f69f9449e05536500c3b61499a24681193e567a7f5b8fd04359f185d0dbe1f37

Analysis

max time kernel
34s
max time network
36s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GAOMONTabletInstall_16.1.0.111.exe
Size

49.5MB
MD5

0d480144a0c8ebb96304e2c95dad03bc
SHA1

cc55fb3b096266cf067a37b122757093f9aed5cd
SHA256

f69f9449e05536500c3b61499a24681193e567a7f5b8fd04359f185d0dbe1f37
SHA512

a6b10f118e5de032c5cedba7c92defed33c59fb25902af9065044b7007e6c1849441c7e5fe45b8b72362642aa903481a63d2444b9ff434a4ed4663596ef44c1b
SSDEEP

1572864:Rn8V5vEOT3wn2PibPd5QabnN1wb8qefY89nSv:CPEMjevHzjlSv

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET1258.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET1258.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET1279.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\vmulti.sys	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET1289.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\WdfCoInstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\hidkmdf.sys	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET1279.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET1289.tmp	DrvInst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GAOMONTablet = "C:\\Users\\Admin\\AppData\\Roaming\\GAOMONTablet\\GAOMONTablet.exe"	GAOMONTabletInstall_16.1.0.111.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wintab32.dll	GAOMONTabletInstall_16.1.0.111.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1114.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\hidkmdf.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1103.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1103.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\wintab32.dll	GAOMONTabletInstall_16.1.0.111.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1102.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\vmulti.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET10F2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\WdfCoInstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1115.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1115.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	devcon.exe
File opened for modification	C:\Windows\SysWOW64\wintab32.dll	GAOMONTabletInstall_16.1.0.111.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET10F2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1102.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	devcon.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\vmulti.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\SET1114.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_e8a92f520f109b52\vmulti.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{131f796d-3237-0f9a-754e-4c705ecfac61}\GAOMONHID.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_e8a92f520f109b52\vmulti.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	devcon.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	devcon.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe

Executes dropped EXE 5 IoCs

pid	Process
2460	WintabTerminator.exe
1128	devcon.exe
1688	GAOMONTablet.exe
2128	TabletServer.exe
2268	TabletDriver.exe

Loads dropped DLL 21 IoCs

pid	Process
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2744	Process not Found
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
2128	TabletServer.exe
2128	TabletServer.exe
2128	TabletServer.exe
2128	TabletServer.exe
2128	TabletServer.exe
1688	GAOMONTablet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAOMONTabletInstall_16.1.0.111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GAOMONTablet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TabletServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TabletDriver.exe

Modifies Control Panel 6 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Cursors	GAOMONTabletInstall_16.1.0.111.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Cursors\ContactVisualisation = "0"	GAOMONTabletInstall_16.1.0.111.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Cursors\GestureVisualisation = "0"	GAOMONTabletInstall_16.1.0.111.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Cursors	GAOMONTablet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Cursors\ContactVisualisation = "0"	GAOMONTablet.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Cursors\GestureVisualisation = "0"	GAOMONTablet.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	TabletServer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	TabletServer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2460	WintabTerminator.exe
2460	WintabTerminator.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe
2248	GAOMONTabletInstall_16.1.0.111.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	2908	DrvInst.exe
Token: SeRestorePrivilege	1128	devcon.exe
Token: SeLoadDriverPrivilege	1128	devcon.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2204	DrvInst.exe
Token: SeLoadDriverPrivilege	2204	DrvInst.exe
Token: SeLoadDriverPrivilege	2204	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	2280	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	988	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2736	DrvInst.exe
Token: SeRestorePrivilege	2172	DrvInst.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2248	GAOMONTabletInstall_16.1.0.111.exe
2460	WintabTerminator.exe
1688	GAOMONTablet.exe
2128	TabletServer.exe
1688	GAOMONTablet.exe
1688	GAOMONTablet.exe
2268	TabletDriver.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2460	2248	GAOMONTabletInstall_16.1.0.111.exe	31
PID 2248 wrote to memory of 2460	2248	GAOMONTabletInstall_16.1.0.111.exe	31
PID 2248 wrote to memory of 2460	2248	GAOMONTabletInstall_16.1.0.111.exe	31
PID 2248 wrote to memory of 2460	2248	GAOMONTabletInstall_16.1.0.111.exe	31
PID 2248 wrote to memory of 1128	2248	GAOMONTabletInstall_16.1.0.111.exe	32
PID 2248 wrote to memory of 1128	2248	GAOMONTabletInstall_16.1.0.111.exe	32
PID 2248 wrote to memory of 1128	2248	GAOMONTabletInstall_16.1.0.111.exe	32
PID 2248 wrote to memory of 1128	2248	GAOMONTabletInstall_16.1.0.111.exe	32
PID 2248 wrote to memory of 1688	2248	GAOMONTabletInstall_16.1.0.111.exe	43
PID 2248 wrote to memory of 1688	2248	GAOMONTabletInstall_16.1.0.111.exe	43
PID 2248 wrote to memory of 1688	2248	GAOMONTabletInstall_16.1.0.111.exe	43
PID 2248 wrote to memory of 1688	2248	GAOMONTabletInstall_16.1.0.111.exe	43
PID 1688 wrote to memory of 2128	1688	GAOMONTablet.exe	44
PID 1688 wrote to memory of 2128	1688	GAOMONTablet.exe	44
PID 1688 wrote to memory of 2128	1688	GAOMONTablet.exe	44
PID 1688 wrote to memory of 2128	1688	GAOMONTablet.exe	44
PID 1688 wrote to memory of 2268	1688	GAOMONTablet.exe	45
PID 1688 wrote to memory of 2268	1688	GAOMONTablet.exe	45
PID 1688 wrote to memory of 2268	1688	GAOMONTablet.exe	45
PID 1688 wrote to memory of 2268	1688	GAOMONTablet.exe	45

C:\Users\Admin\AppData\Local\Temp\GAOMONTabletInstall_16.1.0.111.exe
"C:\Users\Admin\AppData\Local\Temp\GAOMONTabletInstall_16.1.0.111.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\WintabTerminator.exe
  "C:\Users\Admin\AppData\Local\Temp\WintabTerminator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2460
- C:\Users\Admin\AppData\Roaming\GAOMONTablet\driver\sha1\HID\amd64\devcon.exe
  "C:\Users\Admin\AppData\Roaming\GAOMONTablet\driver\sha1\HID\amd64\devcon.exe" INSTALL vmulti.inf gaomon\tablethid
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Users\Admin\AppData\Roaming\GAOMONTablet\GAOMONTablet.exe
  "C:\Users\Admin\AppData\Roaming\GAOMONTablet\GAOMONTablet.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Roaming\GAOMONTablet\TabletServer.exe
    "C:\Users\Admin\AppData\Roaming\GAOMONTablet\TabletServer.exe" Json={ \@AdUrl\@ : \@https://www.gaomon.net/plus/driver_banner.php\@, \@BrandName\@ : \@GAOMON\@, \@CfgWndMark\@ : \@GAOMONWndMark\@, \@DataPath\@ : \@C:\\Users\\Admin\\AppData\\Roaming\\GAOMON\\data\@, \@ServerUrl\@ : \@https://www.gaomon.net\@, \@WndProp\@ : \@GAOMONServer\@, \@WndPropValue\@ : 19810815 } JsonEnd
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    PID:2128
- - C:\Users\Admin\AppData\Roaming\GAOMONTablet\TabletDriver.exe
    Json={ \@BrandName\@ : \@GAOMON\@, \@CfgWnd\@ : 589852, \@CustomerCode\@ : [ \@GM001\@, \@OEM02\@ ], \@DataPath\@ : \@C:\\Users\\Admin\\AppData\\Roaming\\GAOMON\\data\@, \@LangName\@ : \@English\@, \@UIAppPath\@ : \@C:\\Users\\Admin\\AppData\\Roaming\\GAOMONTablet\\GAOMONTablet.exe\@, \@WndMarkValue\@ : 1981 } JsonEnd
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2268

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{31274fa8-2430-4ab7-4e3f-35541d0b0a5c}\vmulti.inf" "9" "6a6f1639b" "00000000000005B4" "WinSta0\Default" "00000000000004BC" "208" "c:\users\admin\appdata\roaming\gaomontablet\driver\sha1\hid\amd64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem2.inf" "vmulti.inf:Vendor.NTAMD64.6.1:vmulti.Inst.Win7:7.1.7610.16485:gaomon\tablethid" "6a6f1639b" "00000000000005B4" "00000000000005A8" "00000000000005E0"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\tablethid&Col01\1&2d595ca7&0&0000" "" "" "61702cfa7" "0000000000000000" "00000000000005F8" "0000000000000618"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\tablethid&Col02\1&2d595ca7&0&0001" "" "" "6d952b023" "0000000000000000" "000000000000061C" "00000000000005D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\tablethid&Col03\1&2d595ca7&0&0002" "" "" "69ba290a3" "0000000000000000" "0000000000000638" "0000000000000634"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "HID\tablethid&Col04\1&2d595ca7&0&0003" "" "" "65df2711f" "0000000000000000" "0000000000000650" "000000000000065C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{3c5d0d91-913f-40e3-a760-7662a6c0254a} "(null)"
1⤵
PID:860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GAOMONTablet\MSVCP140.dll

Filesize
449KB

MD5
ff5771a0cbc52d670cd12429180ef92d

SHA1
8ef0c2d8256c63bd4bfdc21e83ebd1ce5ca54c53

SHA256
d9f70829539ba953b309787677b16a8064548f090d9667e1beb085446c6cf20f

SHA512
37fa8950a444c8b27ca1213330b856ae731517b77bb6afa184ad2edaf234e946432d91b6ebab5df904dac58122b97d77111987157be21b0e1c883d8efc9dcb5a

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\TabletDriver.exe

Filesize
3.9MB

MD5
9ffb265983d1d98c492e5373b591beec

SHA1
96455eeefa01c822c1696bfddfb98530b09e77dd

SHA256
79ea99118d1983a2efbbedab3dcdd28838942e88338d3c2143fffc3808ebf9a7

SHA512
06942d44b1aacf3a2993b415ab1b72f2bf7f129cde3109e9295ca0d5b7b7cdd537697aae3afbdf45b4bba5f3908a9dc6641a25b6d677fa680a3c0a0138422d4c

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\TabletServer.exe

Filesize
1.5MB

MD5
f87a6686f977d0a68ffac3534a817681

SHA1
0ff0471aacd27b5a5f4bef975310ce7b8b222241

SHA256
6fc17740be8436a93b8521b2ad4626e558e1d7ab6a55b481201ecf147efd4d84

SHA512
309828f774d2b682eef875d779c7023531955f7e8876190a4fe52e31ea466c60589e8146b36dfb977142addc355b1d64d910ed514be062858a19722190154f3a

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\VCRUNTIME140.dll

Filesize
90KB

MD5
9c166fb427f4e8f05ab6830777c84f30

SHA1
4ca087b386715058c6c826b20e74ec675ea282c6

SHA256
0bf8db1459e5196890a742da143f10597f370bed798d12dcf6b53a8846bd101b

SHA512
045bfa32a0bc3c53cbf9aea6d7a4b39f7056d352aec909c96faff93d5ff43f22e2dd3ff686ca500b324e32d1c04b90b806a01fdd883edf4b96bc5257d27b1688

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\WintabMapMode.ini

Filesize
324B

MD5
5aa2e80942b5b9e0222744af2578e458

SHA1
062bcff61a0921ef5f9dc7f92e6291252384132d

SHA256
d2edc79669e9bed6b7a4d015219fbdd35a4ad0d5fb44e8d532a481c1348ad30d

SHA512
eee17548a72fbf85b555208b54c8fc11a71e8fe07d450d4ba794bfd2acfc9ccd691f18e97b5e25e5853cc4e4cc89795b19ba324a18f15465c1d609b082a0d246

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\data.rs

Filesize
8.7MB

MD5
0e20a467bfcc0a2ee927f4247b3cf447

SHA1
c17cc6a88e928104bc17183108cbd83c1744a057

SHA256
628b6ddc60c9b703086f51a7297790006a41bc3a419d08ba6873f38a7b32e243

SHA512
9112d89fc52d81932a9dde613d3926289673bcb66fec7f3eed2419383736c87ed3777d8369e0939509763cdd30628aae8a65620b4d67b92d1dc7bff9218bcc73

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\driver\sha1\HID\amd64\vmulti.inf

Filesize
4KB

MD5
6687d8ad7249deb46dff506095fa550d

SHA1
17c1c28d86167114be6a3b18fe52a415cf57c67c

SHA256
2ab84de4df5c62e808c90bf6a9441787c87619dd1a41951cabbd6b933a7e070e

SHA512
3fff2317fe959f76dd6b45e2e52f46f8750185d1f6be63f06ca36b1b4b6d7c65758c84d1aeaa74aa5018d2a5ab89f2cfaaf6b7d27b2045d4b71cf66f34c9cfbc

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMONTablet\mfc140u.dll

Filesize
4.8MB

MD5
29eb82a065a7bfc50f5d18f630c016e3

SHA1
6059f09dae687fe6c419aa6878fe39b98e782cf8

SHA256
6f1dea288f355a235ffe3bcd246dab51540896480a68a83cd2aafe9f640f04f8

SHA512
6eb47be6cdaa6763ab9a1ea7e7f556ca670f492943fbc71c237b6e981d1a86f6d70d59d1f0d21590be66a696b4ca646bde3a31c8593178f10fd6dd87e3a0dfa7

Download Submit
C:\Users\Admin\AppData\Roaming\GAOMON\data\EKeySetting.dt

Filesize
167KB

MD5
9d7f5669d6088374150a462c3a372a8b

SHA1
679965a22a07160c1375003f6e821935caf5420a

SHA256
89ce63938ac74ab1907a33db87eeb77b15afc84690655328380fb9e23abbcdc5

SHA512
07bf8a08b37857c9b91ff79a7933de6eea43cdedb1d50469de056d14ed7ae878b864f5938a4f5a26af543552808b33229a0e48b87676feaf9a39561093cbd3db

Download Submit
C:\Windows\System32\DriverStore\FileRepository\vmulti.inf_amd64_neutral_e8a92f520f109b52\vmulti.PNF

Filesize
10KB

MD5
ef10bf14b3ddf4b7bbfcd94a6c81fb92

SHA1
6485d53b089908076667894b43c89cf989313971

SHA256
dc870b77b0af934ef4c68eef9aae34bd57d0a9f18c97244eafbcb1ed154f19fd

SHA512
35af653ee9d8abaded2ad819be59273142d301b856506d62bcbab885f844a7bb3cb90de48e7720c4dee68dcf90e2bea45fb122870faafa31978c90098458e2aa

Download Submit
C:\Windows\System32\DriverStore\INFCACHE.1

Filesize
1.4MB

MD5
091b8fd39d2ebe5a0effe035fde70ae7

SHA1
e2d78a77dcd0e98080737f90920c8ed56399a58c

SHA256
586fcecd989a99954c1ed8b8970e7be91aab39afdc0d9af04bf6ad9e8a9880f4

SHA512
e227bb67d05971b2fe17d868446ca7bd403f69053b413b47f22ba4db6929617f00b68940e78eef628843aef2436a4d823d6026878b7c2c568767ec21e8743827

Download Submit
\??\c:\users\admin\appdata\roaming\GAOMON~1\driver\sha1\hid\amd64\WDFCOI~1.DLL

Filesize
1.4MB

MD5
ca00578ac7b0be576f3802b04061100d

SHA1
abcad6ced72669c19974acd4b60ad3bc1c2a8df3

SHA256
fed1fe8a7274fe6231a6cd0bf0112ad626ec7eced35a9469c4c4bf499215686c

SHA512
b96a13bdde2c432a0e1a7d4d705f40afa3e5c9df8dce3111d69b8e01542a6dc53763a25bd34aaff6deff96bfdef4492da1ed50dea1ca5f1b4d2715356d01b395

Download Submit
\??\c:\users\admin\appdata\roaming\GAOMON~1\driver\sha1\hid\amd64\hidkmdf.sys

Filesize
16KB

MD5
2086903f3ade4233450aa5f5bfb897c5

SHA1
3bb8090b76c56ef47a30342097da5346bab6dab4

SHA256
6a5bd2b11d465dadc8fa9cc4f5984789f803cf2d0adb70677e283c69edfbe327

SHA512
d482ec52db81b1a34f8ba7cc1c7664b1412e52875ca75fd1b46ca4952910f99471d1771c3612b46b4ee1ec6e9dcd317596d22c46a213b88412639631ff61fc1d

Download Submit
\??\c:\users\admin\appdata\roaming\GAOMON~1\driver\sha1\hid\amd64\vmulti.sys

Filesize
19KB

MD5
347e25bbf78b2e9cc4f4205941591009

SHA1
b2630d41fc3c02c6d8472ed3cedbb7af704892a7

SHA256
34a92b9b03d43f0245ac3c91f35abb9bebfa6ec494adc26643dfdb72a01c7c64

SHA512
b250511eee830752900f014ef9500f17de3a82949d3a12f028307e9c9db98d55fff418b4ff4beee8e9d65835ee99c1762af17f40f0cabd44f33a8769314e9181

Download Submit
\??\c:\users\admin\appdata\roaming\gaomontablet\driver\sha1\hid\amd64\GAOMONHID.cat

Filesize
9KB

MD5
51a02e393870b7d06d0439b99af611ee

SHA1
badf559071fa394f4b0d07aa0d15fc583f3b64e0

SHA256
17cbf003bc69904c131a3de3c011985e01905a997de0fba56f635af356256eea

SHA512
cc7eb18029860aa9b3b278edc935b313e100377b8deb1120bfef5e873fc44af46bc9409362ed7bbd5f847de992ff181b3497d2d61fd5c2fedc6ee77bc9ec039b

Download Submit
\Users\Admin\AppData\Local\Temp\WintabTerminator.exe

Filesize
4.1MB

MD5
63329e3af07706d5cd4be138e676d035

SHA1
3ed6248f15c06d36f154fcae69f855ed570468d7

SHA256
663417749929c5355f80cd3afaebf043be409b53333ab56d250ec7797b214dd4

SHA512
a8b477dde5494d47b5a2f2b3c8d900ed6ce65fa6e03750b0b527aa9713e4b07abf55ad1503b539a4f7fcce315d018e4ef9b8d79fb5ca33e920f36b9c42dd8fe5

Download Submit
\Users\Admin\AppData\Roaming\GAOMONTablet\DuiLib.dll

Filesize
802KB

MD5
2b8eb7477f677e4fd775e284801895e2

SHA1
da610e9054d2d84aa64e2788e2625d2430fc3b58

SHA256
308a584b07a6f258f1efae1a52e3d66d7dd61602b69fa76414698c22762265a4

SHA512
d908080dcefd40111c8468c0ce425556172c09b7e56759cf87521fda482378da7fde0dfc821297098ebaefec3c5fa10b2aaecade6cea4f1f166b0fb5298a421e

Download Submit
\Users\Admin\AppData\Roaming\GAOMONTablet\GAOMONTablet.exe

Filesize
3.9MB

MD5
2a142f60eb3477686ba4b91d13ae7915

SHA1
43f08886094619529f20189ae9e6447330b84ed8

SHA256
83b3358a0b97c86e6f445b76979b29997fd46e59484deae94016054c90501fd2

SHA512
d4ee2cf724b9d5e3ff9ffd074852e0e73d7772ede01b826f42e6feee79a9d555071051e19176781518272644f23555e20b0997e7c55c4a9f875e19dd2377e77e

Download Submit
\Users\Admin\AppData\Roaming\GAOMONTablet\Uninstall.exe

Filesize
2.8MB

MD5
1e9749fcae6c06e934ee25ef3d591c76

SHA1
972527b65790aac678942521338ed16d733e79bb

SHA256
0b70615905a9e06220cf3c2ec7d332c525ad35ad2fe5de5c9df748cb201889fd

SHA512
15bbc31badae3da2e99ace29f5777ac7168c114eab6e6ab82e0cbf4d01f32a0102374106959711a76d3333a49de5d1c5da18ca5ceeca0a885b90bc4f273f964b

Download Submit
\Users\Admin\AppData\Roaming\GAOMONTablet\UpDownManager.dll

Filesize
84KB

MD5
133ff13ab810d0c34f521ef8f4d9f64a

SHA1
d7155e9290b857e50b02e8549fe0215082ac9d2d

SHA256
7db889803f5f678e1c9c7155c3e35f0c812cc88e3e436b67ad516b84548fb303

SHA512
f2fec06e9a9da2c4523ca84ec0d455e74b632f3f22c10cadf0f6c57de534974bed2d03606b05341d13c8340f69e834bb1ed89a39770119228762b5c220c38459

Download Submit
\Users\Admin\AppData\Roaming\GAOMONTablet\api-ms-win-shcore-scaling-l1-1-1.dll

Filesize
12KB

MD5
7270ae3f5f477f93475d32f18ff79224

SHA1
6a15525f53e17b467ab2ee60205750abf708df2e

SHA256
ccdf71471fb23a438238b29b42a3f1bd5526bc787bfa45a6919e4ac65109d516

SHA512
4acb021678229f17ee11df96ead4b9dd034ed26649150ea2d279953e5b665b728bbe2eb8d18716c3f9a19d1ac59b4d688788128a699a0324bfa52c11749d8e4d

Download Submit
\Users\Admin\AppData\Roaming\GAOMONTablet\driver\sha1\HID\amd64\devcon.exe

Filesize
104KB

MD5
a2a7eb81a7fac15406eb35e150f3be44

SHA1
98dae7304358d4162cb553184e0900b5df1f7772

SHA256
4dbdbe1c41178a2cf19287c193623a82f42e9c2423247ec06cd92b867302da95

SHA512
9d76af983934ba29412482ab443230ef9eb50c20e568d8503a1d588bb647c8b35372d99d3764c67191a1195c96573fb093969bccebe3c0f9937af95e8fa2ac55

Download Submit
\Windows\SysWOW64\wintab32.dll

Filesize
140KB

MD5
703c516f8848acd479954c83e9508114

SHA1
7912ca17ef5fbe8e4b27f69cf9d7e4732bee4736

SHA256
98a7c6d0a7127e4ce2f8764e052cadba3f4dcb4e02ca1e5b35b26f457c986588

SHA512
718219fc402e3c3d02cdb97c34baf372a89e6ddf00a0676fd18c259d5a6328ad7499eabd97e2f3983fb298df2eb131199c3eec47f5902566cf696ede13fc72df

Download Submit