Overview

overview

8

Static

static

7

EportClien...57.exe

windows10-2004-x64

EportClien...57.exe

windows11-ltsc_2024-x64

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ox.dll

windows10-2004-x64

3

$PLUGINSDI...ox.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-ltsc_2024-x64

3

C:/Program...1.html

windows10-2004-x64

3

C:/Program...1.html

windows11-ltsc_2024-x64

4

C:/Program...r.html

windows10-2004-x64

3

C:/Program...r.html

windows11-ltsc_2024-x64

4

CPUCard_Client.dll

windows10-2004-x64

3

CPUCard_Client.dll

windows11-ltsc_2024-x64

3

CertUpdateApi.dll

windows10-2004-x64

3

CertUpdateApi.dll

windows11-ltsc_2024-x64

3

Check903Reader.dll

windows10-2004-x64

3

Check903Reader.dll

windows11-ltsc_2024-x64

3

CnEport.Pu...er.exe

windows10-2004-x64

3

CnEport.Pu...er.exe

windows11-ltsc_2024-x64

3

CnEport.Pu...ig.dll

windows10-2004-x64

3

CnEport.Pu...ig.dll

windows11-ltsc_2024-x64

3

CnEport.Pu...te.exe

windows10-2004-x64

CnEport.Pu...te.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    71s
  • max time network
    78s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    EportClientSetup_V1.6.57.exe
  • Size 33.4MB
  • Sample260710-pelansbs9k
  • SHA256 ce59dc8f871c1bb76f58da243bffff5bd46993dee2b017c974315b94fcf7bc7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 56 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 19 IoCs
  • Launches sc.exe 11 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 22 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 33 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 26 IoCs
    defense_evasionspywaretrojan
  • Runs .reg file with regedit 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EportClientSetup_V1.6.57.exe
    "C:\Users\Admin\AppData\Local\Temp\EportClientSetup_V1.6.57.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4856
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe" /codebase "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocket.ActiveX.dll"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      PID:4360
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe" "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4268
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe" /S
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4120
    • C:\Windows\drives\HGBOT_x64.exe
      "C:\Windows\drives\HGBOT_x64.exe" -i -s
      2⤵
      • Executes dropped EXE
      PID:5612
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe"
      2⤵
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc stop "WDDrvRpr_Share"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Windows\SysWOW64\sc.exe
          sc stop "WDDrvRpr_Share"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4140
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc delete "WDDrvRpr_Share"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\Windows\SysWOW64\sc.exe
          sc delete "WDDrvRpr_Share"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3288
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDTokenServerSetup.exe
        "WDTokenServerSetup.exe" /DevFilter=WDK_CCID,watchg2;WDK_UDK,S5BOCL0;WDK_UDK,S5BOCB1;WDK_UDK,S5BOCB1;WDK_UDK,WDCNCB5;
        3⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc stop WDTokenServerHaiGuan
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Windows\SysWOW64\sc.exe
            sc stop WDTokenServerHaiGuan
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3916
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc delete WDTokenServerHaiGuan
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Windows\SysWOW64\sc.exe
            sc delete WDTokenServerHaiGuan
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2472
        • C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe
          "C:\Windows\system32\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe" /Service
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6048
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c sc start WDTokenServerHaiGuan
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Windows\SysWOW64\sc.exe
            sc start WDTokenServerHaiGuan
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:256
      • C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\registCCID.exe
        "C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\registCCID.exe"
        3⤵
        • Executes dropped EXE
        PID:3952
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc config SCardSvr start= auto
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1168
        • C:\Windows\SysWOW64\sc.exe
          sc config SCardSvr start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:3392
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc start SCardSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5240
        • C:\Windows\SysWOW64\sc.exe
          sc start SCardSvr
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2052
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc config SCPolicySvc start= auto
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\SysWOW64\sc.exe
          sc config SCPolicySvc start= auto
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2372
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc start SCPolicySvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5356
        • C:\Windows\SysWOW64\sc.exe
          sc start SCPolicySvc
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4864
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe
        "C:\Windows\system32\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe" /Service
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1884
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c sc start "WDDrvRpr_Share"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\sc.exe
          sc start "WDDrvRpr_Share"
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:4312
    • C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
      "C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5228
    • C:\Windows\SysWOW64\sc.exe
      sc start HDZB_DeviceService_For_CEP_2G
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:1084
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Delete /tn CnEportClientComponent /F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:748
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Delete /tn Eport_iKey_Service /F
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5132
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /create /tn Eport_iKey_Service /sc ONLOGON /TR "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe" /rl HIGHEST /DELAY 0001:10
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3048
    • C:\Windows\SysWOW64\powercfg.exe
      powercfg.exe /H off
      2⤵
      • Power Settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1360
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\SetAccessControl.exe
      F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\SetAccessControl.exe
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4316
      • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe
        "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocketServer.exe"
        3⤵
        • Executes dropped EXE
        • Modifies trusted root certificate store through registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:6060
    • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\ePass3003_SimpChinese_gfa.exe
      "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\ePass3003_SimpChinese_gfa.exe" /S
      2⤵
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies trusted root certificate store through registry
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:5772
      • C:\Windows\SysWOW64\regedit.exe
        regedit.exe /s "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFACSP11_s.reg"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:5316
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe "C:\Windows\system32\GFACSP11.dll",eb_RunNoElevated "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2220
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "8" "C:\Users\Admin\AppData\Local\Temp\{0787537c-e13f-de4f-9b0a-9d24041abbc1}\usbccid.inf" "9" "4421fc7e7" "0000000000000170" "WinSta0\Default" "000000000000017C" "208" "f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:1312
  • C:\Windows\drives\HGBOT_x64.exe
    C:\Windows\drives\HGBOT_x64.exe
    1⤵
    • Executes dropped EXE
    PID:5036
  • C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe
    "C:\Windows\SysWOW64\WatchDataV5HaiGuan\WDTokenServer\WDTokenServerHaiGuan.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:260
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -s SCardSvr
    1⤵
      PID:4260
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:1608
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -s SCPolicySvc
      1⤵
        PID:5012
      • C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe
        "C:\Windows\SysWOW64\WatchDataV5HaiGuan\Watchdata CSP v5.1 HaiGuan\ccid_driver\WDDrvRpr_Share.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4928
      • C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        C:\Windows\drives\HDZB_USBKEY_2G_CEP_DevServer.exe
        1⤵
        • Executes dropped EXE
        PID:5096
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
        1⤵
          PID:2544
        • F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe
          "F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe"
          1⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Modifies trusted root certificate store through registry
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3284
        • C:\Windows\system32\wbem\wmiprvse.exe
          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
          1⤵
            PID:4864
          • C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe
            "C:\Program Files (x86)\EnterSafe\ePass3003_GFA\GFA_certd3003.exe"
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1472
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa39ce855 /state1:0x41c64e6d
            1⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:2792
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:4308
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k CameraMonitor
              1⤵
                PID:4756

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    System Services

                    1
                    T1569

                    Service Execution

                    1
                    T1569.002

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Power Settings

                    1
                    T1653

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    1
                    T1562

                    Modify Registry

                    4
                    T1112

                    Subvert Trust Controls

                    2
                    T1553

                    Install Root Certificate

                    2
                    T1553.004

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    2
                    T1120

                    Query Registry

                    3
                    T1012

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    uninst.exe
                    • Path C:\Program Files (x86)\EnterSafe\ePass3003_GFA\uninst.exe
                    • Size 75KB
                    • SHA256 108caeeedff9e51c8ce3cd0280ef3c203731ea21ba8a2e9f5660411c9f1bbf63
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                    • Size 727B
                    • SHA256 a8688726a968e062f5f43637e62d10d744593af3645530b99d426ae9c172d86c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                    • Size 727B
                    • SHA256 c95ed8fde8d66e7f86cc60e710bb43c3363e09f00ac089f9159af14657e3cd9b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                    • Size 727B
                    • SHA256 2a309b134ee2630cd8ac742660570286e0d0349d0181a317abf45a9de8058daf
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_52AC18C0BFCF05608C839EBE61380020
                    • Size 404B
                    • SHA256 f1a34f66fb10f641cfa85c69ae47f4b099880f5faba8cfd8e575cc916731987c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_624708336DBDEF89ED08B3F269A517C0
                    • Size 408B
                    • SHA256 e9c74776ec03bbe8f811f45db1b7fe116a29c34a7960d7e585b88f687ceba4c3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                    • Size 412B
                    • SHA256 a3d52e6c6f77a055afb30ffd4d06cb94c370cedc7bd06edce4b9a029fe4550a1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    TmpC73E.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\TmpC73E.tmp
                    • Size 1KB
                    • SHA256 fbe0571254b27a5a65de2bc673f028ca32d173d7ce6f1d8b07082ed3412a45d5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    UserInfo.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nscAF14.tmp\UserInfo.dll
                    • Size 4KB
                    • SHA256 728472ba312ae8af7f30d758ab473e0772477a68fcd1d2d547dafe6d8800d531
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nsExec.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nscAF14.tmp\nsExec.dll
                    • Size 6KB
                    • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    nsProcessW.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nscAF14.tmp\nsProcessW.dll
                    • Size 4KB
                    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsoB176.tmp\System.dll
                    • Size 11KB
                    • SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nspCCAF.tmp\System.dll
                    • Size 11KB
                    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    UserInfo.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nspCCAF.tmp\UserInfo.dll
                    • Size 4KB
                    • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    InstallOptions.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\InstallOptions.dll
                    • Size 14KB
                    • SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    KillProcDLL.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\KillProcDLL.dll
                    • Size 4KB
                    • SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    LangDLL.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\LangDLL.dll
                    • Size 5KB
                    • SHA256 fd26ef21d72797fedecd3d15f2001cea793383aceb3cee19a5ae2a3d30e197b6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SimpleSC.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\SimpleSC.dll
                    • Size 49KB
                    • SHA256 b549e39133b32eb4e67e239128c2b55467f01b4601c8147a6c8459d883169fa4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    System.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\System.dll
                    • Size 10KB
                    • SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ioSpecial.ini
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\ioSpecial.ini
                    • Size 726B
                    • SHA256 0fbd66d4a45a54f67bd175f3d131a4eb29a6b304da98508ad8125e38dcc76966
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ioSpecial.ini
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\ioSpecial.ini
                    • Size 589B
                    • SHA256 f98329b5a3690a020f760b7684a544d02f6a6d708eff22e61e0b61cc9bb38e34
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nsExec.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\nsy583A.tmp\nsExec.dll
                    • Size 6KB
                    • SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 64KB
                    • SHA256 f51a62961c61d1078b880ccbde7657ed462a07d0dcd043ab467a274cb4d83f93
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    usbccid.inf_amd64_1549826200fb969f.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\usbccid.inf_amd64_1549826200fb969f.ini
                    • Size 302B
                    • SHA256 0965aeb58b991f8227f71013598c50183835188cc6975baf305e44adeb57a1bd
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    HGBOT_x64.exe
                    • Path C:\Windows\drives\HGBOT_x64.exe
                    • Size 119KB
                    • SHA256 f32defafad6948db40d13b3e5fcde3a8192fa33bd64ff7b77a6c2438c5c46aac
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CnEport.Pub.Config.dll
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.Config.dll
                    • Size 18KB
                    • SHA256 0e02f0e4d50e14603fb32b0c1044c47a543016d23054703e59615b41530f417b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CnEport.Pub.WebSocket.ActiveX.dll
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WebSocket.ActiveX.dll
                    • Size 62KB
                    • SHA256 6ed0ea0aba1f6d1fa7398ec2fe5e9fec7c58dc7465189a3528751a030950c100
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    CnEport.Pub.WinService.InstallLog
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.InstallLog
                    • Size 338B
                    • SHA256 d7beb2f6fc5d105cde49e0d8da9d2eee4d41048038f78cdd1d92fdf335317be8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CnEport.Pub.WinService.InstallLog
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.InstallLog
                    • Size 843B
                    • SHA256 6fb5fb6c0868f8030e756023f4495d8c13688a2f57ab4482ff5f4fc82a647e09
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CnEport.Pub.WinService.exe
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\CnEport.Pub.WinService.exe
                    • Size 42KB
                    • SHA256 24a5e72a1c1c6d488a2c433e34485e1e70b7cb3656bd289b4b6b3ee7f8e2b3d8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Log1.txt
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\ServiceLog\Log1.txt
                    • Size 3KB
                    • SHA256 cf49dcab337b042173776182dc377b34b9c6ba93445f02e57229ec3adb9aad0c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    Log1.txt
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\Log1.txt
                    • Size 4KB
                    • SHA256 87eb63b2d3711825663656c30c533e01d49b21f6be8089de5f8a2ac82d965903
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LogNum.dat
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\Log\SetAccessControl\LogNum.dat
                    • Size 1B
                    • SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a
                    • MD5 SHA1 SHA512
                    Submit Download

                    WinService.xml
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\conf\WinService.xml
                    • Size 1KB
                    • SHA256 3f81cfa937c6378949639616ae261d48de2a71ad69dd61cf4887b398e70fcffb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    DPinst64.exe
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\DPinst64.exe
                    • Size 663KB
                    • SHA256 ec2355c3e59b8d33b21a6ae5041783c45faa22d007384965ffbbfc4195c19853
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WDDriverR.exe
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\WDDriverR.exe
                    • Size 1.1MB
                    • SHA256 cc7e4b3bddb12097271456caf84f5b542095a1be73e742759c4851ace5fa35d3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Ds20Sign.dll
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\MOFCOM\Ds20Sign.dll
                    • Size 903KB
                    • SHA256 f32c4c945908324613dc7b6b55ae47cb56d429d10eb695a91d5d655e7238d724
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    GFACertEnroll.dll
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\libs\MOFCOM\GFACertEnroll.dll
                    • Size 239KB
                    • SHA256 9ae3736703a1ddf417fb326698b87569874dfff5f128563e7a4956700905d02c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    InstallUtil.exe
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\InstallUtil.exe
                    • Size 36KB
                    • SHA256 7f7d33e2e555acc3f6049fbaa6370bd1615af6526bdd47a96bb3a3c5fdf5601b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RegAsm.exe
                    • Path F:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\tools\RegAsm.exe
                    • Size 60KB
                    • SHA256 7552a38af69c7416a551a74379175c633b5e0f102d8a8f35922d5acf5a49cd08
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    usbccid.cat
                    • Path \??\f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\usbccid.cat
                    • Size 7KB
                    • SHA256 16d27ecd64c18a63005ffc21023b1b426f12d634e4d6d153cdc0668eb8873d2d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    usbccid.inf
                    • Path \??\f:\Öйúµç×Ó¿Ú°¶¿Í»§¶Ë¿Ø¼þ\drives\usbccid.inf
                    • Size 1KB
                    • SHA256 92adf715e8af162170b04bbb238dde9917f5b205800f816c99d23f24203511c2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/4268-339-0x0000000001880000-0x0000000001890000-memory.dmp
                    Download

                    memory/4268-340-0x00000000729C2000-0x00000000729C4000-memory.dmp
                    Download

                    memory/4360-301-0x0000000002780000-0x0000000002790000-memory.dmp
                    Download

                    memory/4360-303-0x0000000072722000-0x0000000072724000-memory.dmp
                    Download

                    memory/4856-118-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-110-0x0000000002391000-0x0000000002392000-memory.dmp
                    Download

                    memory/4856-124-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-134-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-135-0x0000000002391000-0x0000000002392000-memory.dmp
                    Download

                    memory/4856-136-0x0000000002391000-0x0000000002392000-memory.dmp
                    Download

                    memory/4856-302-0x0000000002391000-0x0000000002392000-memory.dmp
                    Download

                    memory/4856-273-0x00000000065B0000-0x0000000006696000-memory.dmp
                    Download

                    memory/4856-117-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-119-0x0000000002391000-0x0000000002392000-memory.dmp
                    Download

                    memory/4856-133-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-106-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-10-0x0000000002350000-0x0000000002361000-memory.dmp
                    Download

                    memory/4856-980-0x0000000002390000-0x0000000002393000-memory.dmp
                    Download

                    memory/4856-326-0x0000000004380000-0x0000000004391000-memory.dmp
                    Download