Overview

overview

8

Static

static

7

EportClien...57.exe

windows10-2004-x64

EportClien...57.exe

windows11-ltsc_2024-x64

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ox.dll

windows10-2004-x64

3

$PLUGINSDI...ox.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

C:/Program...1.html

windows10-2004-x64

3

C:/Program...1.html

windows11-ltsc_2024-x64

4

C:/Program...r.html

windows10-2004-x64

3

C:/Program...r.html

windows11-ltsc_2024-x64

4

CPUCard_Client.dll

windows10-2004-x64

3

CPUCard_Client.dll

windows11-ltsc_2024-x64

3

CertUpdateApi.dll

windows10-2004-x64

3

CertUpdateApi.dll

windows11-ltsc_2024-x64

3

Check903Reader.dll

windows10-2004-x64

3

Check903Reader.dll

windows11-ltsc_2024-x64

3

CnEport.Pu...er.exe

windows10-2004-x64

3

CnEport.Pu...er.exe

windows11-ltsc_2024-x64

3

CnEport.Pu...ig.dll

windows10-2004-x64

3

CnEport.Pu...ig.dll

windows11-ltsc_2024-x64

3

CnEport.Pu...te.exe

windows10-2004-x64

CnEport.Pu...te.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    90s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/07/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    EportClientSetup_V1.6.57.exe
  • Size 33.4MB
  • Sample260710-pelansbs9k
  • SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 58 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 20 IoCs
  • Launches sc.exe 11 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 22 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 43 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 35 IoCs
    defense_evasionspywaretrojan
  • Runs .reg file with regedit 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EportClientSetup_V1.6.57.exe
    "C:\Users\Admin\AppData\Local\Temp\EportClientSetup_V1.6.57.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3056
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe" /codebase "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocket.ActiveX.dll"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      PID:1092
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe" "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1872
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe" /S
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:2432
    • C:\Windows\drives\HGBOT_x64.exe
      "C:\Windows\drives\HGBOT_x64.exe" -i -s
      2⤵
      • Executes dropped EXE
      PID:3524
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe"
      2⤵
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc stop "WDDrvRpr_Share"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1128
        • C:\Windows\SysWOW64\sc.exe
          sc stop "WDDrvRpr_Share"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2912
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc delete "WDDrvRpr_Share"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\sc.exe
          sc delete "WDDrvRpr_Share"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2772
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDTokenServerSetup.exe
        "WDTokenServerSetup.exe" /DevFilter=WDK_CCID,watchg2;WDK_UDK,S5BOCL0;WDK_UDK,S5BOCB1;WDK_UDK,S5BOCB1;WDK_UDK,WDCNCB5;
        3⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc stop WDTokenServerHaiGuan
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5116
          • C:\Windows\SysWOW64\sc.exe
            sc stop WDTokenServerHaiGuan
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:5104
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc delete WDTokenServerHaiGuan
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4124
          • C:\Windows\SysWOW64\sc.exe
            sc delete WDTokenServerHaiGuan
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4324
        • C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe
          "C:\Windows\system32\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe" /Service
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1360
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc start WDTokenServerHaiGuan
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5028
          • C:\Windows\SysWOW64\sc.exe
            sc start WDTokenServerHaiGuan
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3500
      • C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\registCCID.exe
        "C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\registCCID.exe"
        3⤵
        • Executes dropped EXE
        PID:3904
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc config SCardSvr start= auto
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Windows\SysWOW64\sc.exe
          sc config SCardSvr start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3532
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc start SCardSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\SysWOW64\sc.exe
          sc start SCardSvr
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1356
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc config SCPolicySvc start= auto
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Windows\SysWOW64\sc.exe
          sc config SCPolicySvc start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3516
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc start SCPolicySvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Windows\SysWOW64\sc.exe
          sc start SCPolicySvc
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3364
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe
        "C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe" /Service
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3612
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc start "WDDrvRpr_Share"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Windows\SysWOW64\sc.exe
          sc start "WDDrvRpr_Share"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:5056
    • C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
      "C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4688
    • C:\Windows\SysWOW64\sc.exe
      sc start HDZB_DeviceService_For_CEP_2G
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:628
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Delete /tn CnEportClientComponent /F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3688
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Delete /tn Eport_iKey_Service /F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:804
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /create /tn Eport_iKey_Service /sc ONLOGON /TR "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe" /rl HIGHEST /DELAY 0001:10
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4120
    • C:\Windows\SysWOW64\powercfg.exe
      powercfg.exe /H off
      2⤵
      • Power Settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4312
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\SetAccessControl.exe
      F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\SetAccessControl.exe
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4864
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe"
        3⤵
        • Executes dropped EXE
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\ePass3003_SimpChinese_gfa.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\ePass3003_SimpChinese_gfa.exe" /S
      2⤵
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFACSP11_s.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:4968
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe "C:\Windows\system32\GFACSP11.dll",eb_RunNoElevated "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2960
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{a402efa8-92da-2a45-a321-447cd6f605b5}\usbccid.inf" "9" "4421fc7e7" "0000000000000148" "WinSta0\Default" "00000000000000B8" "208" "f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3320
  • C:\Windows\drives\HGBOT_x64.exe
    C:\Windows\drives\HGBOT_x64.exe
    1⤵
    • Executes dropped EXE
    PID:2776
  • C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe
    "C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:808
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -s SCardSvr
    1⤵
      PID:5036
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s SCPolicySvc
      1⤵
        PID:1196
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe
        "C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4108
      • C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        1⤵
        • Executes dropped EXE
        PID:4404
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
        1⤵
          PID:4724
        • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe
          "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe"
          1⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Modifies trusted root certificate store through registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3556
        • C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe
          "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2272
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa3909855 /state1:0x41c64e6d
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:1148

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Power Settings

              1
              T1653

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              4
              T1112

              Subvert Trust Controls

              2
              T1553

              Install Root Certificate

              2
              T1553.004

              Credential Access

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              4
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              uninst.exe
              • Path C:\Program Files (x86)\EnterSafe\ePass3003_GFA\uninst.exe
              • Size 75KB
              • SHA256 108caeeedff9e51c8ce3cd0280ef3c203731ea21ba8a2e9f5660411c9f1bbf63
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
              • Size 727B
              • SHA256 a8688726a968e062f5f43637e62d10d744593af3645530b99d426ae9c172d86c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
              • Size 727B
              • SHA256 c95ed8fde8d66e7f86cc60e710bb43c3363e09f00ac089f9159af14657e3cd9b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 7866d6263a37e8d305501b77b61453a5047524f19be57a9068fb9318d6ecea20
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
              • Size 404B
              • SHA256 19a63c9ef6812a2e05712b0fc30484c3197edc7545ec0f0621bc8b468a6465f0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
              • Size 408B
              • SHA256 23bc18203c0d526c62a5b98c4f2a4317c9d06d057c45b96fde0a0c673cb08f7a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 f2316e5c4ce0b5df8a3d3947e174de85a7cefb410ae002dae7997ee89f25fcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Tmp2F24.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp2F24.tmp
              • Size 1KB
              • SHA256 fbe0571254b27a5a65de2bc673f028ca32d173d7ce6f1d8b07082ed3412a45d5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              UserInfo.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nss15E2.tmp\UserInfo.dll
              • Size 4KB
              • SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              nsExec.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nss15E2.tmp\nsExec.dll
              • Size 6KB
              • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              nsProcessW.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nss15E2.tmp\nsProcessW.dll
              • Size 4KB
              • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nst18A1.tmp\System.dll
              • Size 11KB
              • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv364B.tmp\System.dll
              • Size 11KB
              • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              UserInfo.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv364B.tmp\UserInfo.dll
              • Size 4KB
              • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              InstallOptions.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\InstallOptions.dll
              • Size 14KB
              • SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              KillProcDLL.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\KillProcDLL.dll
              • Size 4KB
              • SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LangDLL.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\LangDLL.dll
              • Size 5KB
              • SHA256 fd26ef21d72797fedecd3d15f2001cea793383aceb3cee19a5ae2a3d30e197b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SimpleSC.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\SimpleSC.dll
              • Size 49KB
              • SHA256 b549e39133b32eb4e67e239128c2b55467f01b4601c8147a6c8459d883169fa4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\System.dll
              • Size 10KB
              • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ioSpecial.ini
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\ioSpecial.ini
              • Size 726B
              • SHA256 fd651a8a4411fdec57db8fc2331757a4f1e88e676ac6ab7906c84fc038b5e888
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ioSpecial.ini
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\ioSpecial.ini
              • Size 588B
              • SHA256 a72f5fa673eb53daae4e7847c6192cdeba948a498ea799131ab3a356bfa32285
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              nsExec.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsv4563.tmp\nsExec.dll
              • Size 6KB
              • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\CatRoot2\dberr.txt
              • Size 37KB
              • SHA256 3eaa0707457132cb4b652fefa37bb83bd270aa857b90d713962d7278fa50c66e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CnEport.Pub.Config.dll
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.Config.dll
              • Size 18KB
              • SHA256 0e02f0e4d50e14603fb32b0c1044c47a543016d23054703e59615b41530f417b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CnEport.Pub.WebSocket.ActiveX.dll
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocket.ActiveX.dll
              • Size 62KB
              • SHA256 6ed0ea0aba1f6d1fa7398ec2fe5e9fec7c58dc7465189a3528751a030950c100
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CnEport.Pub.WinService.InstallLog
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.InstallLog
              • Size 843B
              • SHA256 6fb5fb6c0868f8030e756023f4495d8c13688a2f57ab4482ff5f4fc82a647e09
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CnEport.Pub.WinService.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe
              • Size 42KB
              • SHA256 24a5e72a1c1c6d488a2c433e34485e1e70b7cb3656bd289b4b6b3ee7f8e2b3d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Log1.txt
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\Log1.txt
              • Size 3KB
              • SHA256 6739a129f9dec86a7a2b967bdb51d4bc7b8ff6ff318c62ef80aa0a0d806375bf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Log1.txt
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\Log1.txt
              • Size 4KB
              • SHA256 0b5ec8658581154b423f00d3fdac7a6663d718f532a9646c14f9292226d11231
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LogNum.dat
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\LogNum.dat
              • Size 1B
              • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
              • MD5 SHA1 SHA512
              Submit Download

              Log1.txt
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\WebSocket\Log1.txt
              • Size 2KB
              • SHA256 6b9512e83cbb7f08b3bdf73620c1fac97485077531843c7348f16c6360d5b7d7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Log1.txt
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\WebSocket\Log1.txt
              • Size 3KB
              • SHA256 5b2c2d4e2bbb9f6736a1cb544686d986b9d0aff074bddaf1a5c92507d715db2a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              WinService.xml
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\conf\WinService.xml
              • Size 1KB
              • SHA256 3f81cfa937c6378949639616ae261d48de2a71ad69dd61cf4887b398e70fcffb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              DPinst64.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe
              • Size 663KB
              • SHA256 ec2355c3e59b8d33b21a6ae5041783c45faa22d007384965ffbbfc4195c19853
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              HDZB_USBKEY_2G_CEP_DevServer.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
              • Size 169KB
              • SHA256 28b4ff155b588aafa612dc1bfdb3c42e5729248d86db6803bfc9b58391e8b119
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              HGBOT_x64.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\HGBOT_x64.exe
              • Size 119KB
              • SHA256 f32defafad6948db40d13b3e5fcde3a8192fa33bd64ff7b77a6c2438c5c46aac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Ds20Sign.dll
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\MOFCOM\Ds20Sign.dll
              • Size 903KB
              • SHA256 f32c4c945908324613dc7b6b55ae47cb56d429d10eb695a91d5d655e7238d724
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GFACertEnroll.dll
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\MOFCOM\GFACertEnroll.dll
              • Size 239KB
              • SHA256 9ae3736703a1ddf417fb326698b87569874dfff5f128563e7a4956700905d02c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ESBasic.dll
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\others\ESBasic.dll
              • Size 395KB
              • SHA256 31d15e308514e78f87caaadbfa45016c1c0b255af6bf30d046c084c764a8ac52
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InstallUtil.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe
              • Size 36KB
              • SHA256 7f7d33e2e555acc3f6049fbaa6370bd1615af6526bdd47a96bb3a3c5fdf5601b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RegAsm.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe
              • Size 60KB
              • SHA256 7552a38af69c7416a551a74379175c633b5e0f102d8a8f35922d5acf5a49cd08
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              uninst.exe
              • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\uninst.exe
              • Size 156KB
              • SHA256 223beb5703753193bc8308057034cd22a60fe675b00cf2017fc0fef1daad53a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              usbccid.cat
              • Path \??\f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\usbccid.cat
              • Size 7KB
              • SHA256 16d27ecd64c18a63005ffc21023b1b426f12d634e4d6d153cdc0668eb8873d2d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              usbccid.inf
              • Path \??\f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\usbccid.inf
              • Size 1KB
              • SHA256 92adf715e8af162170b04bbb238dde9917f5b205800f816c99d23f24203511c2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1092-310-0x0000000002D40000-0x0000000002D50000-memory.dmp
              Download

              memory/1092-311-0x0000000073A02000-0x0000000073A04000-memory.dmp
              Download

              memory/1092-306-0x0000000002D40000-0x0000000002D50000-memory.dmp
              Download

              memory/1092-307-0x0000000073A02000-0x0000000073A04000-memory.dmp
              Download

              memory/1872-349-0x0000000000EC0000-0x0000000000ED0000-memory.dmp
              Download

              memory/1872-350-0x0000000073D42000-0x0000000073D44000-memory.dmp
              Download

              memory/3056-337-0x0000000003EB0000-0x0000000003EC1000-memory.dmp
              Download

              memory/3056-309-0x0000000003C61000-0x0000000003C62000-memory.dmp
              Download

              memory/3056-308-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-275-0x0000000005C80000-0x0000000005D66000-memory.dmp
              Download

              memory/3056-135-0x0000000003C61000-0x0000000003C62000-memory.dmp
              Download

              memory/3056-134-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-125-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-126-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-127-0x0000000003C61000-0x0000000003C62000-memory.dmp
              Download

              memory/3056-118-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-115-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-109-0x0000000003C60000-0x0000000003C63000-memory.dmp
              Download

              memory/3056-110-0x0000000003C61000-0x0000000003C62000-memory.dmp
              Download

              memory/3056-10-0x0000000003A20000-0x0000000003A31000-memory.dmp
              Download