57

SHA1
9c9833ca082b288040ff6880471603fa90a4b64d

SHA256
d9fa3ad5a5385b7b5bdd1c314e06983ba324421bc72e595f820daa32882543ca

SHA512
63ad5c283db43fe06aac71d12fcf688002aa9fc3e6457525f9c3ac42e542d8a4d43af0035768386d722994023d5920b1796a7d448c532b75a8c52ce650b5972d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\Listdlls.exe

Filesize
414KB

MD5
60a2331a2b28968585c7c7229d2424a8

SHA1
fbac538166d61b4f10db934bd4bc1b86c81e56fb

SHA256
b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385

SHA512
159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\Listdlls.exe

Filesize
414KB

MD5
60a2331a2b28968585c7c7229d2424a8

SHA1
fbac538166d61b4f10db934bd4bc1b86c81e56fb

SHA256
b0f6800b2bb4c86e091120e9087c75f9b1b3e46b89cf65744d65cf5ab01fd385

SHA512
159542a30195f58a6957d70282bd2dff79708bd2228ebebf7db48e25d80e68ea17714b518a029d2e21acf564d37982b43850249c944e99ce1b38864ffa00b009

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\Listdlls64.exe

Filesize
215KB

MD5
8336396d50dcc9d5a5f66b078a8460dc

SHA1
42bf0bb282512e4c638b8f03617dd973ee09afd9

SHA256
29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7

SHA512
08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\PSCC.bat

Filesize
3KB

MD5
935934d8df9be23fd1a9ceebf0268c60

SHA1
9b1514fec943f47a3cc6f4e2086f3d4a756fab4d

SHA256
080a7566cd8bb25f32c3de59a62ad51801663695012ddb3376a2fe159078b24d

SHA512
b1bf2442b90b4118cfd09ff54862291bf8b3a29363ac83e08657badf5b506e56b0751288646bb440ca60906b75bcbd4e949fd8a5cd2e8337e95b6693f98ec019

Download Submit
C:\Users\Admin\AppData\Local\Temp\{267796cf-d659-1414-58db-d537dd9c6278}\pentablethid.cat

Filesize
9KB

MD5
cabe5b1bbfb4a6169d92746c52791399

SHA1
cda8c0d0c0b766b5012e12abe9aea9ee9bbfa7a2

SHA256
f6be58bc921ae4e82a2b85453dde6e8ea76c4a74356ef1647eb07ec16369d76a

SHA512
fc7a4625a78c71414fab851d88b6002fe5ff5276272b53a7d58cbc0e426f9ccaee74cd51e362791f0ada721d1713593e573d278b20cbb624d08d24c09ed17eae

Download Submit
C:\Users\Admin\AppData\Local\Temp\{267796cf-d659-1414-58db-d537dd9c6278}\vmulti.inf

Filesize
3KB

MD5
8caa6a96198b63517ce99095203dbe65

SHA1
666128119cf75897ff466a494d662bd3457a64c7

SHA256
72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

SHA512
2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

Download Submit
C:\Users\Admin\AppData\Local\Temp\{26779~1\WdfCoInstaller01009.dll

Filesize
1.7MB

MD5
d2cc9c7825874f874597e740a6581b66

SHA1
4503b24a8fae7aa0e14ebb7b138e5df1732c90d0

SHA256
399c80fd3eea9fc4365c4596012ac5adfcb786a190dd177e13d3dc9d83b95140

SHA512
b14b4b58ff4d9d72eb52b3d381afd20c3a61b5e08e6bfbbb746a7fe41d9c45e7ecd5a003064609e93f4dc963a6a45691a7e95ad7319b8e79fe7d8b9d260671f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{26779~1\hidkmdf.sys

Filesize
7KB

MD5
f1928f41c82ee87c3512c519b285a115

SHA1
526d137427e83138f0b31a0d18986a0caddf76b1

SHA256
40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

SHA512
5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

Download Submit
C:\Users\Admin\AppData\Local\Temp\{26779~1\vmulti.sys

Filesize
10KB

MD5
4636facdc5d181a62d2ad34654f4a00d

SHA1
221e212e325d07895dacb419479138675031dce2

SHA256
394c002844f9f63a5999f66535ada392c932245c795c9ea9cf7c73f0e4dc43b0

SHA512
9f19751a9bbc69e96af8752784406f80c329caf45bfc3aac201c270117b5ded3c43193a5c8034135ca93514cc4cb947742c80972be50cff00100708d0126449e

Download Submit
C:\Windows\INF\oem2.inf

Filesize
3KB

MD5
8caa6a96198b63517ce99095203dbe65

SHA1
666128119cf75897ff466a494d662bd3457a64c7

SHA256
72ec99a990a5d0c2c1fa7709606309bc7ba3ca850c8649bd86bc0cb639fb25b6

SHA512
2cfb684c88bff460b2fdbd6a09c0a1b859e97216114eb0472aa17a3ba7e27bd89a41a9a357efc662e5ef3809e33cf4470823421e18042cb607b6263526c9f949

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
194KB

MD5
f88c73ce77a94777fe7e49d7098aa984

SHA1
9ef028f982899501612314a9cac925676faeaed6

SHA256
a09a6a17edb49600dfc2bbd7fdc861e31243b4e673a19045248ab3ae3ca1d571

SHA512
b93cfe28a1b16028da2a0a289f5fff166d78b165e093766331d026638cd47ad8fd0e2b42ac3adb5f677c4ce11f3b29a2666ace7a497c2ddadaa89a4273565cd1

Download Submit
C:\Windows\System32\DRIVER~1\FILERE~1\VMULTI~1.INF\hidkmdf.sys

Filesize
7KB

MD5
f1928f41c82ee87c3512c519b285a115

SHA1
526d137427e83138f0b31a0d18986a0caddf76b1

SHA256
40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

SHA512
5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

Download Submit
C:\Windows\System32\DRIVER~1\FILERE~1\VMULTI~1.INF\vmulti.sys

Filesize
10KB

MD5
4636facdc5d181a62d2ad34654f4a00d

SHA1
221e212e325d07895dacb419479138675031dce2

SHA256
394c002844f9f63a5999f66535ada392c932245c795c9ea9cf7c73f0e4dc43b0

SHA512
9f19751a9bbc69e96af8752784406f80c329caf45bfc3aac201c270117b5ded3c43193a5c8034135ca93514cc4cb947742c80972be50cff00100708d0126449e

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_7c4a709680e8796d\pentablethid.cat

Filesize
9KB

MD5
cabe5b1bbfb4a6169d92746c52791399

SHA1
cda8c0d0c0b766b5012e12abe9aea9ee9bbfa7a2

SHA256
f6be58bc921ae4e82a2b85453dde6e8ea76c4a74356ef1647eb07ec16369d76a

SHA512
fc7a4625a78c71414fab851d88b6002fe5ff5276272b53a7d58cbc0e426f9ccaee74cd51e362791f0ada721d1713593e573d278b20cbb624d08d24c09ed17eae

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_7c4a709680e8796d\vmulti.PNF

Filesize
10KB

MD5
1babf1e55c3901e8c17e51bd79da45b2

SHA1
e1ac7e2fea6fc8e468c39b7dec054f94c49732a6

SHA256
0e841467ce71b5de94e6b9aacc51998548080b83cf6fb6337f96a010ccdd0dd3

SHA512
d52fcc1f97a618d62d2003b39a414f1e8e7dd0f24d6c5c27e6d70da8fe380680d1ec79aaf4dd6eb004ff3847eba91e154c46430b41d16cbcb896112165892791

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
babec703d64c71ae4e946428e4a8fcf3

SHA1
06902bbaab758c3790c1a2bd645b27f71f22d4db

SHA256
8b4bd3bb2d6b5631fdcaa6d21825b68c1ffb615272d1a429571ec935127b3a46

SHA512
28b49d857dac9ace7830bdb82c75c8175b7b413d2d2eefe9ea6edb899ce48ea929802908e0e9992990be66920f239b6f12569ef5e387da7fcc015ef37c1b4800

Download Submit
C:\Windows\setupact.log

Filesize
21KB

MD5
2b3135949a84c8a6630b9d9943a4117a

SHA1
8241f3ab0e91f387e259ae8f63c0ec00405a127e

SHA256
ee4a3b516262b28eb66e8e60bf2d049da0642649cd53ccd05e68deef149c2dcf

SHA512
652e1ceabc6c095de3d736e11153f26a8ba3f677f32ae90b1f313b062768c719e39a866fc77c1596542b65d936f361cef66859c4bce64d17a89089605f329f7d

Download Submit
\??\c:\PROGRA~1\PENTAB~1\64\WDFCOI~1.DLL

Filesize
1.7MB

MD5
d2cc9c7825874f874597e740a6581b66

SHA1
4503b24a8fae7aa0e14ebb7b138e5df1732c90d0

SHA256
399c80fd3eea9fc4365c4596012ac5adfcb786a190dd177e13d3dc9d83b95140

SHA512
b14b4b58ff4d9d72eb52b3d381afd20c3a61b5e08e6bfbbb746a7fe41d9c45e7ecd5a003064609e93f4dc963a6a45691a7e95ad7319b8e79fe7d8b9d260671f7

Download Submit
\??\c:\PROGRA~1\PENTAB~1\64\hidkmdf.sys

Filesize
7KB

MD5
f1928f41c82ee87c3512c519b285a115

SHA1
526d137427e83138f0b31a0d18986a0caddf76b1

SHA256
40bbe73324701268c3f52551c2531552fa43421ef7db799c08200c303ddc2235

SHA512
5d85b39d6e295e3baf1dd63d515c3e18a2d165483549ef1a7a8cdc78ed9cfed10e0e5acd8a8d60762bcffebb4c4c4ef5cf404a5f1f95a16a3f7523c85fdaa230

Download Submit
\??\c:\PROGRA~1\PENTAB~1\64\vmulti.sys

Filesize
10KB

MD5
4636facdc5d181a62d2ad34654f4a00d

SHA1
221e212e325d07895dacb419479138675031dce2

SHA256
394c002844f9f63a5999f66535ada392c932245c795c9ea9cf7c73f0e4dc43b0

SHA512
9f19751a9bbc69e96af8752784406f80c329caf45bfc3aac201c270117b5ded3c43193a5c8034135ca93514cc4cb947742c80972be50cff00100708d0126449e

Download Submit
\??\c:\program files\pentablet\64\pentablethid.cat

Filesize
9KB

MD5
cabe5b1bbfb4a6169d92746c52791399

SHA1
cda8c0d0c0b766b5012e12abe9aea9ee9bbfa7a2

SHA256
f6be58bc921ae4e82a2b85453dde6e8ea76c4a74356ef1647eb07ec16369d76a

SHA512
fc7a4625a78c71414fab851d88b6002fe5ff5276272b53a7d58cbc0e426f9ccaee74cd51e362791f0ada721d1713593e573d278b20cbb624d08d24c09ed17eae

Download Submit
\Program Files\Pentablet\64\devcon.exe

Filesize
88KB

MD5
f44245761bcf718a534974b431b8ce5c

SHA1
ee9ddb20529b1dad55383d9209d4d5c35c152571

SHA256
0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

SHA512
0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

Download Submit
\Program Files\Pentablet\64\devcon.exe

Filesize
88KB

MD5
f44245761bcf718a534974b431b8ce5c

SHA1
ee9ddb20529b1dad55383d9209d4d5c35c152571

SHA256
0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

SHA512
0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

Download Submit
\Program Files\Pentablet\64\devcon.exe

Filesize
88KB

MD5
f44245761bcf718a534974b431b8ce5c

SHA1
ee9ddb20529b1dad55383d9209d4d5c35c152571

SHA256
0a15d33b2994e5eb25ab9747e1214b078348529a735d342f3fa5fdb64b6cd312

SHA512
0b58cc6353d9cdb39c83c0f97444d66072eea9fdf19b835116e58cff3d195da4cf05f25fe57da0962aafa35dc6bf0fe35350b87c39c8f2e440615b766652af87

Download Submit
\Program Files\Pentablet\PenTablet.exe

Filesize
839KB

MD5
3a1aab2358d1d470e4c6eba9896e0609

SHA1
fed44d4015fe09ebf21108281d6b2da891dc23ea

SHA256
51838beb325a501b08e84c3bb423b88296921fe2cf04166126695d169c7d72d9

SHA512
17467b3eb0fcb08b0a1647c72c706e583b83a9de46e01d03853d6b5baaa9469ff328324eadb78cd6f328c3da7c3a0514a624fb8b546838e7c383cf43de5051b1

Download Submit
\Program Files\Pentablet\PenTablet.exe

Filesize
839KB

MD5
3a1aab2358d1d470e4c6eba9896e0609

SHA1
fed44d4015fe09ebf21108281d6b2da891dc23ea

SHA256
51838beb325a501b08e84c3bb423b88296921fe2cf04166126695d169c7d72d9

SHA512
17467b3eb0fcb08b0a1647c72c706e583b83a9de46e01d03853d6b5baaa9469ff328324eadb78cd6f328c3da7c3a0514a624fb8b546838e7c383cf43de5051b1

Download Submit
\Program Files\Pentablet\unins000.exe

Filesize
1.5MB

MD5
f9c63c065b076ef5336bed33b9fd8ba5

SHA1
814921a3863aab52cac771c6a2d8e78be596ab30

SHA256
dc179a67ea34394f0bdec643d8142b190c959ecf50585a488b903ef3741d017c

SHA512
5d06a85ac77e0487f44a1a2851212c5e4b7726b49beaea3457862a2e3831e2adfb79bc6cef3ffc7f3708ef684642cbe331f0336924f72e65002af48e09e0793f

Download Submit
\Users\Admin\AppData\Local\Temp\is-5LLK7.tmp\UGEEWin_3.2.0.210804.tmp

Filesize
1.5MB

MD5
dca93f866f9a591f547ed8442841734a

SHA1
b8970ce7e09ff274fe331d7335e23087ebd71810

SHA256
a6d6e323f0fa2a630fe6fbf5d4e1d306cb8c2cb7a10e417ad105bdcef4cd6be1

SHA512
c14cea4f24d0620f65304b1b9019799e20850c3ea928ec6c119cb70171b1d3aeb71729347047e69b231f918f81b42939a6b91faddf3bbc7803278c9191b4718f

Download Submit
\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\Listdlls64.exe

Filesize
215KB

MD5
8336396d50dcc9d5a5f66b078a8460dc

SHA1
42bf0bb282512e4c638b8f03617dd973ee09afd9

SHA256
29d23bc492e48a5ae68444302d3430e07d08e04278d53aa70d9367d9cf8bceb7

SHA512
08f34405f8d5ebf695391f9cb1deb6eb22b318b698ce9540d37eae45d36476a96d379e9f338c64d5f2f3e9674751bdb7f3661845530605b8fb1eb14ee91702e2

Download Submit
\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
\Users\Admin\AppData\Local\Temp\is-IR3P2.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
memory/1200-83-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmp

Filesize
8KB

Download
memory/1228-64-0x0000000002140000-0x000000000214E000-memory.dmp

Filesize
56KB

Download
memory/1228-66-0x0000000002150000-0x0000000002165000-memory.dmp

Filesize
84KB

Download
memory/1228-94-0x0000000074211000-0x0000000074213000-memory.dmp

Filesize
8KB

Download
memory/1764-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1764-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1764-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1764-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download